analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://google.com

Full analysis: https://app.any.run/tasks/82114868-cfe2-4689-896c-265a8525ecfa
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Analysis date: May 21, 2022, 08:31:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
loader
evasion
trojan
rat
redline
phishing
opendir
hiloti
systembc
arkei
vidar
socelars
tofsee
amadey
ransomware
stop
miner
Indicators:
MD5:

99999EBCFDB78DF077AD2727FD00969F

SHA1:

72FE95C5576EC634E214814A32AB785568EDA76A

SHA256:

05046F26C83E8C88B3DDAB2EAB63D0D16224AC1E564535FC75CDCEEE47A0938D

SSDEEP:

3:N8r3uK:2LuK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 4028)
      • PC_En-1653121520_setup.exe (PID: 2392)
      • setup_installer.exe (PID: 3868)
      • 6288a1ea208a4_fd04fb523d.exe (PID: 3792)
      • 6288a1e12b0d6_892f6331.exe (PID: 3340)
      • 6288a1ea208a4_fd04fb523d.tmp (PID: 4124)
      • 6288a1e916698_060a424.exe (PID: 732)
      • lBo5.exe (PID: 5976)
      • 6288a1e12b0d6_892f6331.tmp (PID: 4672)
      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • 6288a1e12b0d6_892f6331.exe (PID: 4964)
      • 6288a1e12b0d6_892f6331.tmp (PID: 5448)
      • 6288a1e5cf6a8_a26c67c.exe (PID: 2840)
      • poweroff.exe (PID: 2288)
      • poweroff.tmp (PID: 4084)
      • Gozhinudejae.exe (PID: 5484)
      • HB0pcaJov.exe (PID: 4752)
      • installer.exe (PID: 5652)
      • glmQaq.exe (PID: 5780)
      • msiexec.exe (PID: 3920)
      • chrome.exe (PID: 4672)
      • chrome.exe (PID: 1836)
      • VkeDxukYR.exe (PID: 3884)
      • explorer.exe (PID: 5464)
      • w8LTwns6t.exe (PID: 3836)
      • NiceProcessX32.bmp.exe (PID: 892)
      • 13.php.exe (PID: 1232)
      • cmd.exe (PID: 5616)
      • fxdd.bmp.exe (PID: 4212)
      • test33.bmp.exe (PID: 2328)
      • Service.bmp.exe (PID: 5028)
      • test33.bmp.exe (PID: 3248)
      • TrdngAnlzr22649.exe.exe (PID: 4020)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • utube2005.bmp.exe (PID: 4628)
      • K377K.exe (PID: 736)
      • Install.exe (PID: 5560)
      • download2.exe.exe (PID: 1152)
      • orxds.exe (PID: 4168)
      • build2.exe (PID: 1408)
      • setup.exe (PID: 5852)
      • Congiunto.exe.pif (PID: 5836)
      • ll.exe (PID: 4736)
      • Install.exe (PID: 1428)
    • Application was dropped or rewritten from another process

      • PC_En-1653121520_setup.exe (PID: 2392)
      • PC_En-1653121520_setup.exe (PID: 2940)
      • setup_installer.exe (PID: 3868)
      • 6288a1e12b0d6_892f6331.exe (PID: 3340)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 4024)
      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • 6288a1dfb8d08_cf8c29.exe (PID: 2024)
      • 6288a1e20c44b_63f4244e0.exe (PID: 2616)
      • 6288a1e5cf6a8_a26c67c.exe (PID: 2840)
      • 6288a1ea208a4_fd04fb523d.exe (PID: 3792)
      • 6288a1e443b77_fd2fce267.exe (PID: 4032)
      • 6288a1e916698_060a424.exe (PID: 732)
      • 6288a1e84c9ef_f8927b40db.exe (PID: 4168)
      • setup_install.exe (PID: 3680)
      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • 6288a1e84c9ef_f8927b40db.exe (PID: 1024)
      • 1518327346.exe (PID: 5096)
      • 7231574788.exe (PID: 4380)
      • 6288a1e12b0d6_892f6331.exe (PID: 4964)
      • Nihalehequ.exe (PID: 2752)
      • 7231574788.exe (PID: 4968)
      • UNiXVEI3wd.exe (PID: 4876)
      • Gozhinudejae.exe (PID: 5484)
      • poweroff.exe (PID: 2288)
      • HB0pcaJov.exe (PID: 4752)
      • Setup.exe (PID: 2696)
      • installer.exe (PID: 5652)
      • gcleaner.exe (PID: 916)
      • glmQaq.exe (PID: 5780)
      • strongix.exe (PID: 2060)
      • random.exe (PID: 6140)
      • random.exe (PID: 5932)
      • Power Off.exe (PID: 4812)
      • handselfdiy_0.exe (PID: 5980)
      • chrome.exe (PID: 4672)
      • b123.exe (PID: 5108)
      • Cleaner.exe (PID: 5776)
      • installer.exe (PID: 4760)
      • Qadddgh25r.exe (PID: 5460)
      • hPeKSFoca.exe (PID: 4740)
      • hPeKSFoca.exe (PID: 2620)
      • VkeDxukYR.exe (PID: 3884)
      • M2rf60JTO.exe (PID: 188)
      • Tabivuz.exe (PID: 5372)
      • w8LTwns6t.exe (PID: 3836)
      • NiceProcessX32.bmp.exe (PID: 892)
      • SetupMEXX.exe.exe (PID: 3988)
      • rrmix.exe.exe (PID: 5424)
      • 13.php.exe (PID: 1232)
      • Service.bmp.exe (PID: 5028)
      • Offscum.exe.exe (PID: 5208)
      • test33.bmp.exe (PID: 4064)
      • TrdngAnlzr22649.exe.exe (PID: 4020)
      • FJEfRXZ.exe.exe (PID: 648)
      • 6523.exe.exe (PID: 5352)
      • mixinte2001.bmp.exe (PID: 5816)
      • test33.bmp.exe (PID: 2328)
      • wam.exe.exe (PID: 2940)
      • Fenix_8.bmp.exe (PID: 1040)
      • Cleaner.exe (PID: 5820)
      • prolivv.bmp.exe (PID: 5996)
      • real2001.bmp.exe (PID: 5900)
      • mouvcfbd.exe (PID: 5584)
      • Cleaner.exe (PID: 4828)
      • lokes_1.bmp.exe (PID: 5500)
      • arabcode_crypted_3.bmp.exe (PID: 5728)
      • norm2.bmp.exe (PID: 1120)
      • olympteam_build_crypted_2.bmp.exe (PID: 4760)
      • fxdd.bmp.exe (PID: 4212)
      • ShortnessUnsol.bmp.exe (PID: 5856)
      • unmatured.bmp.exe (PID: 2960)
      • orxds.exe (PID: 4168)
      • test33.bmp.exe (PID: 5432)
      • test33.bmp.exe (PID: 3248)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • orxds.exe (PID: 1772)
      • build2.exe (PID: 5932)
      • build2.exe (PID: 1408)
      • 7AAAK.exe (PID: 3960)
      • NiceProcessX32.bmp.exe (PID: 4764)
      • 4M9D8.exe (PID: 4208)
      • mixinte2001.bmp.exe (PID: 2860)
      • random.exe.exe (PID: 1844)
      • FJEfRXZ.exe.exe (PID: 5432)
      • random.exe.exe (PID: 4176)
      • setup777.exe.exe (PID: 3956)
      • K377K.exe (PID: 736)
      • BFJJJ.exe (PID: 5408)
      • search_hyperfs_310.exe.exe (PID: 4896)
      • utube2005.bmp.exe (PID: 4628)
      • Install.exe (PID: 5560)
      • download2.exe.exe (PID: 1152)
      • Install.exe (PID: 1428)
      • InvisBrowser45856.exe (PID: 1036)
      • setup331.exe (PID: 4600)
      • ll.exe (PID: 3200)
      • ll.exe (PID: 4736)
      • setup.exe (PID: 5852)
      • orxds.exe (PID: 4708)
    • Executes PowerShell scripts

      • cmd.exe (PID: 844)
    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 3680)
      • rundll32.exe (PID: 5240)
      • rundll32.exe (PID: 5920)
      • Cleaner.exe (PID: 5776)
      • installer.exe (PID: 5652)
      • Cleaner.exe (PID: 5820)
      • Cleaner.exe (PID: 4828)
      • real2001.bmp.exe (PID: 5900)
      • UNiXVEI3wd.exe (PID: 4876)
      • b123.exe (PID: 5108)
      • rundll32.exe (PID: 3260)
      • build2.exe (PID: 1408)
      • taskkill.exe (PID: 916)
      • cmd.exe (PID: 4112)
      • random.exe.exe (PID: 4176)
      • cmd.exe (PID: 648)
      • conhost.exe (PID: 5852)
      • conhost.exe (PID: 3320)
      • find.exe (PID: 5864)
      • taskkill.exe (PID: 4296)
      • chrome.exe (PID: 3052)
      • conhost.exe (PID: 4648)
      • iexplore.exe (PID: 3404)
      • iexplore.exe (PID: 2908)
      • conhost.exe (PID: 2928)
      • cmd.exe (PID: 1732)
      • taskkill.exe (PID: 3148)
      • 7231574788.exe (PID: 4968)
      • conhost.exe (PID: 3580)
      • iexplore.exe (PID: 1068)
      • 6288a1e916698_060a424.exe (PID: 732)
      • SetupMEXX.exe.exe (PID: 3988)
      • cmd.exe (PID: 5120)
      • conhost.exe (PID: 4844)
      • chrome.exe (PID: 1448)
      • conhost.exe (PID: 5868)
      • WerFault.exe (PID: 4572)
      • chrome.exe (PID: 1560)
      • WerFault.exe (PID: 3732)
      • 6288a1e84c9ef_f8927b40db.exe (PID: 4168)
      • svchost.exe (PID: 4824)
      • chrome.exe (PID: 268)
      • test33.bmp.exe (PID: 4064)
      • ftp.exe (PID: 3348)
      • chrome.exe (PID: 3524)
      • msiexec.exe (PID: 4916)
      • tasklist.exe (PID: 3308)
      • BFJJJ.exe (PID: 5408)
      • wmiprvse.exe (PID: 400)
      • find.exe (PID: 2932)
      • schtasks.exe (PID: 4060)
      • chrome.exe (PID: 1632)
      • setup331.exe (PID: 4600)
      • chrome.exe (PID: 3504)
      • chrome.exe (PID: 2460)
      • cmd.exe (PID: 4700)
      • FJEfRXZ.exe.exe (PID: 648)
      • schtasks.exe (PID: 5392)
      • cmd.exe (PID: 5616)
      • conhost.exe (PID: 4968)
      • conhost.exe (PID: 1796)
      • svchost.exe (PID: 880)
      • chrome.exe (PID: 1836)
      • 1518327346.exe (PID: 5096)
      • conhost.exe (PID: 3960)
      • schtasks.exe (PID: 2456)
      • cmd.exe (PID: 3200)
      • 6288a1e5cf6a8_a26c67c.exe (PID: 2840)
      • chrome.exe (PID: 1228)
      • TrdngAnlzr22649.exe.exe (PID: 4020)
      • chrome.exe (PID: 3152)
      • find.exe (PID: 4676)
      • search_hyperfs_310.exe.exe (PID: 4896)
      • DllHost.exe (PID: 3048)
      • chrome.exe (PID: 3944)
      • conhost.exe (PID: 5616)
      • poweroff.exe (PID: 2288)
      • conhost.exe (PID: 3712)
      • arabcode_crypted_3.bmp.exe (PID: 5728)
      • conhost.exe (PID: 1192)
      • chrome.exe (PID: 940)
      • tasklist.exe (PID: 4324)
      • chrome.exe (PID: 1860)
      • download2.exe.exe (PID: 1152)
      • test33.bmp.exe (PID: 3248)
      • SearchProtocolHost.exe (PID: 4392)
      • chrome.exe (PID: 2036)
      • control.exe (PID: 2464)
      • conhost.exe (PID: 6128)
      • explorer.exe (PID: 3952)
      • conhost.exe (PID: 3884)
      • conhost.exe (PID: 4320)
      • chrome.exe (PID: 2712)
      • cmd.exe (PID: 5292)
      • WinRAR.exe (PID: 4028)
      • DllHost.exe (PID: 3992)
      • DllHost.exe (PID: 4500)
      • DllHost.exe (PID: 3636)
      • conhost.exe (PID: 4524)
      • hPeKSFoca.exe (PID: 2620)
      • taskkill.exe (PID: 3408)
      • chrome.exe (PID: 5828)
      • chrome.exe (PID: 2800)
      • NiceProcessX32.bmp.exe (PID: 892)
      • rundll32.exe (PID: 4812)
      • cmd.exe (PID: 4940)
      • chrome.exe (PID: 3968)
      • prolivv.bmp.exe (PID: 5996)
      • fxdd.bmp.exe (PID: 4212)
      • setup.exe (PID: 5852)
      • cmd.exe (PID: 5240)
      • build2.exe (PID: 5932)
      • PC_En-1653121520_setup.exe (PID: 2940)
      • cmd.exe (PID: 2672)
      • setup777.exe.exe (PID: 3956)
      • chrome.exe (PID: 6040)
      • timeout.exe (PID: 4248)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 4024)
      • mouvcfbd.exe (PID: 5584)
      • WerFault.exe (PID: 5132)
      • DllHost.exe (PID: 4276)
      • conhost.exe (PID: 2408)
      • chrome.exe (PID: 6100)
      • cmd.exe (PID: 5432)
      • cmd.exe (PID: 2636)
      • schtasks.exe (PID: 4272)
      • conhost.exe (PID: 2924)
      • rundll32.exe (PID: 3120)
      • setup_installer.exe (PID: 3868)
      • cmd.exe (PID: 4500)
      • conhost.exe (PID: 4912)
      • conhost.exe (PID: 5400)
      • sc.exe (PID: 4532)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • conhost.exe (PID: 2868)
      • Qadddgh25r.exe (PID: 5460)
      • 6288a1ea208a4_fd04fb523d.exe (PID: 3792)
      • conhost.exe (PID: 452)
      • Setup.exe (PID: 2696)
      • cmd.exe (PID: 1804)
      • chrome.exe (PID: 2180)
      • control.exe (PID: 5128)
      • Service.bmp.exe (PID: 5028)
      • DllHost.exe (PID: 4768)
      • strongix.exe (PID: 2060)
      • WerFault.exe (PID: 3832)
      • 6288a1e443b77_fd2fce267.exe (PID: 4032)
      • cmd.exe (PID: 3952)
      • WerFault.exe (PID: 4932)
      • icacls.exe (PID: 3152)
      • rrmix.exe.exe (PID: 5424)
      • reg.exe (PID: 4692)
      • random.exe (PID: 6140)
      • svchost.exe (PID: 2580)
      • cmd.exe (PID: 2992)
      • handselfdiy_0.exe (PID: 5980)
      • Congiunto.exe.pif (PID: 5836)
      • test33.bmp.exe (PID: 2328)
      • InstallUtil.exe (PID: 2924)
      • K377K.exe (PID: 736)
      • 6288a1e20c44b_63f4244e0.exe (PID: 2616)
      • olympteam_build_crypted_2.bmp.exe (PID: 4760)
      • utube2005.bmp.exe (PID: 4628)
      • cmd.exe (PID: 5224)
      • conhost.exe (PID: 1780)
      • 6288a1dfb8d08_cf8c29.exe (PID: 2024)
      • taskeng.exe (PID: 4104)
      • PC_En-1653121520_setup.exe (PID: 2392)
      • Install.exe (PID: 5560)
      • HB0pcaJov.exe (PID: 4752)
      • cmd.exe (PID: 4020)
      • conhost.exe (PID: 5200)
      • svchost.exe (PID: 4132)
      • 13.php.exe (PID: 1232)
      • ShortnessUnsol.bmp.exe (PID: 5856)
      • orxds.exe (PID: 4168)
      • M2rf60JTO.exe (PID: 188)
      • chrome.exe (PID: 3956)
      • DllHost.exe (PID: 4648)
      • DllHost.exe (PID: 5516)
      • DllHost.exe (PID: 3804)
      • cmd.exe (PID: 844)
      • AppLaunch.exe (PID: 2820)
      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • VkeDxukYR.exe (PID: 3884)
      • chrome.exe (PID: 3652)
      • NOTEPAD.EXE (PID: 2920)
      • Fenix_8.bmp.exe (PID: 1040)
      • ll.exe (PID: 3200)
      • conhost.exe (PID: 4692)
      • AppLaunch.exe (PID: 6016)
      • conhost.exe (PID: 5596)
      • test33.bmp.exe (PID: 5432)
      • glmQaq.exe (PID: 5780)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • cmd.exe (PID: 4852)
      • conhost.exe (PID: 5228)
      • svchost.exe (PID: 1860)
      • conhost.exe (PID: 5528)
      • FJEfRXZ.exe.exe (PID: 5432)
      • conhost.exe (PID: 3180)
      • chrome.exe (PID: 2516)
      • ftp.exe (PID: 2216)
      • conhost.exe (PID: 4780)
      • chrome.exe (PID: 3316)
      • hPeKSFoca.exe (PID: 4740)
      • NiceProcessX32.bmp.exe (PID: 4764)
      • InvisBrowser45856.exe (PID: 1036)
      • explorer.exe (PID: 5464)
      • AppLaunch.exe (PID: 564)
      • WerFault.exe (PID: 4524)
      • cmd.exe (PID: 3948)
      • conhost.exe (PID: 5456)
      • DllHost.exe (PID: 2076)
      • unmatured.bmp.exe (PID: 2960)
      • msiexec.exe (PID: 3672)
      • DllHost.exe (PID: 2232)
      • cmd.exe (PID: 4612)
      • 6523.exe.exe (PID: 5352)
      • Gozhinudejae.exe (PID: 5484)
      • cmd.exe (PID: 4300)
      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • chrome.exe (PID: 2984)
      • iexplore.exe (PID: 5236)
      • mixinte2001.bmp.exe (PID: 2860)
      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 1780)
      • WerFault.exe (PID: 4696)
      • chrome.exe (PID: 3460)
      • cmd.exe (PID: 3252)
      • 6288a1e84c9ef_f8927b40db.exe (PID: 1024)
      • cmd.exe (PID: 1036)
      • taskkill.exe (PID: 2456)
      • mixinte2001.bmp.exe (PID: 5816)
      • 6288a1e12b0d6_892f6331.exe (PID: 3340)
      • lokes_1.bmp.exe (PID: 5500)
      • findstr.exe (PID: 4680)
      • chrome.exe (PID: 2492)
      • conhost.exe (PID: 4204)
      • DllHost.exe (PID: 120)
      • cmd.exe (PID: 2536)
      • PING.EXE (PID: 2464)
      • conhost.exe (PID: 4224)
      • WerFault.exe (PID: 3664)
      • chrome.exe (PID: 3376)
      • WerFault.exe (PID: 4192)
      • wam.exe.exe (PID: 2940)
      • cmd.exe (PID: 3980)
      • orxds.exe (PID: 1772)
      • DllHost.exe (PID: 3376)
      • consent.exe (PID: 3176)
      • DllHost.exe (PID: 6092)
      • DllHost.exe (PID: 2496)
      • chrome.exe (PID: 4672)
      • SearchFilterHost.exe (PID: 4928)
      • conhost.exe (PID: 564)
      • powershell.exe (PID: 2772)
      • gcleaner.exe (PID: 916)
      • 4M9D8.exe (PID: 4208)
      • cmd.exe (PID: 5464)
      • ntvdm.exe (PID: 4972)
      • cmd.exe (PID: 5292)
      • cmd.exe (PID: 3280)
      • conhost.exe (PID: 4724)
      • cmd.exe (PID: 3296)
      • Congiunto.exe.pif (PID: 3316)
      • WerFault.exe (PID: 4820)
      • WinRAR.exe (PID: 3392)
      • 6288a1e12b0d6_892f6331.exe (PID: 4964)
      • cmd.exe (PID: 3836)
      • Offscum.exe.exe (PID: 5208)
      • 7AAAK.exe (PID: 3960)
      • cmd.exe (PID: 2192)
      • conhost.exe (PID: 1960)
      • sc.exe (PID: 3496)
      • AppLaunch.exe (PID: 5972)
      • conhost.exe (PID: 5572)
      • cmd.exe (PID: 5116)
      • chrome.exe (PID: 5384)
      • Tabivuz.exe (PID: 5372)
      • cmd.exe (PID: 5584)
      • chrome.exe (PID: 2464)
      • netsh.exe (PID: 2672)
      • chrome.exe (PID: 3344)
      • random.exe.exe (PID: 1844)
      • norm2.bmp.exe (PID: 1120)
      • conhost.exe (PID: 4908)
      • installer.exe (PID: 4760)
      • ll.exe (PID: 4736)
      • chrome.exe (PID: 1844)
      • chrome.exe (PID: 2212)
      • Install.exe (PID: 1428)
      • sc.exe (PID: 5984)
      • conhost.exe (PID: 4280)
      • Nihalehequ.exe (PID: 2752)
      • conhost.exe (PID: 2476)
      • conhost.exe (PID: 3044)
      • cmd.exe (PID: 2520)
      • tasklist.exe (PID: 6076)
      • 7231574788.exe (PID: 4380)
      • rundll32.exe (PID: 5332)
      • random.exe (PID: 5932)
      • w8LTwns6t.exe (PID: 3836)
      • chrome.exe (PID: 5360)
      • Power Off.exe (PID: 4812)
      • control.exe (PID: 5424)
      • taskkill.exe (PID: 4684)
      • rundll32.exe (PID: 5604)
      • find.exe (PID: 3464)
      • tasklist.exe (PID: 5080)
      • forfiles.exe (PID: 2456)
      • Congiunto.exe.pif (PID: 3000)
      • forfiles.exe (PID: 5916)
      • conhost.exe (PID: 5728)
      • conhost.exe (PID: 2476)
      • orxds.exe (PID: 4708)
      • cmd.exe (PID: 4112)
      • reg.exe (PID: 872)
      • cmd.exe (PID: 1992)
      • reg.exe (PID: 5828)
      • conhost.exe (PID: 6096)
      • rundll32.exe (PID: 2992)
      • schtasks.exe (PID: 932)
      • conhost.exe (PID: 2344)
      • schtasks.exe (PID: 5256)
      • WerFault.exe (PID: 5624)
      • findstr.exe (PID: 3868)
      • Congiunto.exe.pif (PID: 4812)
      • powershell.EXE (PID: 3888)
      • conhost.exe (PID: 1180)
      • PING.EXE (PID: 2088)
      • conhost.exe (PID: 5052)
      • schtasks.exe (PID: 4296)
      • conhost.exe (PID: 4088)
      • schtasks.exe (PID: 3580)
    • Actions looks like stealing of personal data

      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • cmd.exe (PID: 5224)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • svchost.exe (PID: 1860)
      • strongix.exe (PID: 2060)
      • b123.exe (PID: 5108)
      • UNiXVEI3wd.exe (PID: 4876)
      • AppLaunch.exe (PID: 5972)
      • rrmix.exe.exe (PID: 5424)
      • AppLaunch.exe (PID: 2820)
      • AppLaunch.exe (PID: 6016)
      • SetupMEXX.exe.exe (PID: 3988)
      • Offscum.exe.exe (PID: 5208)
      • ShortnessUnsol.bmp.exe (PID: 5856)
      • Fenix_8.bmp.exe (PID: 1040)
      • lokes_1.bmp.exe (PID: 5500)
      • InvisBrowser45856.exe (PID: 1036)
      • real2001.bmp.exe (PID: 5900)
      • rundll32.exe (PID: 3260)
      • download2.exe.exe (PID: 1152)
      • build2.exe (PID: 1408)
      • 7AAAK.exe (PID: 3960)
    • Stealing of credential data

      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • svchost.exe (PID: 1860)
      • real2001.bmp.exe (PID: 5900)
      • InvisBrowser45856.exe (PID: 1036)
      • rundll32.exe (PID: 3260)
      • build2.exe (PID: 1408)
    • Changes settings of System certificates

      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • installer.exe (PID: 5652)
      • svchost.exe (PID: 1860)
      • Gozhinudejae.exe (PID: 5484)
      • w8LTwns6t.exe (PID: 3836)
      • Service.bmp.exe (PID: 5028)
      • test33.bmp.exe (PID: 2328)
    • Steals credentials from Web Browsers

      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • svchost.exe (PID: 1860)
      • b123.exe (PID: 5108)
      • UNiXVEI3wd.exe (PID: 4876)
      • strongix.exe (PID: 2060)
      • AppLaunch.exe (PID: 5972)
      • rrmix.exe.exe (PID: 5424)
      • SetupMEXX.exe.exe (PID: 3988)
      • Offscum.exe.exe (PID: 5208)
      • AppLaunch.exe (PID: 6016)
      • Fenix_8.bmp.exe (PID: 1040)
      • real2001.bmp.exe (PID: 5900)
      • InvisBrowser45856.exe (PID: 1036)
      • build2.exe (PID: 1408)
      • AppLaunch.exe (PID: 2820)
    • Loads the Task Scheduler DLL interface

      • 7231574788.exe (PID: 4380)
      • schtasks.exe (PID: 3580)
    • Connects to CnC server

      • 6288a1e916698_060a424.exe (PID: 732)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • UNiXVEI3wd.exe (PID: 4876)
      • strongix.exe (PID: 2060)
      • w8LTwns6t.exe (PID: 3836)
      • Offscum.exe.exe (PID: 5208)
      • rrmix.exe.exe (PID: 5424)
      • Fenix_8.bmp.exe (PID: 1040)
      • AppLaunch.exe (PID: 5972)
      • AppLaunch.exe (PID: 2820)
      • AppLaunch.exe (PID: 6016)
      • orxds.exe (PID: 4168)
      • SetupMEXX.exe.exe (PID: 3988)
      • lokes_1.bmp.exe (PID: 5500)
      • ShortnessUnsol.bmp.exe (PID: 5856)
      • Service.bmp.exe (PID: 5028)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • 7AAAK.exe (PID: 3960)
      • 4M9D8.exe (PID: 4208)
      • svchost.exe (PID: 4132)
      • rundll32.exe (PID: 3260)
    • Application was injected by another process

      • svchost.exe (PID: 860)
    • Runs injected code in another process

      • rundll32.exe (PID: 5240)
      • rundll32.exe (PID: 5920)
      • rundll32.exe (PID: 5332)
    • Changes the autorun value in the registry

      • lBo5.exe (PID: 5976)
      • chrome.exe (PID: 4672)
      • FJEfRXZ.exe.exe (PID: 648)
      • test33.bmp.exe (PID: 2328)
      • FJEfRXZ.exe.exe (PID: 5432)
      • K377K.exe (PID: 736)
    • REDLINE was detected

      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • strongix.exe (PID: 2060)
      • rrmix.exe.exe (PID: 5424)
      • Offscum.exe.exe (PID: 5208)
      • Fenix_8.bmp.exe (PID: 1040)
      • AppLaunch.exe (PID: 5972)
      • AppLaunch.exe (PID: 2820)
      • AppLaunch.exe (PID: 6016)
      • SetupMEXX.exe.exe (PID: 3988)
      • lokes_1.bmp.exe (PID: 5500)
      • ShortnessUnsol.bmp.exe (PID: 5856)
      • 7AAAK.exe (PID: 3960)
      • 4M9D8.exe (PID: 4208)
    • REDLINE detected by memory dumps

      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • Offscum.exe.exe (PID: 5208)
      • rrmix.exe.exe (PID: 5424)
      • AppLaunch.exe (PID: 5972)
      • norm2.bmp.exe (PID: 1120)
      • AppLaunch.exe (PID: 6016)
      • AppLaunch.exe (PID: 2820)
      • AppLaunch.exe (PID: 564)
    • SYSTEMBC detected by memory dumps

      • 7231574788.exe (PID: 4380)
      • 7231574788.exe (PID: 4968)
    • ARKEI detected by memory dumps

      • UNiXVEI3wd.exe (PID: 4876)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3200)
      • orxds.exe (PID: 4168)
      • Service.bmp.exe (PID: 5028)
      • Service.bmp.exe (PID: 5028)
      • Install.exe (PID: 1428)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 4060)
      • MsiExec.exe (PID: 4364)
      • installer.exe (PID: 5652)
      • schtasks.exe (PID: 4272)
      • test33.bmp.exe (PID: 2328)
      • test33.bmp.exe (PID: 3248)
      • schtasks.exe (PID: 2456)
      • schtasks.exe (PID: 5392)
      • schtasks.exe (PID: 5256)
      • schtasks.exe (PID: 932)
      • schtasks.exe (PID: 4296)
    • HILOTI was detected

      • explorer.exe (PID: 5464)
    • ARKEI was detected

      • UNiXVEI3wd.exe (PID: 4876)
    • Disables Windows Defender

      • w8LTwns6t.exe (PID: 3836)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
    • SOCELARS was detected

      • w8LTwns6t.exe (PID: 3836)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
    • TOFSEE detected by memory dumps

      • 13.php.exe (PID: 1232)
      • svchost.exe (PID: 880)
    • Runs app for hidden code execution

      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 3252)
    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 2672)
    • Uses SVCHOST.EXE for hidden code execution

      • mouvcfbd.exe (PID: 5584)
      • svchost.exe (PID: 880)
    • AMADEY detected by memory dumps

      • fxdd.bmp.exe (PID: 4212)
      • orxds.exe (PID: 4168)
      • orxds.exe (PID: 1772)
    • AMADEY was detected

      • orxds.exe (PID: 4168)
    • Changes the Startup folder

      • reg.exe (PID: 4692)
    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 2672)
    • STOP was detected

      • test33.bmp.exe (PID: 3248)
    • MINER was detected

      • svchost.exe (PID: 4132)
    • TOFSEE was detected

      • svchost.exe (PID: 880)
    • Modifies exclusions in Windows Defender

      • svchost.exe (PID: 880)
  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1068)
      • chrome.exe (PID: 1860)
      • iexplore.exe (PID: 3404)
    • Checks supported languages

      • wmiprvse.exe (PID: 400)
      • WinRAR.exe (PID: 3392)
      • WinRAR.exe (PID: 4028)
      • PC_En-1653121520_setup.exe (PID: 2392)
      • setup_installer.exe (PID: 3868)
      • conhost.exe (PID: 3180)
      • setup_install.exe (PID: 3680)
      • cmd.exe (PID: 844)
      • powershell.exe (PID: 2772)
      • cmd.exe (PID: 3896)
      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • cmd.exe (PID: 3948)
      • cmd.exe (PID: 3952)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 4024)
      • cmd.exe (PID: 4020)
      • cmd.exe (PID: 3280)
      • 6288a1dfb8d08_cf8c29.exe (PID: 2024)
      • cmd.exe (PID: 2636)
      • 6288a1e12b0d6_892f6331.exe (PID: 3340)
      • cmd.exe (PID: 2992)
      • cmd.exe (PID: 1804)
      • 6288a1e20c44b_63f4244e0.exe (PID: 2616)
      • cmd.exe (PID: 3836)
      • cmd.exe (PID: 2536)
      • 6288a1e443b77_fd2fce267.exe (PID: 4032)
      • cmd.exe (PID: 2192)
      • 6288a1ea208a4_fd04fb523d.tmp (PID: 4124)
      • 6288a1ea208a4_fd04fb523d.exe (PID: 3792)
      • 6288a1e5cf6a8_a26c67c.exe (PID: 2840)
      • 6288a1e84c9ef_f8927b40db.exe (PID: 4168)
      • 6288a1e916698_060a424.exe (PID: 732)
      • 6288a1e12b0d6_892f6331.tmp (PID: 4672)
      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • lBo5.exe (PID: 5976)
      • 6288a1e84c9ef_f8927b40db.exe (PID: 1024)
      • 1518327346.exe (PID: 5096)
      • cmd.exe (PID: 4940)
      • conhost.exe (PID: 4968)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • conhost.exe (PID: 4280)
      • Nihalehequ.exe (PID: 2752)
      • cmd.exe (PID: 3980)
      • 7231574788.exe (PID: 4380)
      • 6288a1e12b0d6_892f6331.exe (PID: 4964)
      • Gozhinudejae.exe (PID: 5484)
      • 6288a1e12b0d6_892f6331.tmp (PID: 5448)
      • cmd.exe (PID: 5464)
      • conhost.exe (PID: 5572)
      • 7231574788.exe (PID: 4968)
      • UNiXVEI3wd.exe (PID: 4876)
      • poweroff.exe (PID: 2288)
      • poweroff.tmp (PID: 4084)
      • Power Off.exe (PID: 4812)
      • cmd.exe (PID: 5432)
      • conhost.exe (PID: 1192)
      • Setup.exe (PID: 2696)
      • cmd.exe (PID: 5224)
      • HB0pcaJov.exe (PID: 4752)
      • conhost.exe (PID: 2868)
      • installer.exe (PID: 5652)
      • cmd.exe (PID: 4700)
      • conhost.exe (PID: 4780)
      • glmQaq.exe (PID: 5780)
      • conhost.exe (PID: 4908)
      • msiexec.exe (PID: 3920)
      • gcleaner.exe (PID: 916)
      • cmd.exe (PID: 4612)
      • MsiExec.exe (PID: 5640)
      • strongix.exe (PID: 2060)
      • cmd.exe (PID: 5120)
      • conhost.exe (PID: 5200)
      • random.exe (PID: 6140)
      • random.exe (PID: 5932)
      • conhost.exe (PID: 4648)
      • cmd.exe (PID: 3200)
      • cmd.exe (PID: 4300)
      • conhost.exe (PID: 4692)
      • MsiExec.exe (PID: 5348)
      • handselfdiy_0.exe (PID: 5980)
      • conhost.exe (PID: 3884)
      • MsiExec.exe (PID: 4364)
      • conhost.exe (PID: 1796)
      • cmd.exe (PID: 5240)
      • cmd.exe (PID: 4852)
      • chrome.exe (PID: 4672)
      • conhost.exe (PID: 4912)
      • b123.exe (PID: 5108)
      • cmd.exe (PID: 3296)
      • conhost.exe (PID: 4224)
      • cmd.exe (PID: 1780)
      • conhost.exe (PID: 2408)
      • cmd.exe (PID: 648)
      • cmd.exe (PID: 5116)
      • conhost.exe (PID: 5528)
      • Cleaner.exe (PID: 5776)
      • conhost.exe (PID: 5868)
      • cmd.exe (PID: 1036)
      • conhost.exe (PID: 2924)
      • conhost.exe (PID: 3712)
      • cmd.exe (PID: 1732)
      • installer.exe (PID: 4760)
      • Qadddgh25r.exe (PID: 5460)
      • InstallUtil.exe (PID: 2924)
      • M2rf60JTO.exe (PID: 188)
      • hPeKSFoca.exe (PID: 4740)
      • hPeKSFoca.exe (PID: 2620)
      • VkeDxukYR.exe (PID: 3884)
      • w8LTwns6t.exe (PID: 3836)
      • Tabivuz.exe (PID: 5372)
      • SetupMEXX.exe.exe (PID: 3988)
      • Service.bmp.exe (PID: 5028)
      • NiceProcessX32.bmp.exe (PID: 892)
      • rrmix.exe.exe (PID: 5424)
      • Offscum.exe.exe (PID: 5208)
      • conhost.exe (PID: 2928)
      • 13.php.exe (PID: 1232)
      • TrdngAnlzr22649.exe.exe (PID: 4020)
      • test33.bmp.exe (PID: 4064)
      • 6523.exe.exe (PID: 5352)
      • Fenix_8.bmp.exe (PID: 1040)
      • FJEfRXZ.exe.exe (PID: 648)
      • mixinte2001.bmp.exe (PID: 5816)
      • wam.exe.exe (PID: 2940)
      • cmd.exe (PID: 5292)
      • test33.bmp.exe (PID: 2328)
      • conhost.exe (PID: 4204)
      • conhost.exe (PID: 3960)
      • prolivv.bmp.exe (PID: 5996)
      • conhost.exe (PID: 5596)
      • cmd.exe (PID: 5616)
      • Cleaner.exe (PID: 5820)
      • real2001.bmp.exe (PID: 5900)
      • conhost.exe (PID: 564)
      • AppLaunch.exe (PID: 5972)
      • conhost.exe (PID: 2476)
      • conhost.exe (PID: 4724)
      • mouvcfbd.exe (PID: 5584)
      • conhost.exe (PID: 1780)
      • conhost.exe (PID: 5852)
      • lokes_1.bmp.exe (PID: 5500)
      • Cleaner.exe (PID: 4828)
      • conhost.exe (PID: 4844)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 4500)
      • conhost.exe (PID: 3580)
      • arabcode_crypted_3.bmp.exe (PID: 5728)
      • norm2.bmp.exe (PID: 1120)
      • fxdd.bmp.exe (PID: 4212)
      • conhost.exe (PID: 452)
      • olympteam_build_crypted_2.bmp.exe (PID: 4760)
      • ShortnessUnsol.bmp.exe (PID: 5856)
      • unmatured.bmp.exe (PID: 2960)
      • conhost.exe (PID: 5616)
      • AppLaunch.exe (PID: 564)
      • AppLaunch.exe (PID: 2820)
      • AppLaunch.exe (PID: 6016)
      • orxds.exe (PID: 4168)
      • conhost.exe (PID: 5456)
      • cmd.exe (PID: 5584)
      • conhost.exe (PID: 1960)
      • conhost.exe (PID: 4320)
      • cmd.exe (PID: 5292)
      • test33.bmp.exe (PID: 5432)
      • Congiunto.exe.pif (PID: 5836)
      • test33.bmp.exe (PID: 3248)
      • build2.exe (PID: 5932)
      • conhost.exe (PID: 5228)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • conhost.exe (PID: 6128)
      • build2.exe (PID: 1408)
      • orxds.exe (PID: 1772)
      • 7AAAK.exe (PID: 3960)
      • 4M9D8.exe (PID: 4208)
      • NiceProcessX32.bmp.exe (PID: 4764)
      • setup777.exe.exe (PID: 3956)
      • mixinte2001.bmp.exe (PID: 2860)
      • random.exe.exe (PID: 1844)
      • FJEfRXZ.exe.exe (PID: 5432)
      • K377K.exe (PID: 736)
      • random.exe.exe (PID: 4176)
      • conhost.exe (PID: 3320)
      • conhost.exe (PID: 5400)
      • cmd.exe (PID: 3252)
      • cmd.exe (PID: 2672)
      • BFJJJ.exe (PID: 5408)
      • search_hyperfs_310.exe.exe (PID: 4896)
      • utube2005.bmp.exe (PID: 4628)
      • Install.exe (PID: 5560)
      • download2.exe.exe (PID: 1152)
      • Install.exe (PID: 1428)
      • InvisBrowser45856.exe (PID: 1036)
      • setup331.exe (PID: 4600)
      • conhost.exe (PID: 4524)
      • ll.exe (PID: 3200)
      • ll.exe (PID: 4736)
      • setup.exe (PID: 5852)
      • setup.tmp (PID: 6100)
      • conhost.exe (PID: 3044)
      • cmd.exe (PID: 2520)
      • Congiunto.exe.pif (PID: 3000)
      • conhost.exe (PID: 2476)
      • conhost.exe (PID: 5728)
      • orxds.exe (PID: 4708)
      • conhost.exe (PID: 6096)
      • conhost.exe (PID: 2344)
      • Congiunto.exe.pif (PID: 4812)
      • conhost.exe (PID: 1180)
      • powershell.EXE (PID: 3888)
      • conhost.exe (PID: 5052)
      • conhost.exe (PID: 4088)
    • Reads the computer name

      • wmiprvse.exe (PID: 400)
      • WinRAR.exe (PID: 3392)
      • WinRAR.exe (PID: 4028)
      • PC_En-1653121520_setup.exe (PID: 2392)
      • setup_installer.exe (PID: 3868)
      • powershell.exe (PID: 2772)
      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 4024)
      • 6288a1e443b77_fd2fce267.exe (PID: 4032)
      • 6288a1e12b0d6_892f6331.tmp (PID: 4672)
      • 6288a1ea208a4_fd04fb523d.tmp (PID: 4124)
      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • 6288a1dfb8d08_cf8c29.exe (PID: 2024)
      • 6288a1e916698_060a424.exe (PID: 732)
      • 6288a1e5cf6a8_a26c67c.exe (PID: 2840)
      • lBo5.exe (PID: 5976)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • 1518327346.exe (PID: 5096)
      • 7231574788.exe (PID: 4380)
      • Nihalehequ.exe (PID: 2752)
      • 6288a1e12b0d6_892f6331.tmp (PID: 5448)
      • Gozhinudejae.exe (PID: 5484)
      • 7231574788.exe (PID: 4968)
      • poweroff.tmp (PID: 4084)
      • Setup.exe (PID: 2696)
      • HB0pcaJov.exe (PID: 4752)
      • installer.exe (PID: 5652)
      • msiexec.exe (PID: 3920)
      • MsiExec.exe (PID: 5640)
      • random.exe (PID: 5932)
      • Power Off.exe (PID: 4812)
      • random.exe (PID: 6140)
      • glmQaq.exe (PID: 5780)
      • gcleaner.exe (PID: 916)
      • handselfdiy_0.exe (PID: 5980)
      • MsiExec.exe (PID: 5348)
      • chrome.exe (PID: 4672)
      • b123.exe (PID: 5108)
      • MsiExec.exe (PID: 4364)
      • UNiXVEI3wd.exe (PID: 4876)
      • Cleaner.exe (PID: 5776)
      • strongix.exe (PID: 2060)
      • installer.exe (PID: 4760)
      • VkeDxukYR.exe (PID: 3884)
      • w8LTwns6t.exe (PID: 3836)
      • Service.bmp.exe (PID: 5028)
      • rrmix.exe.exe (PID: 5424)
      • Offscum.exe.exe (PID: 5208)
      • Fenix_8.bmp.exe (PID: 1040)
      • wam.exe.exe (PID: 2940)
      • 13.php.exe (PID: 1232)
      • test33.bmp.exe (PID: 2328)
      • Cleaner.exe (PID: 5820)
      • AppLaunch.exe (PID: 5972)
      • Cleaner.exe (PID: 4828)
      • norm2.bmp.exe (PID: 1120)
      • mouvcfbd.exe (PID: 5584)
      • AppLaunch.exe (PID: 564)
      • AppLaunch.exe (PID: 2820)
      • AppLaunch.exe (PID: 6016)
      • fxdd.bmp.exe (PID: 4212)
      • orxds.exe (PID: 4168)
      • SetupMEXX.exe.exe (PID: 3988)
      • mixinte2001.bmp.exe (PID: 5816)
      • real2001.bmp.exe (PID: 5900)
      • TrdngAnlzr22649.exe.exe (PID: 4020)
      • lokes_1.bmp.exe (PID: 5500)
      • ShortnessUnsol.bmp.exe (PID: 5856)
      • Congiunto.exe.pif (PID: 5836)
      • test33.bmp.exe (PID: 3248)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • build2.exe (PID: 1408)
      • orxds.exe (PID: 1772)
      • 7AAAK.exe (PID: 3960)
      • setup777.exe.exe (PID: 3956)
      • random.exe.exe (PID: 1844)
      • random.exe.exe (PID: 4176)
      • BFJJJ.exe (PID: 5408)
      • search_hyperfs_310.exe.exe (PID: 4896)
      • K377K.exe (PID: 736)
      • download2.exe.exe (PID: 1152)
      • Install.exe (PID: 1428)
      • 4M9D8.exe (PID: 4208)
      • setup331.exe (PID: 4600)
      • InvisBrowser45856.exe (PID: 1036)
      • ll.exe (PID: 3200)
      • ll.exe (PID: 4736)
      • setup.tmp (PID: 6100)
      • mixinte2001.bmp.exe (PID: 2860)
      • Congiunto.exe.pif (PID: 4812)
      • powershell.EXE (PID: 3888)
    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1632)
    • Reads Windows owner or organization settings

      • wmiprvse.exe (PID: 400)
      • 6288a1ea208a4_fd04fb523d.tmp (PID: 4124)
      • 6288a1e12b0d6_892f6331.tmp (PID: 4672)
      • 6288a1e12b0d6_892f6331.tmp (PID: 5448)
      • poweroff.tmp (PID: 4084)
      • installer.exe (PID: 5652)
      • msiexec.exe (PID: 3920)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4028)
      • setup_installer.exe (PID: 3868)
      • PC_En-1653121520_setup.exe (PID: 2392)
      • 6288a1ea208a4_fd04fb523d.exe (PID: 3792)
      • 6288a1e12b0d6_892f6331.exe (PID: 3340)
      • 6288a1ea208a4_fd04fb523d.tmp (PID: 4124)
      • 6288a1e916698_060a424.exe (PID: 732)
      • lBo5.exe (PID: 5976)
      • 6288a1e12b0d6_892f6331.tmp (PID: 4672)
      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • 6288a1e12b0d6_892f6331.exe (PID: 4964)
      • 6288a1e12b0d6_892f6331.tmp (PID: 5448)
      • 6288a1e5cf6a8_a26c67c.exe (PID: 2840)
      • poweroff.exe (PID: 2288)
      • poweroff.tmp (PID: 4084)
      • Gozhinudejae.exe (PID: 5484)
      • HB0pcaJov.exe (PID: 4752)
      • glmQaq.exe (PID: 5780)
      • installer.exe (PID: 5652)
      • msiexec.exe (PID: 3920)
      • chrome.exe (PID: 4672)
      • explorer.exe (PID: 5464)
      • chrome.exe (PID: 1836)
      • VkeDxukYR.exe (PID: 3884)
      • NiceProcessX32.bmp.exe (PID: 892)
      • w8LTwns6t.exe (PID: 3836)
      • 13.php.exe (PID: 1232)
      • cmd.exe (PID: 5616)
      • fxdd.bmp.exe (PID: 4212)
      • test33.bmp.exe (PID: 2328)
      • Service.bmp.exe (PID: 5028)
      • test33.bmp.exe (PID: 3248)
      • TrdngAnlzr22649.exe.exe (PID: 4020)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • utube2005.bmp.exe (PID: 4628)
      • K377K.exe (PID: 736)
      • Install.exe (PID: 5560)
      • download2.exe.exe (PID: 1152)
      • orxds.exe (PID: 4168)
      • build2.exe (PID: 1408)
      • setup.exe (PID: 5852)
      • Congiunto.exe.pif (PID: 5836)
      • ll.exe (PID: 4736)
      • Install.exe (PID: 1428)
    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 4028)
      • PC_En-1653121520_setup.exe (PID: 2392)
      • setup_installer.exe (PID: 3868)
      • 6288a1ea208a4_fd04fb523d.exe (PID: 3792)
      • 6288a1e12b0d6_892f6331.exe (PID: 3340)
      • 6288a1ea208a4_fd04fb523d.tmp (PID: 4124)
      • 6288a1e916698_060a424.exe (PID: 732)
      • lBo5.exe (PID: 5976)
      • 6288a1e12b0d6_892f6331.tmp (PID: 4672)
      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • 6288a1e12b0d6_892f6331.exe (PID: 4964)
      • 6288a1e12b0d6_892f6331.tmp (PID: 5448)
      • 6288a1e5cf6a8_a26c67c.exe (PID: 2840)
      • poweroff.exe (PID: 2288)
      • poweroff.tmp (PID: 4084)
      • Gozhinudejae.exe (PID: 5484)
      • HB0pcaJov.exe (PID: 4752)
      • installer.exe (PID: 5652)
      • glmQaq.exe (PID: 5780)
      • msiexec.exe (PID: 3920)
      • chrome.exe (PID: 4672)
      • explorer.exe (PID: 5464)
      • chrome.exe (PID: 1836)
      • VkeDxukYR.exe (PID: 3884)
      • w8LTwns6t.exe (PID: 3836)
      • NiceProcessX32.bmp.exe (PID: 892)
      • 13.php.exe (PID: 1232)
      • cmd.exe (PID: 5616)
      • fxdd.bmp.exe (PID: 4212)
      • test33.bmp.exe (PID: 2328)
      • Service.bmp.exe (PID: 5028)
      • test33.bmp.exe (PID: 3248)
      • TrdngAnlzr22649.exe.exe (PID: 4020)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • utube2005.bmp.exe (PID: 4628)
      • K377K.exe (PID: 736)
      • Install.exe (PID: 5560)
      • download2.exe.exe (PID: 1152)
      • orxds.exe (PID: 4168)
      • build2.exe (PID: 1408)
      • setup.exe (PID: 5852)
      • Congiunto.exe.pif (PID: 5836)
      • ll.exe (PID: 4736)
      • Install.exe (PID: 1428)
    • Application launched itself

      • WinRAR.exe (PID: 3392)
      • 6288a1dfb8d08_cf8c29.exe (PID: 2024)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 4024)
      • 6288a1e84c9ef_f8927b40db.exe (PID: 4168)
      • random.exe (PID: 6140)
      • hPeKSFoca.exe (PID: 4740)
      • test33.bmp.exe (PID: 4064)
      • cmd.exe (PID: 4112)
      • test33.bmp.exe (PID: 2328)
      • test33.bmp.exe (PID: 5432)
      • build2.exe (PID: 5932)
      • random.exe.exe (PID: 1844)
      • cmd.exe (PID: 3252)
      • svchost.exe (PID: 880)
      • ll.exe (PID: 3200)
      • Congiunto.exe.pif (PID: 5836)
    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 3680)
      • 6288a1e916698_060a424.exe (PID: 732)
      • Gozhinudejae.exe (PID: 5484)
      • glmQaq.exe (PID: 5780)
      • gcleaner.exe (PID: 916)
      • chrome.exe (PID: 4672)
      • 6288a1e5cf6a8_a26c67c.exe (PID: 2840)
      • 13.php.exe (PID: 1232)
      • FJEfRXZ.exe.exe (PID: 648)
      • cmd.exe (PID: 4112)
      • orxds.exe (PID: 4168)
      • mixinte2001.bmp.exe (PID: 5816)
      • FJEfRXZ.exe.exe (PID: 5432)
      • cmd.exe (PID: 3252)
      • mixinte2001.bmp.exe (PID: 2860)
      • forfiles.exe (PID: 2456)
      • forfiles.exe (PID: 5916)
    • Reads the Windows organization settings

      • 6288a1ea208a4_fd04fb523d.tmp (PID: 4124)
      • wmiprvse.exe (PID: 400)
      • 6288a1e12b0d6_892f6331.tmp (PID: 4672)
      • 6288a1e12b0d6_892f6331.tmp (PID: 5448)
      • poweroff.tmp (PID: 4084)
      • installer.exe (PID: 5652)
      • msiexec.exe (PID: 3920)
    • Adds / modifies Windows certificates

      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • installer.exe (PID: 5652)
      • Gozhinudejae.exe (PID: 5484)
      • w8LTwns6t.exe (PID: 3836)
      • Service.bmp.exe (PID: 5028)
      • test33.bmp.exe (PID: 2328)
    • Loads DLL from Mozilla Firefox

      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • InvisBrowser45856.exe (PID: 1036)
    • Reads CPU info

      • wmiprvse.exe (PID: 400)
      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • HB0pcaJov.exe (PID: 4752)
      • glmQaq.exe (PID: 5780)
      • b123.exe (PID: 5108)
      • UNiXVEI3wd.exe (PID: 4876)
      • real2001.bmp.exe (PID: 5900)
      • build2.exe (PID: 1408)
      • InvisBrowser45856.exe (PID: 1036)
    • Reads the date of Windows installation

      • wmiprvse.exe (PID: 400)
      • powershell.EXE (PID: 3888)
    • Reads Environment values

      • lBo5.exe (PID: 5976)
      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • Nihalehequ.exe (PID: 2752)
      • Gozhinudejae.exe (PID: 5484)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • installer.exe (PID: 5652)
      • HB0pcaJov.exe (PID: 4752)
      • MsiExec.exe (PID: 5640)
      • glmQaq.exe (PID: 5780)
      • MsiExec.exe (PID: 5348)
      • chrome.exe (PID: 4672)
      • Cleaner.exe (PID: 5776)
      • b123.exe (PID: 5108)
      • UNiXVEI3wd.exe (PID: 4876)
      • strongix.exe (PID: 2060)
      • Offscum.exe.exe (PID: 5208)
      • Fenix_8.bmp.exe (PID: 1040)
      • netsh.exe (PID: 2672)
      • Cleaner.exe (PID: 5820)
      • Cleaner.exe (PID: 4828)
      • AppLaunch.exe (PID: 2820)
      • wam.exe.exe (PID: 2940)
      • AppLaunch.exe (PID: 6016)
      • SetupMEXX.exe.exe (PID: 3988)
      • AppLaunch.exe (PID: 5972)
      • ShortnessUnsol.bmp.exe (PID: 5856)
      • rrmix.exe.exe (PID: 5424)
      • lokes_1.bmp.exe (PID: 5500)
      • K377K.exe (PID: 736)
      • real2001.bmp.exe (PID: 5900)
      • 4M9D8.exe (PID: 4208)
      • build2.exe (PID: 1408)
      • 7AAAK.exe (PID: 3960)
    • Reads Windows Product ID

      • wmiprvse.exe (PID: 400)
    • Creates files in the program directory

      • WerFault.exe (PID: 4192)
      • svchost.exe (PID: 860)
      • b123.exe (PID: 5108)
      • WerFault.exe (PID: 5132)
      • WerFault.exe (PID: 4820)
      • WerFault.exe (PID: 4524)
      • WerFault.exe (PID: 4696)
      • Service.bmp.exe (PID: 5028)
      • real2001.bmp.exe (PID: 5900)
      • build2.exe (PID: 1408)
    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 2464)
      • wmiprvse.exe (PID: 400)
      • control.exe (PID: 5128)
      • orxds.exe (PID: 4168)
      • control.exe (PID: 5424)
    • Creates files in the Windows directory

      • 7231574788.exe (PID: 4380)
      • svchost.exe (PID: 860)
      • svchost.exe (PID: 1860)
      • svchost.exe (PID: 880)
      • schtasks.exe (PID: 3580)
    • Executed via WMI

      • rundll32.exe (PID: 5240)
      • rundll32.exe (PID: 5920)
    • Searches for installed software

      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • svchost.exe (PID: 1860)
      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • glmQaq.exe (PID: 5780)
      • b123.exe (PID: 5108)
      • UNiXVEI3wd.exe (PID: 4876)
      • strongix.exe (PID: 2060)
      • AppLaunch.exe (PID: 2820)
      • AppLaunch.exe (PID: 5972)
      • AppLaunch.exe (PID: 6016)
      • ShortnessUnsol.bmp.exe (PID: 5856)
      • rrmix.exe.exe (PID: 5424)
      • SetupMEXX.exe.exe (PID: 3988)
      • Fenix_8.bmp.exe (PID: 1040)
      • real2001.bmp.exe (PID: 5900)
      • build2.exe (PID: 1408)
      • Offscum.exe.exe (PID: 5208)
      • 7AAAK.exe (PID: 3960)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 5464)
      • MsiExec.exe (PID: 5348)
      • cmd.exe (PID: 3296)
      • cmd.exe (PID: 648)
      • cmd.exe (PID: 5292)
      • cmd.exe (PID: 2520)
    • Creates a directory in Program Files

      • lBo5.exe (PID: 5976)
      • poweroff.tmp (PID: 4084)
      • msiexec.exe (PID: 3920)
      • Service.bmp.exe (PID: 5028)
    • Creates files in the user directory

      • 6288a1e5cf6a8_a26c67c.exe (PID: 2840)
      • installer.exe (PID: 5652)
      • HB0pcaJov.exe (PID: 4752)
      • glmQaq.exe (PID: 5780)
      • svchost.exe (PID: 1860)
      • b123.exe (PID: 5108)
      • UNiXVEI3wd.exe (PID: 4876)
      • chrome.exe (PID: 4672)
      • explorer.exe (PID: 3952)
      • K377K.exe (PID: 736)
      • orxds.exe (PID: 4168)
    • Executed via Task Scheduler

      • 7231574788.exe (PID: 4968)
      • Tabivuz.exe (PID: 5372)
      • orxds.exe (PID: 1772)
      • orxds.exe (PID: 4708)
      • powershell.EXE (PID: 3888)
    • Starts Internet Explorer

      • Nihalehequ.exe (PID: 2752)
    • Reads the cookies of Mozilla Firefox

      • 6288a1df09dd5_9fbf0bcee0.exe (PID: 5772)
      • strongix.exe (PID: 2060)
      • AppLaunch.exe (PID: 5972)
      • rrmix.exe.exe (PID: 5424)
      • SetupMEXX.exe.exe (PID: 3988)
      • Offscum.exe.exe (PID: 5208)
      • AppLaunch.exe (PID: 6016)
      • Fenix_8.bmp.exe (PID: 1040)
      • build2.exe (PID: 1408)
      • AppLaunch.exe (PID: 2820)
    • Check for Java to be installed

      • MsiExec.exe (PID: 5640)
      • MsiExec.exe (PID: 5348)
    • Starts Microsoft Installer

      • installer.exe (PID: 5652)
    • Checks for external IP

      • svchost.exe (PID: 1860)
      • w8LTwns6t.exe (PID: 3836)
      • Service.bmp.exe (PID: 5028)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
    • Reads mouse settings

      • Tabivuz.exe (PID: 5372)
      • Congiunto.exe.pif (PID: 5836)
      • Congiunto.exe.pif (PID: 4812)
    • Creates executable files which already exist in Windows

      • WerFault.exe (PID: 4524)
    • Starts SC.EXE for service management

      • 13.php.exe (PID: 1232)
    • Executed as Windows Service

      • mouvcfbd.exe (PID: 5584)
    • Uses NETSH.EXE for network configuration

      • 13.php.exe (PID: 1232)
    • Creates or modifies windows services

      • svchost.exe (PID: 880)
    • Starts itself from another location

      • fxdd.bmp.exe (PID: 4212)
      • utube2005.bmp.exe (PID: 4628)
    • Uses ICACLS.EXE to modify access control list

      • test33.bmp.exe (PID: 2328)
    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 5584)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 1992)
    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 2672)
    • Starts application with an unusual extension

      • cmd.exe (PID: 4500)
      • Congiunto.exe.pif (PID: 5836)
      • cmd.exe (PID: 2672)
    • Removes files from Windows directory

      • svchost.exe (PID: 860)
    • Executes application which crashes

      • TrdngAnlzr22649.exe.exe (PID: 4020)
    • Reads default file associations for system extensions

      • setup331.exe (PID: 4600)
    • Executes PowerShell scripts

      • powershell.EXE (PID: 3888)
  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2908)
      • iexplore.exe (PID: 1068)
      • DllHost.exe (PID: 2076)
      • chrome.exe (PID: 1632)
      • chrome.exe (PID: 3652)
      • chrome.exe (PID: 2460)
      • chrome.exe (PID: 268)
      • chrome.exe (PID: 1844)
      • chrome.exe (PID: 2516)
      • chrome.exe (PID: 1860)
      • DllHost.exe (PID: 2496)
      • DllHost.exe (PID: 3636)
      • chrome.exe (PID: 2800)
      • consent.exe (PID: 3176)
      • DllHost.exe (PID: 3048)
      • svchost.exe (PID: 2580)
      • WerFault.exe (PID: 4192)
      • control.exe (PID: 2464)
      • rundll32.exe (PID: 5240)
      • taskkill.exe (PID: 916)
      • svchost.exe (PID: 1860)
      • taskeng.exe (PID: 4104)
      • svchost.exe (PID: 4824)
      • iexplore.exe (PID: 5236)
      • iexplore.exe (PID: 3404)
      • chrome.exe (PID: 6100)
      • SearchProtocolHost.exe (PID: 4392)
      • explorer.exe (PID: 5464)
      • DllHost.exe (PID: 3992)
      • schtasks.exe (PID: 4060)
      • msiexec.exe (PID: 4916)
      • taskkill.exe (PID: 2456)
      • DllHost.exe (PID: 6092)
      • taskkill.exe (PID: 3408)
      • rundll32.exe (PID: 5920)
      • WerFault.exe (PID: 4820)
      • taskkill.exe (PID: 4296)
      • WerFault.exe (PID: 5132)
      • explorer.exe (PID: 3952)
      • DllHost.exe (PID: 2232)
      • WerFault.exe (PID: 4524)
      • SearchFilterHost.exe (PID: 4928)
      • DllHost.exe (PID: 3376)
      • sc.exe (PID: 4532)
      • sc.exe (PID: 3496)
      • WerFault.exe (PID: 4696)
      • sc.exe (PID: 5984)
      • netsh.exe (PID: 2672)
      • ftp.exe (PID: 2216)
      • tasklist.exe (PID: 3308)
      • WerFault.exe (PID: 3832)
      • svchost.exe (PID: 880)
      • WerFault.exe (PID: 4572)
      • schtasks.exe (PID: 4272)
      • DllHost.exe (PID: 5516)
      • icacls.exe (PID: 3152)
      • taskkill.exe (PID: 3148)
      • WerFault.exe (PID: 3732)
      • tasklist.exe (PID: 6076)
      • PING.EXE (PID: 2464)
      • DllHost.exe (PID: 120)
      • WerFault.exe (PID: 3664)
      • schtasks.exe (PID: 2456)
      • schtasks.exe (PID: 5392)
      • DllHost.exe (PID: 4500)
      • DllHost.exe (PID: 4276)
      • ftp.exe (PID: 3348)
      • tasklist.exe (PID: 4324)
      • control.exe (PID: 5128)
      • DllHost.exe (PID: 4768)
      • DllHost.exe (PID: 3804)
      • svchost.exe (PID: 4132)
      • rundll32.exe (PID: 3260)
      • WerFault.exe (PID: 4932)
      • DllHost.exe (PID: 4648)
      • rundll32.exe (PID: 5332)
      • taskkill.exe (PID: 4684)
      • control.exe (PID: 5424)
      • tasklist.exe (PID: 5080)
      • schtasks.exe (PID: 932)
      • WerFault.exe (PID: 5624)
      • schtasks.exe (PID: 5256)
      • PING.EXE (PID: 2088)
      • schtasks.exe (PID: 4296)
      • schtasks.exe (PID: 3580)
    • Checks supported languages

      • iexplore.exe (PID: 2908)
      • DllHost.exe (PID: 2076)
      • iexplore.exe (PID: 1068)
      • chrome.exe (PID: 268)
      • chrome.exe (PID: 3052)
      • chrome.exe (PID: 1560)
      • chrome.exe (PID: 3652)
      • chrome.exe (PID: 1448)
      • chrome.exe (PID: 1632)
      • chrome.exe (PID: 2464)
      • chrome.exe (PID: 3504)
      • chrome.exe (PID: 2460)
      • chrome.exe (PID: 2984)
      • chrome.exe (PID: 1228)
      • chrome.exe (PID: 1844)
      • chrome.exe (PID: 2036)
      • chrome.exe (PID: 3316)
      • chrome.exe (PID: 3376)
      • chrome.exe (PID: 2180)
      • chrome.exe (PID: 3956)
      • chrome.exe (PID: 2712)
      • chrome.exe (PID: 940)
      • chrome.exe (PID: 2516)
      • chrome.exe (PID: 3344)
      • chrome.exe (PID: 3944)
      • chrome.exe (PID: 2212)
      • chrome.exe (PID: 2492)
      • chrome.exe (PID: 3968)
      • chrome.exe (PID: 1860)
      • NOTEPAD.EXE (PID: 2920)
      • chrome.exe (PID: 2800)
      • DllHost.exe (PID: 2496)
      • DllHost.exe (PID: 3636)
      • consent.exe (PID: 3176)
      • DllHost.exe (PID: 3048)
      • svchost.exe (PID: 2580)
      • WerFault.exe (PID: 4192)
      • control.exe (PID: 2464)
      • rundll32.exe (PID: 3120)
      • svchost.exe (PID: 860)
      • rundll32.exe (PID: 5240)
      • chrome.exe (PID: 6040)
      • taskkill.exe (PID: 916)
      • taskeng.exe (PID: 4104)
      • svchost.exe (PID: 4824)
      • svchost.exe (PID: 1860)
      • iexplore.exe (PID: 3404)
      • chrome.exe (PID: 6100)
      • iexplore.exe (PID: 5236)
      • SearchProtocolHost.exe (PID: 4392)
      • explorer.exe (PID: 5464)
      • DllHost.exe (PID: 3992)
      • msiexec.exe (PID: 4916)
      • schtasks.exe (PID: 4060)
      • chrome.exe (PID: 3460)
      • taskkill.exe (PID: 2456)
      • DllHost.exe (PID: 6092)
      • taskkill.exe (PID: 3408)
      • WerFault.exe (PID: 4820)
      • rundll32.exe (PID: 5920)
      • chrome.exe (PID: 5360)
      • timeout.exe (PID: 4248)
      • taskkill.exe (PID: 4296)
      • WerFault.exe (PID: 5132)
      • chrome.exe (PID: 3524)
      • chrome.exe (PID: 3152)
      • DllHost.exe (PID: 2232)
      • explorer.exe (PID: 3952)
      • chrome.exe (PID: 1836)
      • WerFault.exe (PID: 4524)
      • SearchFilterHost.exe (PID: 4928)
      • DllHost.exe (PID: 3376)
      • sc.exe (PID: 4532)
      • sc.exe (PID: 5984)
      • sc.exe (PID: 3496)
      • WerFault.exe (PID: 4696)
      • netsh.exe (PID: 2672)
      • ftp.exe (PID: 2216)
      • tasklist.exe (PID: 3308)
      • find.exe (PID: 4676)
      • WerFault.exe (PID: 3832)
      • svchost.exe (PID: 880)
      • chrome.exe (PID: 5828)
      • WerFault.exe (PID: 4572)
      • schtasks.exe (PID: 4272)
      • reg.exe (PID: 4692)
      • DllHost.exe (PID: 5516)
      • icacls.exe (PID: 3152)
      • WerFault.exe (PID: 3732)
      • taskkill.exe (PID: 3148)
      • find.exe (PID: 2932)
      • tasklist.exe (PID: 6076)
      • findstr.exe (PID: 4680)
      • PING.EXE (PID: 2464)
      • DllHost.exe (PID: 120)
      • WerFault.exe (PID: 3664)
      • schtasks.exe (PID: 5392)
      • schtasks.exe (PID: 2456)
      • DllHost.exe (PID: 4500)
      • ntvdm.exe (PID: 4972)
      • DllHost.exe (PID: 4276)
      • ftp.exe (PID: 3348)
      • tasklist.exe (PID: 4324)
      • find.exe (PID: 5864)
      • chrome.exe (PID: 5384)
      • control.exe (PID: 5128)
      • rundll32.exe (PID: 4812)
      • DllHost.exe (PID: 4768)
      • DllHost.exe (PID: 3804)
      • msiexec.exe (PID: 3672)
      • svchost.exe (PID: 4132)
      • rundll32.exe (PID: 3260)
      • WerFault.exe (PID: 4932)
      • DllHost.exe (PID: 4648)
      • rundll32.exe (PID: 5332)
      • taskkill.exe (PID: 4684)
      • control.exe (PID: 5424)
      • rundll32.exe (PID: 5604)
      • tasklist.exe (PID: 5080)
      • find.exe (PID: 3464)
      • forfiles.exe (PID: 2456)
      • forfiles.exe (PID: 5916)
      • cmd.exe (PID: 4112)
      • reg.exe (PID: 872)
      • reg.exe (PID: 5828)
      • cmd.exe (PID: 1992)
      • schtasks.exe (PID: 5256)
      • schtasks.exe (PID: 932)
      • rundll32.exe (PID: 2992)
      • WerFault.exe (PID: 5624)
      • findstr.exe (PID: 3868)
      • PING.EXE (PID: 2088)
      • schtasks.exe (PID: 4296)
      • schtasks.exe (PID: 3580)
    • Creates files in the user directory

      • iexplore.exe (PID: 1068)
      • iexplore.exe (PID: 3404)
    • Reads the date of Windows installation

      • iexplore.exe (PID: 2908)
      • chrome.exe (PID: 2800)
      • iexplore.exe (PID: 5236)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 1068)
      • iexplore.exe (PID: 2908)
      • chrome.exe (PID: 268)
      • 6288a1dfb8d08_cf8c29.exe (PID: 5220)
      • powershell.exe (PID: 2772)
      • lBo5.exe (PID: 5976)
      • Nihalehequ.exe (PID: 2752)
      • Gozhinudejae.exe (PID: 5484)
      • iexplore.exe (PID: 3404)
      • 6288a1de5a1db_30593f.exe (PID: 2516)
      • iexplore.exe (PID: 5236)
      • installer.exe (PID: 5652)
      • svchost.exe (PID: 1860)
      • random.exe (PID: 5932)
      • msiexec.exe (PID: 3920)
      • handselfdiy_0.exe (PID: 5980)
      • chrome.exe (PID: 4672)
      • MsiExec.exe (PID: 5348)
      • b123.exe (PID: 5108)
      • explorer.exe (PID: 5464)
      • explorer.exe (PID: 3952)
      • w8LTwns6t.exe (PID: 3836)
      • Service.bmp.exe (PID: 5028)
      • test33.bmp.exe (PID: 2328)
      • Offscum.exe.exe (PID: 5208)
      • wam.exe.exe (PID: 2940)
      • test33.bmp.exe (PID: 3248)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • random.exe.exe (PID: 4176)
      • real2001.bmp.exe (PID: 5900)
      • build2.exe (PID: 1408)
      • K377K.exe (PID: 736)
      • ll.exe (PID: 4736)
    • Reads internet explorer settings

      • iexplore.exe (PID: 1068)
      • iexplore.exe (PID: 3404)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1068)
      • iexplore.exe (PID: 2908)
      • consent.exe (PID: 3176)
      • powershell.exe (PID: 2772)
      • iexplore.exe (PID: 3404)
      • installer.exe (PID: 5652)
      • iexplore.exe (PID: 5236)
      • svchost.exe (PID: 1860)
      • msiexec.exe (PID: 3920)
      • handselfdiy_0.exe (PID: 5980)
      • b123.exe (PID: 5108)
      • MsiExec.exe (PID: 5348)
      • explorer.exe (PID: 5464)
      • explorer.exe (PID: 3952)
      • w8LTwns6t.exe (PID: 3836)
      • test33.bmp.exe (PID: 2328)
      • test33.bmp.exe (PID: 3248)
      • tde8etIr7miOb766p06Bs7fB.exe (PID: 5136)
      • real2001.bmp.exe (PID: 5900)
      • build2.exe (PID: 1408)
    • Application launched itself

      • iexplore.exe (PID: 2908)
      • chrome.exe (PID: 1632)
      • iexplore.exe (PID: 5236)
      • msiexec.exe (PID: 3920)
    • Changes internet zones settings

      • iexplore.exe (PID: 2908)
      • iexplore.exe (PID: 5236)
    • Manual execution by user

      • chrome.exe (PID: 1632)
      • Cleaner.exe (PID: 5820)
      • Cleaner.exe (PID: 4828)
    • Reads the hosts file

      • chrome.exe (PID: 268)
      • chrome.exe (PID: 1632)
    • Application was dropped or rewritten from another process

      • 6288a1e12b0d6_892f6331.tmp (PID: 4672)
      • 6288a1ea208a4_fd04fb523d.tmp (PID: 4124)
      • lBo5.exe (PID: 5976)
      • 6288a1e12b0d6_892f6331.tmp (PID: 5448)
      • poweroff.tmp (PID: 4084)
      • setup.tmp (PID: 6100)
    • Loads dropped or rewritten executable

      • 6288a1ea208a4_fd04fb523d.tmp (PID: 4124)
      • 6288a1e12b0d6_892f6331.tmp (PID: 5448)
      • 6288a1e12b0d6_892f6331.tmp (PID: 4672)
      • poweroff.tmp (PID: 4084)
      • MsiExec.exe (PID: 5348)
      • MsiExec.exe (PID: 5640)
      • MsiExec.exe (PID: 4364)
      • setup.tmp (PID: 6100)
      • msiexec.exe (PID: 3920)
      • lBo5.exe (PID: 5976)
    • Creates files in the program directory

      • lBo5.exe (PID: 5976)
      • poweroff.tmp (PID: 4084)
      • msiexec.exe (PID: 3920)
    • Creates a software uninstall entry

      • poweroff.tmp (PID: 4084)
      • msiexec.exe (PID: 3920)
    • Reads CPU info

      • svchost.exe (PID: 1860)
    • Reads Microsoft Office registry keys

      • MsiExec.exe (PID: 5640)
      • MsiExec.exe (PID: 5348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RedLine

(PID) Process(5772) 6288a1df09dd5_9fbf0bcee0.exe
C2 (1)141.95.211.151:34846
Botnetbernard03
Err_msg
Auth_value79ef71b2b79b4bbfc450d11fa1720cea
US (165)
LEnvironmentogiEnvironmentn DatEnvironmenta
Environment
WSystem.Texteb DatSystem.Texta
System.Text
CoCryptographyokieCryptographys
Cryptography
ExtGenericension CooGenerickies
Generic
OFileInfopeFileInfora GFileInfoX StabFileInfole
FileInfo
OpLinqera GLinqX
Linq
ApGenericpDaGenericta\RGenericoamiGenericng\
Network
Extension
UNKNOWN
.
1
cFileStreamredFileStreamit_cFileStreamardFileStreams
FileStream
\
Host
Port
:
User
Pass
cookies.sqlite
%USEDisposeRPROFILE%\AppDaDisposeta\LDisposeocal
Dispose
String.Replace
String.Remove
bcrFileStream.IOypt.dFileStream.IOll
FileStream.IO
BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder
string.Empty
BCruintyptCloseAlgorituinthmProvuintider
uint
BCrUnmanagedTypeyptDecrUnmanagedTypeypt
UnmanagedType
BCrbyte[]yptDesbyte[]troyKbyte[]ey
byte[]
BCpszPropertyryptGepszPropertytPropepszPropertyrty
pszProperty
BCEncodingryptSEncodingetPrEncodingoperEncodingty
Encoding
BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey
bMasterKey
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
-
{0}
net.tcp://
/
localhost
79ef71b2b79b4bbfc450d11fa1720cea
Authorization
ns1
UNKNWON
AzsrAiAPJV42ECUdAzxOAiIxC1k3AD1RACsjRw==
FwIsAw4ICBYgPi0f
Nozzle
Yandex\YaAddon
ToString
asf
*wallet*
ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtu...
_
T
e
l
gr
am
ex
\TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata
string.Replace
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl
serviceInterface.Extension
ProldCharotonVoldCharPN
oldChar
nSystem.CollectionspvoSystem.Collections*
System.Collections
(
UNIQUE
cstringmstringd
string
/ProcessC Process
Process
|
"
Armenia
Azerbaijan
Belarus
Kazakhstan
Kyrgyzstan
Moldova
Tajikistan
Uzbekistan
Ukraine
Russia
gasdl94ja;sdiasdl94ja;s32
asdl94ja;s
Gasdl94jlajsdetDevasdl94jlajsdiceCapasdl94jlajsds
asdl94jlajsd
Width
Height
CopyFromScreen
https://api.ip.sb/ip
SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor
System.Windows.Forms
Name
NumberOfCores
roSystem.Linqot\CISystem.LinqMV2
System.Linq
SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller
AdapterRAM
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente
System.Management
SerialNumber
SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId='
'
FileSystem
SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId='
System.
ExecutablePath
[
]
Concat0 MConcatb oConcatr Concat0
Concat
SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem
Memory
{0}{1}{2}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[
Network\
String
Replace
80
81
0.0.0.0
(PID) Process(5208) Offscum.exe.exe
C2 (1)185.215.113.75:80
Botnettest1
Err_msg
Auth_value7ab4a4e2eae9eb7ae10f64f68df53bb3
US (191)
LEnvironmentogiEnvironmentn DatEnvironmenta
Environment
WSystem.Texteb DatSystem.Texta
System.Text
CoCryptographyokieCryptographys
Cryptography
ExtGenericension CooGenerickies
Generic
OFileInfopeFileInfora GFileInfoX StabFileInfole
FileInfo
OpLinqera GLinqX
Linq
ApGenericpDaGenericta\RGenericoamiGenericng\
Network
Extension
UNKNOWN
.
1
cFileStreamredFileStreamit_cFileStreamardFileStreams
FileStream
\
Network\
Host
Port
:
User
Pass
cookies.sqlite
%USEDisposeRPROFILE%\AppDaDisposeta\LDisposeocal
Dispose
String.Replace
String.Remove
net.tcp://
/
localhost
7ab4a4e2eae9eb7ae10f64f68df53bb3
Authorization
ns1
HjcSVyoTGhs7NVIBHjc4EygDBlU6IidE
NyQjHAI9Fl4=
Scuffy
asf
*wallet*
_
T
e
l
gr
am
ex
\TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata
\Discord\Local Storage\leveldb
*.loSystem.Collections.Genericg
System.Collections.Generic
String
Replace
string.Replace
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl
serviceInterface.Extension
ProldCharotonVoldCharPN
oldChar
nSystem.CollectionspvoSystem.Collections*
System.Collections
Microsoft\Windоws
-
ToString
%
(
UNIQUE
"
bcrFileStream.IOypt.dFileStream.IOll
FileStream.IO
BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder
string.Empty
BCruintyptCloseAlgorituinthmProvuintider
uint
BCrUnmanagedTypeyptDecrUnmanagedTypeypt
UnmanagedType
BCrbyte[]yptDesbyte[]troyKbyte[]ey
byte[]
BCpszPropertyryptGepszPropertytPropepszPropertyrty
pszProperty
BCEncodingryptSEncodingetPrEncodingoperEncodingty
Encoding
BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey
bMasterKey
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
{0}
gasdl94ja;sdiasdl94ja;s32
asdl94ja;s
Gasdl94jlajsdetDevasdl94jlajsdiceCapasdl94jlajsds
asdl94jlajsd
Width
Height
CopyFromScreen
|
https://api.ip.sb/ip
80
81
0.0.0.0
SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor
System.Windows.Forms
Name
NumberOfCores
roSystem.Linqot\CISystem.LinqMV2
System.Linq
SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller
AdapterRAM
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente
System.Management
SerialNumber
SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId='
System.Text.RegularExpressions
'
FileSystem
SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId='
System.
ExecutablePath
[
]
Concat0 MConcatb oConcatr Concat0
Concat
SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem
Memory
{0}{1}{2}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[
System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Cryptography.AesCryptoServiceProvider
šf–knŠ‘3xŒ4‰fm‰6.‰33n“u’2t4Š—Ÿg5p0
{11111-22222-10009-11111}
{11111-22222-50001-00000}
GetDelegateForFunctionPointer
__
System.Reflection.ReflectionContext
m_ptr
m_pData
System.Reflection.RuntimeModule
d‹Ÿqaq7e‰Œl’Ÿˆ7.j˜Šž›Ž6f”b6™‘’•0
clrjit.dll
file:///
Location
Find
ResourceA
Virtual
Alloc
Write
Process
Protect
Open
Process
Close
Handle
kernel
32.dll
{11111-22222-10001-00001}
{11111-22222-10001-00002}
{11111-22222-20001-00001}
{11111-22222-20001-00002}
{11111-22222-40001-00001}
{11111-22222-40001-00002}
{11111-22222-50001-00001}
{11111-22222-50001-00002}
(PID) Process(5424) rrmix.exe.exe
C2 (1)193.233.48.58:38989
BotnetRuzki
Err_msg
Auth_value80c38cc7772c328c028b0e4f42a3fac6
US (200)
LEnvironmentogiEnvironmentn DatEnvironmenta
Environment
WSystem.Texteb DatSystem.Texta
System.Text
CoCryptographyokieCryptographys
Cryptography
ExtGenericension CooGenerickies
Generic
OFileInfopeFileInfora GFileInfoX StabFileInfole
FileInfo
OpLinqera GLinqX
Linq
ApGenericpDaGenericta\RGenericoamiGenericng\
Network
Extension
UNKNOWN
.
1
cFileStreamredFileStreamit_cFileStreamardFileStreams
FileStream
\
Network\
Host
Port
:
User
Pass
cookies.sqlite
%USEDisposeRPROFILE%\AppDaDisposeta\LDisposeocal
Dispose
String.Replace
String.Remove
bcrFileStream.IOypt.dFileStream.IOll
FileStream.IO
BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder
string.Empty
BCruintyptCloseAlgorituinthmProvuintider
uint
BCrUnmanagedTypeyptDecrUnmanagedTypeypt
UnmanagedType
BCrbyte[]yptDesbyte[]troyKbyte[]ey
byte[]
BCpszPropertyryptGepszPropertytPropepszPropertyrty
pszProperty
BCEncodingryptSEncodingetPrEncodingoperEncodingty
Encoding
BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey
bMasterKey
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
-
{0}
net.tcp://
/
localhost
80c38cc7772c328c028b0e4f42a3fac6
Authorization
ns1
UNKNWON
GSYCFyEDJx0ZC11dIipaVhs2BhciLQVTGyNUUA==
ARw/WwxbBVo=
Trimming
Yandex\YaAddon
ToString
asf
*wallet*
ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtu...
_
T
e
l
gr
am
ex
\TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata
String
Replace
string.Replace
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl
serviceInterface.Extension
ProldCharotonVoldCharPN
oldChar
nSystem.CollectionspvoSystem.Collections*
System.Collections
(
UNIQUE
cstringmstringd
string
/ProcessC Process
Process
|
"
Armenia
Azerbaijan
Belarus
Kazakhstan
Kyrgyzstan
Moldova
Tajikistan
Uzbekistan
Ukraine
Russia
gasdl94ja;sdiasdl94ja;s32
asdl94ja;s
Gasdl94jlajsdetDevasdl94jlajsdiceCapasdl94jlajsds
asdl94jlajsd
Width
Height
CopyFromScreen
https://api.ip.sb/ip
80
81
0.0.0.0
SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor
System.Windows.Forms
Name
NumberOfCores
roSystem.Linqot\CISystem.LinqMV2
System.Linq
SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller
AdapterRAM
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente
System.Management
SerialNumber
SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId='
'
FileSystem
SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId='
System.
ExecutablePath
[
]
Concat0 MConcatb oConcatr Concat0
Concat
SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem
Memory
{0}{1}{2}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[
System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Cryptography.AesCryptoServiceProvider
9b0k‰•‘˜gil4ep7Ž†.rmtpkx’ubžprxrd9
{11111-22222-10009-11111}
{11111-22222-50001-00000}
GetDelegateForFunctionPointer
švŸ4wb—21iq4l—82.Ÿv4a4Ž4yl6‡žŠtx
m_ptr
System.Reflection.RuntimeModule
m_pData
clrjit.dll
System.Reflection.ReflectionContext
__
file:///
Location
Find
ResourceA
Virtual
Alloc
Write
Process
Protect
Open
Close
Handle
kernel
32.dll
{11111-22222-10001-00001}
{11111-22222-10001-00002}
{11111-22222-20001-00001}
{11111-22222-20001-00002}
{11111-22222-40001-00001}
{11111-22222-40001-00002}
{11111-22222-50001-00001}
{11111-22222-50001-00002}
(PID) Process(5972) AppLaunch.exe
C2 (1)65.108.101.231:14648
BotnetSUSHI
Err_msg
Auth_value26bcdf6ae8358a98f24ebd4bd8ec3714
US (165)
LEnvironmentogiEnvironmentn DatEnvironmenta
Environment
WSystem.Texteb DatSystem.Texta
System.Text
CoCryptographyokieCryptographys
Cryptography
ExtGenericension CooGenerickies
Generic
OFileInfopeFileInfora GFileInfoX StabFileInfole
FileInfo
OpLinqera GLinqX
Linq
ApGenericpDaGenericta\RGenericoamiGenericng\
Network
Extension
UNKNOWN
.
1
cFileStreamredFileStreamit_cFileStreamardFileStreams
FileStream
\
Network\
Host
Port
:
User
Pass
cookies.sqlite
%USEDisposeRPROFILE%\AppDaDisposeta\LDisposeocal
Dispose
String.Replace
String.Remove
bcrFileStream.IOypt.dFileStream.IOll
FileStream.IO
BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder
string.Empty
BCruintyptCloseAlgorituinthmProvuintider
uint
BCrUnmanagedTypeyptDecrUnmanagedTypeypt
UnmanagedType
BCrbyte[]yptDesbyte[]troyKbyte[]ey
byte[]
BCpszPropertyryptGepszPropertytPropepszPropertyrty
pszProperty
BCEncodingryptSEncodingetPrEncodingoperEncodingty
Encoding
BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey
bMasterKey
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
-
{0}
net.tcp://
/
localhost
26bcdf6ae8358a98f24ebd4bd8ec3714
Authorization
ns1
UNKNWON
HA8lBygnMl0iDRcSPSFRCj4TK1EfMSFAKzcUVA==
B1QmJjY2GFQ=
Repressing
Yandex\YaAddon
ToString
asf
*wallet*
ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtu...
_
T
e
l
gr
am
ex
\TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata
String
Replace
string.Replace
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl
serviceInterface.Extension
ProldCharotonVoldCharPN
oldChar
nSystem.CollectionspvoSystem.Collections*
System.Collections
(
UNIQUE
cstringmstringd
string
/ProcessC Process
Process
|
"
Armenia
Azerbaijan
Belarus
Kazakhstan
Kyrgyzstan
Moldova
Tajikistan
Uzbekistan
Ukraine
Russia
gasdl94ja;sdiasdl94ja;s32
asdl94ja;s
Gasdl94jlajsdetDevasdl94jlajsdiceCapasdl94jlajsds
asdl94jlajsd
Width
Height
CopyFromScreen
https://api.ip.sb/ip
80
81
0.0.0.0
SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor
System.Windows.Forms
Name
NumberOfCores
roSystem.Linqot\CISystem.LinqMV2
System.Linq
SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller
AdapterRAM
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente
System.Management
SerialNumber
SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId='
'
FileSystem
SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId='
System.
ExecutablePath
[
]
Concat0 MConcatb oConcatr Concat0
Concat
SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem
Memory
{0}{1}{2}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[
(PID) Process(564) AppLaunch.exe
C2 (1)194.36.177.138:81
BotnetROK
Err_msg
Auth_value17f65f419822bba9db958b4ac6cc9f05
US (163)
LEnvironmentogiEnvironmentn DatEnvironmenta
Environment
WSystem.Texteb DatSystem.Texta
System.Text
CoCryptographyokieCryptographys
Cryptography
ExtGenericension CooGenerickies
Generic
OFileInfopeFileInfora GFileInfoX StabFileInfole
FileInfo
OpLinqera GLinqX
Linq
ApGenericpDaGenericta\RGenericoamiGenericng\
Network
Extension
UNKNOWN
.
1
cFileStreamredFileStreamit_cFileStreamardFileStreams
FileStream
\
Host
Port
:
User
Pass
cookies.sqlite
%USEDisposeRPROFILE%\AppDaDisposeta\LDisposeocal
Dispose
String.Replace
String.Remove
bcrFileStream.IOypt.dFileStream.IOll
FileStream.IO
BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder
string.Empty
BCruintyptCloseAlgorituinthmProvuintider
uint
BCrUnmanagedTypeyptDecrUnmanagedTypeypt
UnmanagedType
BCrbyte[]yptDesbyte[]troyKbyte[]ey
byte[]
BCpszPropertyryptGepszPropertytPropepszPropertyrty
pszProperty
BCEncodingryptSEncodingetPrEncodingoperEncodingty
Encoding
BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey
bMasterKey
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
-
{0}
net.tcp://
/
localhost
17f65f419822bba9db958b4ac6cc9f05
Authorization
ns1
UNKNWON
DzUMQCUaKEA/KCRUPhBEHT8JJVcoNCxN
FwpePA==
Bagpipers
Yandex\YaAddon
ToString
asf
*wallet*
ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtu...
_
T
e
l
gr
am
ex
\TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata
string.Replace
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl
serviceInterface.Extension
ProldCharotonVoldCharPN
oldChar
nSystem.CollectionspvoSystem.Collections*
System.Collections
(
UNIQUE
cstringmstringd
string
/ProcessC Process
Process
|
"
Armenia
Azerbaijan
Belarus
Kazakhstan
Kyrgyzstan
Moldova
Tajikistan
Uzbekistan
Ukraine
Russia
gasdl94ja;sdiasdl94ja;s32
asdl94ja;s
Gasdl94jlajsdetDevasdl94jlajsdiceCapasdl94jlajsds
asdl94jlajsd
Width
Height
CopyFromScreen
https://api.ip.sb/ip
SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor
System.Windows.Forms
Name
NumberOfCores
roSystem.Linqot\CISystem.LinqMV2
System.Linq
SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller
AdapterRAM
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente
System.Management
SerialNumber
SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId='
'
FileSystem
SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId='
System.
ExecutablePath
[
]
Concat0 MConcatb oConcatr Concat0
Concat
SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem
Memory
{0}{1}{2}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[
Network\
String
Replace
80
81
0.0.0.0
(PID) Process(2820) AppLaunch.exe
C2 (1)185.215.113.24:15994
Botnet@humus228p
Err_msg
Auth_valuebb99a32fdff98741feb69d524760afae
US (165)
LEnvironmentogiEnvironmentn DatEnvironmenta
Environment
WSystem.Texteb DatSystem.Texta
System.Text
CoCryptographyokieCryptographys
Cryptography
ExtGenericension CooGenerickies
Generic
OFileInfopeFileInfora GFileInfoX StabFileInfole
FileInfo
OpLinqera GLinqX
Linq
ApGenericpDaGenericta\RGenericoamiGenericng\
Network
Extension
UNKNOWN
.
1
cFileStreamredFileStreamit_cFileStreamardFileStreams
FileStream
\
Network\
Host
Port
:
User
Pass
cookies.sqlite
%USEDisposeRPROFILE%\AppDaDisposeta\LDisposeocal
Dispose
String.Replace
String.Remove
bcrFileStream.IOypt.dFileStream.IOll
FileStream.IO
BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder
string.Empty
BCruintyptCloseAlgorituinthmProvuintider
uint
BCrUnmanagedTypeyptDecrUnmanagedTypeypt
UnmanagedType
BCrbyte[]yptDesbyte[]troyKbyte[]ey
byte[]
BCpszPropertyryptGepszPropertytPropepszPropertyrty
pszProperty
BCEncodingryptSEncodingetPrEncodingoperEncodingty
Encoding
BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey
bMasterKey
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
-
{0}
net.tcp://
/
localhost
bb99a32fdff98741feb69d524760afae
Authorization
ns1
UNKNWON
HCEIRTkHGA0hJ0EVHCEiATgHAEMiICBYHiE+SQ==
ADIHRRc1Bw8iHjxZMjRSSQ==
Quotum
Yandex\YaAddon
ToString
asf
*wallet*
ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtu...
_
T
e
l
gr
am
ex
\TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata
String
Replace
string.Replace
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl
serviceInterface.Extension
ProldCharotonVoldCharPN
oldChar
nSystem.CollectionspvoSystem.Collections*
System.Collections
(
UNIQUE
cstringmstringd
string
/ProcessC Process
Process
|
"
Armenia
Azerbaijan
Belarus
Kazakhstan
Kyrgyzstan
Moldova
Tajikistan
Uzbekistan
Ukraine
Russia
gasdl94ja;sdiasdl94ja;s32
asdl94ja;s
Gasdl94jlajsdetDevasdl94jlajsdiceCapasdl94jlajsds
asdl94jlajsd
Width
Height
CopyFromScreen
https://api.ip.sb/ip
80
81
0.0.0.0
SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor
System.Windows.Forms
Name
NumberOfCores
roSystem.Linqot\CISystem.LinqMV2
System.Linq
SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller
AdapterRAM
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente
System.Management
SerialNumber
SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId='
'
FileSystem
SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId='
System.
ExecutablePath
[
]
Concat0 MConcatb oConcatr Concat0
Concat
SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem
Memory
{0}{1}{2}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[
(PID) Process(6016) AppLaunch.exe
C2 (1)193.124.22.34:19489
Botnetruz19489
Err_msg
Auth_value2b3af4bdf5e7f4f41faf1150d1660073
US (163)
LEnvironmentogiEnvironmentn DatEnvironmenta
Environment
WSystem.Texteb DatSystem.Texta
System.Text
CoCryptographyokieCryptographys
Cryptography
ExtGenericension CooGenerickies
Generic
OFileInfopeFileInfora GFileInfoX StabFileInfole
FileInfo
OpLinqera GLinqX
Linq
ApGenericpDaGenericta\RGenericoamiGenericng\
Network
Extension
UNKNOWN
.
1
cFileStreamredFileStreamit_cFileStreamardFileStreams
FileStream
\
Host
Port
:
User
Pass
cookies.sqlite
%USEDisposeRPROFILE%\AppDaDisposeta\LDisposeocal
Dispose
String.Replace
String.Remove
bcrFileStream.IOypt.dFileStream.IOll
FileStream.IO
BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder
string.Empty
BCruintyptCloseAlgorituinthmProvuintider
uint
BCrUnmanagedTypeyptDecrUnmanagedTypeypt
UnmanagedType
BCrbyte[]yptDesbyte[]troyKbyte[]ey
byte[]
BCpszPropertyryptGepszPropertytPropepszPropertyrty
pszProperty
BCEncodingryptSEncodingetPrEncodingoperEncodingty
Encoding
BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey
bMasterKey
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
-
{0}
net.tcp://
/
localhost
2b3af4bdf5e7f4f41faf1150d1660073
Authorization
ns1
UNKNWON
HzEdEyAPISsrNV0VKA1mHzgtAx0rBjRCJj1YWQ==
MQsgXyExD2IqMgJR
Reviled
Yandex\YaAddon
ToString
asf
*wallet*
ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtu...
_
T
e
l
gr
am
ex
\TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata
string.Replace
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl
serviceInterface.Extension
ProldCharotonVoldCharPN
oldChar
nSystem.CollectionspvoSystem.Collections*
System.Collections
(
UNIQUE
cstringmstringd
string
/ProcessC Process
Process
|
"
Armenia
Azerbaijan
Belarus
Kazakhstan
Kyrgyzstan
Moldova
Tajikistan
Uzbekistan
Ukraine
Russia
gasdl94ja;sdiasdl94ja;s32
asdl94ja;s
Gasdl94jlajsdetDevasdl94jlajsdiceCapasdl94jlajsds
asdl94jlajsd
Width
Height
CopyFromScreen
https://api.ip.sb/ip
SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor
System.Windows.Forms
Name
NumberOfCores
roSystem.Linqot\CISystem.LinqMV2
System.Linq
SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller
AdapterRAM
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente
System.Management
SerialNumber
SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId='
'
FileSystem
SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId='
System.
ExecutablePath
[
]
Concat0 MConcatb oConcatr Concat0
Concat
SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem
Memory
{0}{1}{2}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[
Network\
String
Replace
80
81
0.0.0.0

SystemBC

(PID) Process(4380) 7231574788.exe
C2 (2)135.125.248.50:443
146.70.53.169:443
(PID) Process(4968) 7231574788.exe
C2 (2)135.125.248.50:443
146.70.53.169:443

Arkei

(PID) Process(4876) UNiXVEI3wd.exe
C2http://
Mutex
other (618)LoadLibraryA
GetProcAddress
ExitProcess
advapi32.dll
crypt32.dll
GetTickCount
Sleep
GetUserDefaultLangID
CreateMutexA
GetLastError
HeapAlloc
GetProcessHeap
GetComputerNameA
VirtualProtect
GetCurrentProcess
VirtualAllocExNuma
GetUserNameA
CryptStringToBinaryA
HAL9TH
JohnDoe
21/04/2022 20:00:00
http://
Default
%hu/%hu/%hu %hu:%hu:%hu
open
sqlite3.dll
C:\ProgramData\sqlite3.dll
freebl3.dll
C:\ProgramData\freebl3.dll
mozglue.dll
C:\ProgramData\mozglue.dll
msvcp140.dll
C:\ProgramData\msvcp140.dll
nss3.dll
C:\ProgramData\nss3.dll
softokn3.dll
C:\ProgramData\softokn3.dll
vcruntime140.dll
C:\ProgramData\vcruntime140.dll
.zip
Tag:
IP: IP?
Country: Country?
Working Path:
Local Time:
TimeZone:
Display Language:
Keyboard Languages:
Is Laptop:
Processor:
Installed RAM:
OS:
(
Bit)
Videocard:
Display Resolution:
PC name:
User name:
Domain name:
MachineID:
GUID:
Installed Software:
system.txt
Grabber\%s.zip
%APPDATA%
%LOCALAPPDATA%
%USERPROFILE%
%DESKTOP%
Wallets\
Ethereum
\Ethereum\
keystore
Electrum
\Electrum\wallets\
*.*
ElectrumLTC
\Electrum-LTC\wallets\
Exodus
\Exodus\
exodus.conf.json
window-state.json
\Exodus\exodus.wallet\
passphrase.json
seed.seco
info.seco
ElectronCash
\ElectronCash\wallets\
default_wallet
MultiDoge
\MultiDoge\
multidoge.wallet
JAXX
\jaxx\Local Storage\
file__0.localstorage
Atomic
\atomic\Local Storage\leveldb\
000003.log
CURRENT
LOCK
LOG
MANIFEST-000001
0000*
Binance
\Binance\
app-store.json
Coinomi
\Coinomi\Coinomi\wallets\
*.wallet
*.config
*wallet*.dat
GetSystemTime
lstrcatA
SystemTimeToFileTime
ntdll.dll
sscanf
memset
memcpy
wininet.dll
user32.dll
gdi32.dll
netapi32.dll
psapi.dll
bcrypt.dll
vaultcli.dll
shlwapi.dll
shell32.dll
gdiplus.dll
ole32.dll
dbghelp.dll
CreateFileA
WriteFile
CloseHandle
GetFileSize
lstrlenA
LocalAlloc
GlobalFree
ReadFile
OpenProcess
SetFilePointer
SetEndOfFile
GetCurrentProcessId
GetLocalTime
GetTimeZoneInformation
GetUserDefaultLocaleName
LocalFree
GetSystemPowerStatus
GetSystemInfo
GlobalMemoryStatusEx
IsWow64Process
GetTempPathA
GetLocaleInfoA
GetFileSizeEx
GetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
GetCurrentDirectoryA
CopyFileA
DeleteFileA
lstrcmpW
GlobalAlloc
FreeLibrary
SetCurrentDirectoryA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
FileTimeToSystemTime
GetFileInformationByHandle
GlobalLock
GlobalSize
WideCharToMultiByte
GetWindowsDirectoryA
GetVolumeInformationA
GetVersionExA
GetModuleFileNameA
CreateFileW
CreateFileMappingW
MultiByteToWideChar
CreateThread
GetEnvironmentVariableA
SetEnvironmentVariableA
lstrcpyA
lstrcpynA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
HttpQueryInfoA
InternetCloseHandle
InternetReadFile
InternetSetOptionA
InternetOpenUrlA
InternetCrackUrlA
wsprintfA
CharToOemW
GetKeyboardLayoutList
EnumDisplayDevicesA
ReleaseDC
GetDC
GetSystemMetrics
GetDesktopWindow
GetWindowRect
GetWindowDC
CloseWindow
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetCurrentHwProfileA
RegEnumKeyExA
RegGetValueA
CreateDCA
GetDeviceCaps
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
StretchBlt
GetObjectW
GetDIBits
SaveDC
CreateDIBSection
DeleteDC
RestoreDC
DsRoleGetPrimaryDomainInformation
GetModuleFileNameExA
CryptUnprotectData
BCryptCloseAlgorithmProvider
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptDecrypt
VaultOpenVault
VaultCloseVault
VaultEnumerateItems
VaultGetItemWin8
VaultGetItemWin7
VaultFree
StrCmpCA
StrStrA
PathMatchSpecA
SHGetFolderPathA
ShellExecuteExA
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipDisposeImage
GdipFree
CreateStreamOnHGlobal
GetHGlobalFromStream
SymMatchString
HEAD
HTTP/1.1
GET
POST
file
Content-Type: multipart/form-data; boundary=----
Content-Disposition: form-data; name="
Content-Disposition: form-data; name="file"; filename="
Content-Type: application/octet-stream
Content-Transfer-Encoding: binary
SOFT:
PROF: ?
PROF:
HOST:
USER:
PASS:
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
"}
PATH
PATH=
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
SELECT origin_url, username_value, password_value FROM logins
Cookies\%s_%s.txt
SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
TRUE
FALSE
Autofill\%s_%s.txt
SELECT name, value FROM autofill
CC\%s_%s.txt
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Card number:
Name on card:
Expiration date:
History\%s_%s.txt
SELECT url FROM urls
Downloads\%s_%s.txt
SELECT target_path, tab_url from downloads
Login Data
Cookies
Web Data
History
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
logins.json
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places
cookies.sqlite
formhistory.sqlite
places.sqlite
\Local State
..\profiles.ini
C:\ProgramData\
Chrome
\Google\Chrome\User Data
ChromeBeta
\Google\Chrome Beta\User Data
ChromeCanary
\Google\Chrome SxS\User Data
Chromium
\Chromium\User Data
Edge_Chromium
\Microsoft\Edge\User Data
Kometa
\Kometa\User Data
Amigo
\Amigo\User Data
Torch
\Torch\User Data
Orbitum
\Orbitum\User Data
Comodo
\Comodo\Dragon\User Data
Nichrome
\Nichrome\User Data
Maxthon5
\Maxthon5\Users
Sputnik
\Sputnik\User Data
EPB
\Epic Privacy Browser\User Data
Vivaldi
\Vivaldi\User Data
CocCoc
\CocCoc\Browser\User Data
Uran
\uCozMedia\Uran\User Data
QIP
\QIP Surf\User Data
Cent
\CentBrowser\User Data
Elements
\Elements Browser\User Data
TorBro
\TorBro\Profile
CryptoTab
\CryptoTab Browser\User Data
Brave
\BraveSoftware\Brave-Browser\User Data
Opera
\Opera Software\Opera Stable\
OperaGX
\Opera Software\Opera GX Stable\
OperaNeon
\Opera Software\Opera Neon\User Data
Firefox
\Mozilla\Firefox\Profiles\
SlimBrowser
\FlashPeak\SlimBrowser\Profiles\
PaleMoon
\Moonchild Productions\Pale Moon\Profiles\
Waterfox
\Waterfox\Profiles\
Cyberfox
\8pecxstudios\Cyberfox\Profiles\
BlackHawk
\NETGATE Technologies\BlackHawk\Profiles\
IceCat
\Mozilla\icecat\Profiles\
KMeleon
\K-Meleon\
Thunderbird
\Thunderbird\Profiles\
passwords.txt
ibnejdfjmmkpcnlpebklmnkoeoihofec
TronLink
nkbihfbeogaeaoehlefnkodbefgpgknn
MetaMask
fhbohimaelbohpjbbldcngcnapndodjp
Binance Chain Wallet
ffnbelfdoeiohenkjibnmadjiehjhajb
Yoroi
jbdaocneiiinmjbjlgalhcelgbejmnid
Nifty Wallet
afbcbjpbpfadlkmhmclhkeeodmamcflc
Math Wallet
hnfanknocfeofbddgcijnmhnfnkdnaad
Coinbase Wallet
hpglfhgfnhbgpjdenjgmdgoeiappafln
Guarda
blnieiiffboillknjnepogjhkgnoapac
EQUAL Wallet
cjelfplplebdjjenllpjcblmjkfcffne
Jaxx Liberty
fihkakfobkmkjojpchpfgcmhfjnmnfpi
BitApp Wallet
kncchdigobghenbbaddojjnnaogfppfj
iWallet
amkmjjmmflddogmhpjloimipbofnfjih
Wombat
nlbmnnijcnlegkjjpcfjclmcfggfefdm
MEW CX
nanjmdknhkinifnkgdcggcfnhdaammmj
GuildWallet
nkddgncdjgjfcddamfgcmfnlhccnimig
Saturn Wallet
fnjhmkhhmkbjkkabndcnnogagogbneec
Ronin Wallet
cphhlgmgameodnhkjdmkpanlelnlohao
NeoLine
nhnkbkgjikgcigadomkphalanndcapjk
Clover Wallet
kpfopkelmapcoipemfendmdcghnegimn
Liquality Wallet
aiifbnbfobpmeekipheeijimdpnlpgpp
Terra Station
dmkamcknogkgcdfhhbddcghachkejeap
Keplr
fhmfendgdocmcbmfikdcogofphimnkno
Sollet
cnmamaachppnkjgnildpdmkaakejnhae
Auro Wallet
jojhfeoedkpkglbfimdfabpdfjaoolaf
Polymesh Wallet
flpiciilemghbmfalicajoolhkkenfel
ICONex
nknhiehlklippafakaeklbeglecifhad
Nabox Wallet
hcflpincpppdclinealmandijcmnkbgn
KHC
ookjlbkiijinhpmnjffcofjonbfbgaoc
Temple
mnfifefkajgofkcjkemidiaecocnkjeh
TezBox
dkdedlpgdmmkkfjabffeganieamfklkm
Cyano Wallet
nlgbhdfgdhgbiamfdfmbikcdghidoadd
Byone
infeboajgfhgbjpjbeppbkgnabfdkdaf
OneKey
cihmoadaighcejopammfbmddcmdekcje
LeafWallet
lodccjjbdhfakaekdiahmedfbieldgik
DAppPlay
ijmpgkjfkbfhoebgogflfebnmejmfbml
BitClip
lkcjlnjfpbikmcmbachjpdbijejflpcm
Steem Keychain
onofpnbbkehpmmoabgpcpmigafmmnjhl
Nash Extension
bcopgchhojmggmffilplmbdicgaihlkp
Hycon Lite Client
klnaejjgbibmhlephnhpmaofohgkpgkd
ZilPay
aeachknmefphepccionboohckonoeemg
Coin98 Wallet
bfnaelmomeimhlpmgjnjophhpkkoljpa
Phantom
hifafgmccdpekplomjjkcfgodnhcellj
Crypto.com
dngmlblcodfobpdpecaadgfbcggfjfnm
Maiar DeFi Wallet
ppdadbejkmjnefldpcdjhnkpbjkikoip
Oasis
hpbgcgmiemanfelegbndmhieiigkackl
MonstaWallet
fcckkdbjnoikooededlapcalpionmalo
MOBOX
jccapkebeeiajkkdemacblkjhhhboiek
Crust Wallet
mgffkfbidihjpoaomajlbgchddlicgpn
Pali Wallet
nphplpgoakhhjchkkhmiggakijnkhfnd
TON Wallet
ldinpeekobnhjjdofggfgjlcehhmanlj
Hiro Wallet
pocmplpaccanhmnllbbkpgfliimjljgo
Slope Wallet
bhhhlbepdkbapadjdnnojkbgioiodbic
Solflare Wallet
pgiaagfkgcbnmiiolekcfmljdagdhlcm
Stargazer Wallet
cgeeodpfagjceefieflmdfphplkenlfk
EVER Wallet
gjkdbeaiifkpoencioahhcilildpjhgh
partisia-wallet
bgjogpoidejdemgoochpnkmdjpocgkha
Ecto Wallet
ifckdpamphokdglkkdomedpdegcjhjdp
ONTO Wallet
agechnindjilpccclelhlbjphbgnobpf
Fractal Wallet
algblmhagnobbnmakepomicmfljlbehg
ADS Wallet
imijjbmbnebfnbmonjeileijahaipglj
Moonlet Wallet
kpjdchaapjheajadlaakiiigcbhoppda
ZEBEDEE
dlcobpjiigpikoobohmabehhmhfoodbb
Argent X StarkNet Wallet
bofddndhbegljegmpmnlbhcejofmjgbn
X-Wallet
mapbhaebnddapnmifbbkgeedkeplgjmf
Biport Wallet
kfdniefadaanbjodldohaedphafoffoh
Typhon Wallet
jaooiolkmfcmloonphpiiogkfckgciom
Twetch Wallet
aijcbedoijmgnlmjeegjaglmepbmpkpi
Leap Wallet
fhfffofbcgbjjojdnpcfompojdjjhdim
Lamden Wallet
agkfnefiabmfpanochlcakggnkdfmmjd
Earth Wallet
lpfcbjknijpeeillifnkikgncikgfhdo
Nami
fecfflganphcinpahcklgahckeohalog
Coin Wallet
ilhaljfiglknggcoegeknjghdgampffk
Beam Web Wallet
dklmlehijiaepdijfnbbhncfpcoeeljf
FShares Wallet
fkhebcilafocjhnlcngogekljmllgdhd
WAGMIswap.io Wallet
laphpbhjhhgigmjoflgcchgodbbclahk
BLUE - Worlds Safest and Simplest Wallet
mkjjflkhdddfjhonakofipfojoepfndk
Unification Web Wallet
jnldfbidonfeldmalbflbmlebbipcnle
Infinity Wallet
ellkdbaphhldpeajbepobaecooaoafpg
Fetch.ai Network Wallet
iokeahhehimjnekafflcihljlcjccdbe
Alby Wallet
omajpeaffjgmlpmhbfdjepdejoemifpe
xBull Wallet
pgojdfajgcjjpjnbpfaelnpnjocakldb
Sugarchain Wallet
pnndplcbkakcplkjnolgbkdgjikjednm
Tronium
fnnegphlobjdpkhecapkijjdkgcjhkib
Harmony
fhilaheimglignddkjgofkcbgekhenbh
Oxygen
cmbagcoinhmacpcgmbiniijboejgiahi
JustLiquidity Wallet
kmmolakhbgdlpkjkcjkebenjheonagdm
AlgoSigner
fnabdmcgpkkjjegokfcnfbpneacddpfh
Goldmint Lite Wallet
bgpipimickeadkjlklgciifhnalhdjhe
GeroWallet
hoighigmnhgkkdaenafgnefkcmipfjon
EO.Finance
nlgnepoeokdfodgjkjiblkadkjbdfmgd
Multi Wallet
nhihjlnjgibefgjhobhcphmnckoogdea
Waves Enterprise Wallet
ehibhohmlpipbaogcknmpmiibbllplph
Bluehelix Wallet
magbanejlegnbcppjljfhnmfmghialkl
Nebulas Wallet
fgkaeeikaoeiiggggbgdcjchmdfmamla
Vtimes
pnlfjmlcjdjgkddecgincndfgegkecke
Crocobit Wallet
bhghoamapcdpbohphigoooaddinpkbai
Authenticator
gaedmjdfmmahhbjefcbgaolhhanlaolb
Authy
oeljdldpnmdbchonielidgobddffflal
EOS Authenticator
ilgcnhelpchnceeipipijaljkblbcobl
GAuth Authenticator
imloifkgjagghnncjkhggdhalmcnfklk
Trezor Password Manager
%s\%s\Local Extension Settings\%s
%s\CURRENT
%s\%s\Sync Extension Settings\%s
%s\%s\IndexedDB\chrome-extension_%s_0.indexeddb.leveldb
Plugins\
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
x64
x86
DISPLAY
SOFTWARE\Microsoft\Cryptography
MachineGuid
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayName
DisplayVersion
screenshot.jpg
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
/c timeout /t 5 & del /f /q "%s" & exit
C:\Windows\System32\cmd.exe

Tofsee

(PID) Process(1232) 13.php.exe
C2 (2)niflheimr.cn
jotunheim.name
Encrypted Strings (59)c:\Windows
\system32\
ImagePath
.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSConfig
/r
.exe
cmd /C move /Y "%s" %s sc config %s binPath= "%s%s /d\"%s\"" sc start %s
svchost.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin
PromptOnSecureDesktop
MSConfig
:.repos
USERPROFILE
\Local Settings:.repos
USERPROFILE
\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.repos
USERPROFILE
\wincookie.repos
TMP
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
SYSTEM\CurrentControlSet\services
ImagePath
SYSTEM\CurrentControlSet\services
SYSTEM\CurrentControlSet\services
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
.exe
qazwsxed
%s%i%i%i%i.bat
@echo off :next_try del "%s">nul if exist "%s" ( ping 127.0.0.1 >nul goto next_try ) del %%0
svchost.exe
.exe
/u
USERPROFILE
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/d
/e
/d
/e
.exe
"%s" /u"%s"
USERPROFILE
.exe
USERPROFILE
USERPROFILE
ver=%d lid=%d win=%X/%d sid=%s rep=%s
(PID) Process(880) svchost.exe
C2 (2)niflheimr.cn
jotunheim.name
Encrypted Strings (59)c:\Windows
\system32\
ImagePath
.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSConfig
/r
.exe
cmd /C move /Y "%s" %s sc config %s binPath= "%s%s /d\"%s\"" sc start %s
svchost.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin
PromptOnSecureDesktop
MSConfig
:.repos
USERPROFILE
\Local Settings:.repos
USERPROFILE
\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.repos
USERPROFILE
\wincookie.repos
TMP
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
Config
Control Panel\Buses
Config
SOFTWARE\Microsoft\Buses
SYSTEM\CurrentControlSet\services
ImagePath
SYSTEM\CurrentControlSet\services
SYSTEM\CurrentControlSet\services
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
.exe
qazwsxed
%s%i%i%i%i.bat
@echo off :next_try del "%s">nul if exist "%s" ( ping 127.0.0.1 >nul goto next_try ) del %%0
svchost.exe
.exe
/u
USERPROFILE
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
/d
/e
/d
/e
.exe
"%s" /u"%s"
USERPROFILE
.exe
USERPROFILE
USERPROFILE
ver=%d lid=%d win=%X/%d sid=%s rep=%s

Amadey

(PID) Process(4212) fxdd.bmp.exe
C2 (1)185.215.113.38/f8dfksdj3/index.php
Version3.10
Strings (92)8c7aecc852
orxds.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
/C REG ADD "HKCU\Software\Micro=oft\Windows\CurrentVersion\Expl9rer\User Shell Folders" /f /v S>artup /t REG_SZ /d
cmd
SOFTWARE\Microsoft\Windows\Curr/ntVersion\Explorer\Shell Folder=
Startup
/C REG ADD "HKCU\SOFTWARE\Micro=oft\Windows\CurrentVersion\RunO8ce" /f /v rem /t REG_SZ /d
"cmd /C RMDIR /s/q "
SOFTWARE\Microsoft\Windows\Curr/ntVersion\Run
rundll32
/Delete /TN "
powershell
-Command $action = New-Schedule.TaskAction -Execute '
'; $time = New-TimeSpan -Minute= 1; $trigger = New-ScheduledTas5Trigger -Once -At 0:00 -Repetit3onInterval $time; Register-Sche.uledTask -Action $action -Trigg/r $trigger -TaskName '
-Command $action = Unregister-S-heduledTask -TaskName '
-Confirm: $false
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
cred.dll|
Main
http://
https://
exe
dll
<c>
<d>
Plugins/
+++
&unit=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
Content-Type: multipart/form-da>a; boundary=----
------
?scr=1
.jpg
Content-Type: application/x-www÷form-urlencoded
SYSTEM\CurrentControlSet\Contro6\ComputerName\ComputerName
ComputerName
-unicode-
SYSTEM\CurrentControlSet\Contro6\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\B+sicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\C?rrentVersion
ProductName
2019
2022
2016
CurrentBuild
cmd.exe
/c echo Y|CACLS "
" /P "
:N"
/c CACLS "
:R" /E
:F" /E
AppData
:::
rundll32.exe
(PID) Process(4168) orxds.exe
C2 (1)185.215.113.38/f8dfksdj3/index.php
Version3.10
Strings (92)8c7aecc852
orxds.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
/C REG ADD "HKCU\Software\Micro=oft\Windows\CurrentVersion\Expl9rer\User Shell Folders" /f /v S>artup /t REG_SZ /d
cmd
SOFTWARE\Microsoft\Windows\Curr/ntVersion\Explorer\Shell Folder=
Startup
/C REG ADD "HKCU\SOFTWARE\Micro=oft\Windows\CurrentVersion\RunO8ce" /f /v rem /t REG_SZ /d
"cmd /C RMDIR /s/q "
SOFTWARE\Microsoft\Windows\Curr/ntVersion\Run
rundll32
/Delete /TN "
powershell
-Command $action = New-Schedule.TaskAction -Execute '
'; $time = New-TimeSpan -Minute= 1; $trigger = New-ScheduledTas5Trigger -Once -At 0:00 -Repetit3onInterval $time; Register-Sche.uledTask -Action $action -Trigg/r $trigger -TaskName '
-Command $action = Unregister-S-heduledTask -TaskName '
-Confirm: $false
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
cred.dll|
Main
http://
https://
exe
dll
<c>
<d>
Plugins/
+++
&unit=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
Content-Type: multipart/form-da>a; boundary=----
------
?scr=1
.jpg
Content-Type: application/x-www÷form-urlencoded
SYSTEM\CurrentControlSet\Contro6\ComputerName\ComputerName
ComputerName
-unicode-
SYSTEM\CurrentControlSet\Contro6\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\B+sicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\C?rrentVersion
ProductName
2019
2022
2016
CurrentBuild
cmd.exe
/c echo Y|CACLS "
" /P "
:N"
/c CACLS "
:R" /E
:F" /E
AppData
:::
rundll32.exe
(PID) Process(1772) orxds.exe
C2 (1)185.215.113.38/f8dfksdj3/index.php
Version3.10
Strings (92)8c7aecc852
orxds.exe
SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
/C REG ADD "HKCU\Software\Micro=oft\Windows\CurrentVersion\Expl9rer\User Shell Folders" /f /v S>artup /t REG_SZ /d
cmd
SOFTWARE\Microsoft\Windows\Curr/ntVersion\Explorer\Shell Folder=
Startup
/C REG ADD "HKCU\SOFTWARE\Micro=oft\Windows\CurrentVersion\RunO8ce" /f /v rem /t REG_SZ /d
"cmd /C RMDIR /s/q "
SOFTWARE\Microsoft\Windows\Curr/ntVersion\Run
rundll32
/Delete /TN "
powershell
-Command $action = New-Schedule.TaskAction -Execute '
'; $time = New-TimeSpan -Minute= 1; $trigger = New-ScheduledTas5Trigger -Once -At 0:00 -Repetit3onInterval $time; Register-Sche.uledTask -Action $action -Trigg/r $trigger -TaskName '
-Command $action = Unregister-S-heduledTask -TaskName '
-Confirm: $false
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
cred.dll|
Main
http://
https://
exe
dll
<c>
<d>
Plugins/
+++
&unit=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
Content-Type: multipart/form-da>a; boundary=----
------
?scr=1
.jpg
Content-Type: application/x-www÷form-urlencoded
SYSTEM\CurrentControlSet\Contro6\ComputerName\ComputerName
ComputerName
-unicode-
SYSTEM\CurrentControlSet\Contro6\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\B+sicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\C?rrentVersion
ProductName
2019
2022
2016
CurrentBuild
cmd.exe
/c echo Y|CACLS "
" /P "
:N"
/c CACLS "
:R" /E
:F" /E
AppData
:::
rundll32.exe
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
377
Monitored processes
346
Malicious processes
149
Suspicious processes
91

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs notepad.exe no specs chrome.exe no specs winrar.exe pc_en-1653121520_setup.exe no specs pc_en-1653121520_setup.exe setup_installer.exe setup_install.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs 6288a1de5a1db_30593f.exe cmd.exe no specs cmd.exe no specs 6288a1dfb8d08_cf8c29.exe no specs 6288a1df09dd5_9fbf0bcee0.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs 6288a1e12b0d6_892f6331.exe cmd.exe no specs cmd.exe no specs 6288a1e20c44b_63f4244e0.exe 6288a1ea208a4_fd04fb523d.exe 6288a1e5cf6a8_a26c67c.exe 6288a1e443b77_fd2fce267.exe no specs 6288a1e916698_060a424.exe 6288a1ea208a4_fd04fb523d.tmp 6288a1e84c9ef_f8927b40db.exe no specs 6288a1e12b0d6_892f6331.tmp 6288a1dfb8d08_cf8c29.exe #REDLINE 6288a1df09dd5_9fbf0bcee0.exe lbo5.exe 6288a1e84c9ef_f8927b40db.exe no specs cmd.exe no specs 1518327346.exe control.exe no specs rundll32.exe no specs nihalehequ.exe cmd.exe no specs #SYSTEMBC 7231574788.exe no specs 6288a1e12b0d6_892f6331.exe rundll32.exe no specs 6288a1e12b0d6_892f6331.tmp cmd.exe no specs gozhinudejae.exe chrome.exe no specs taskkill.exe no specs #ARKEI unixvei3wd.exe #SYSTEMBC 7231574788.exe iexplore.exe chrome.exe no specs iexplore.exe poweroff.exe poweroff.tmp power off.exe no specs cmd.exe no specs cmd.exe setup.exe no specs hb0pcajov.exe #HILOTI explorer.exe cmd.exe no specs installer.exe glmqaq.exe msiexec.exe cmd.exe no specs gcleaner.exe msiexec.exe no specs #REDLINE strongix.exe cmd.exe no specs random.exe no specs random.exe cmd.exe no specs msiexec.exe no specs schtasks.exe no specs cmd.exe no specs handselfdiy_0.exe msiexec.exe chrome.exe no specs taskkill.exe no specs cmd.exe no specs msiexec.exe no specs chrome.exe cmd.exe no specs b123.exe cmd.exe no specs taskkill.exe no specs rundll32.exe no specs chrome.exe no specs cmd.exe no specs timeout.exe no specs cmd.exe no specs cleaner.exe cmd.exe no specs taskkill.exe no specs cmd.exe no specs cmd.exe no specs installer.exe no specs chrome.exe no specs chrome.exe no specs qadddgh25r.exe no specs installutil.exe no specs m2rf60jto.exe no specs explorer.exe hpeksfoca.exe no specs chrome.exe hpeksfoca.exe no specs vkedxukyr.exe #SOCELARS w8ltwns6t.exe tabivuz.exe no specs niceprocessx32.bmp.exe service.bmp.exe #REDLINE setupmexx.exe.exe #REDLINE offscum.exe.exe #TOFSEE 13.php.exe #REDLINE rrmix.exe.exe trdnganlzr22649.exe.exe test33.bmp.exe no specs fjefrxz.exe.exe 6523.exe.exe #REDLINE fenix_8.bmp.exe mixinte2001.bmp.exe wam.exe.exe test33.bmp.exe cmd.exe no specs cmd.exe prolivv.bmp.exe no specs real2001.bmp.exe cleaner.exe sc.exe no specs #REDLINE applaunch.exe sc.exe no specs sc.exe no specs mouvcfbd.exe no specs netsh.exe no specs ftp.exe no specs cmd.exe no specs cleaner.exe #REDLINE lokes_1.bmp.exe cmd.exe no specs arabcode_crypted_3.bmp.exe no specs #REDLINE norm2.bmp.exe tasklist.exe no specs find.exe no specs #AMADEY fxdd.bmp.exe olympteam_build_crypted_2.bmp.exe no specs #REDLINE shortnessunsol.bmp.exe unmatured.bmp.exe no specs #REDLINE applaunch.exe #TOFSEE svchost.exe #REDLINE applaunch.exe chrome.exe no specs #REDLINE applaunch.exe #AMADEY orxds.exe icacls.exe no specs cmd.exe no specs schtasks.exe no specs reg.exe cmd.exe no specs taskkill.exe no specs tasklist.exe no specs find.exe no specs test33.bmp.exe no specs findstr.exe no specs congiunto.exe.pif ping.exe no specs #STOP test33.bmp.exe build2.exe no specs #SOCELARS tde8etir7miob766p06bs7fb.exe schtasks.exe no specs schtasks.exe no specs build2.exe #AMADEY orxds.exe no specs ntvdm.exe no specs #REDLINE 7aaak.exe niceprocessx32.bmp.exe no specs #REDLINE 4m9d8.exe mixinte2001.bmp.exe setup777.exe.exe no specs random.exe.exe no specs k377k.exe fjefrxz.exe.exe random.exe.exe ftp.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs find.exe no specs chrome.exe no specs bfjjj.exe no specs search_hyperfs_310.exe.exe no specs control.exe no specs rundll32.exe no specs utube2005.bmp.exe install.exe download2.exe.exe install.exe invisbrowser45856.exe setup331.exe no specs #MINER svchost.exe ll.exe no specs msiexec.exe no specs ll.exe setup.exe rundll32.exe setup.tmp no specs congiunto.exe.pif no specs congiunto.exe.pif no specs cmd.exe no specs rundll32.exe no specs DllHost.exe no specs wmiprvse.exe no specs consent.exe no specs Profile Notification Host no specs PSIProfileNotify no specs conhost.exe no specs DllHost.exe no specs svchost.exe no specs werfault.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs svchost.exe taskeng.exe no specs svchost.exe no specs conhost.exe no specs conhost.exe no specs searchprotocolhost.exe no specs conhost.exe no specs Thumbnail Cache Class Factory for Out of Proc Server no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs Thumbnail Cache Class Factory for Out of Proc Server no specs conhost.exe no specs werfault.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs werfault.exe no specs conhost.exe no specs conhost.exe no specs DllHost.exe no specs werfault.exe no specs searchfilterhost.exe no specs conhost.exe no specs conhost.exe no specs DllHost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs werfault.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs werfault.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs werfault.exe no specs DllHost.exe no specs conhost.exe no specs werfault.exe no specs DllHost.exe no specs werfault.exe no specs conhost.exe no specs conhost.exe no specs DllHost.exe no specs DllHost.exe no specs conhost.exe no specs conhost.exe no specs DllHost.exe no specs DllHost.exe no specs conhost.exe no specs werfault.exe no specs DllHost.exe no specs conhost.exe no specs svchost.exe taskkill.exe no specs control.exe no specs rundll32.exe no specs tasklist.exe no specs find.exe no specs orxds.exe no specs forfiles.exe no specs conhost.exe no specs forfiles.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs schtasks.exe no specs conhost.exe no specs rundll32.exe schtasks.exe no specs werfault.exe no specs conhost.exe no specs powershell.exe no specs findstr.exe no specs congiunto.exe.pif no specs ping.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2908"C:\Program Files\Internet Explorer\iexplore.exe" "https://google.com"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1068"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2908 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
1632"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
3052"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6eded988,0x6eded998,0x6eded9a4C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3652"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,6641672657117367764,7346472303265760550,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1052 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1044,6641672657117367764,7346472303265760550,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1328 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1560"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,6641672657117367764,7346472303265760550,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1448"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,6641672657117367764,7346472303265760550,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2464"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,6641672657117367764,7346472303265760550,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2984"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,6641672657117367764,7346472303265760550,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
Total events
216 433
Read events
213 821
Write events
0
Delete events
0

Modification events

No data
Executable files
188
Suspicious files
323
Text files
246
Unknown types
97

Dropped files

PID
Process
Filename
Type
1068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:5A11C6099B9E5808DFB08C5C9570C92F
SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172
1068iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\NH1V0TZ9.txttext
MD5:A0DE7E4CDFDF474BB6E1416770DFC93B
SHA256:D58255F5E4BBEE17404AB90823CD5B24BF67648BEF3A3E96DA405BC348B6459C
2908iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFFCF00B270929EF7F.TMPgmc
MD5:5AD622C7091C13FC53AA476063582A34
SHA256:EA059AF66D4C3C11DD4AD7DEC7FBF6D73442332E4FBD95FE6955CA79ADC546EB
2908iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{42C873D0-1D90-11EB-BA2C-12A9866C77DE}.datbinary
MD5:F38D539A1C5ADAAA686874F740FA9040
SHA256:6202FD9AB33B1B184CF4AADF1B2AE56D55B74A2890EDD51784DDF25CC1454374
2908iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{7C61CE46-D8E0-11EC-B13F-12A9866C77DE}.datbinary
MD5:096BAC2CF6756C34830C35539E58B1A8
SHA256:E14E1B8CA13AF50A4FD1874F7503C2209057FD7CDC3D5397AAF61B6A9FD0A662
1068iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\ECUVAI9T.htmhtml
MD5:581D40812A8F6081F8E76335ED6CFBBC
SHA256:B502FCE4A0FB681CA9D689363145A75574AB13A989250BAB84A3EBE422A93852
1068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_7172467AE25B54F1B9D87A9343356E9Bbinary
MD5:6D0D6C785443DCDF798796EA360B58C8
SHA256:FAE720160C2036EFB47996FBEC6F57D0EA2129518EEA0420105343577DCF6C1F
1068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:399242ED2925DFFE308E17D4D88BBF6B
SHA256:2142B6734A3A0515D8C8F90C4A510043EEB16B9E00B9CDF8354721C1BD54ECA5
1068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_72BF6A27377E65244ED5348D2E81C743binary
MD5:6488FDEEE0EE865B17098340AF334664
SHA256:E3E046A57B50391806E28125DE35DE4340A18229ED7C5D3FB528F8953E2FB5B3
2908iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF3865FC0769CFE43E.TMPgmc
MD5:DD28CEE3F7B01671ABA224015C971F20
SHA256:831073DB81EE18C9D73B29B0680F44D85294F4A80334F586DF0EBDBE9F0D7EB7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
236
TCP/UDP connections
507
DNS requests
157
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
268
chrome.exe
GET
200
188.114.97.10:80
http://bj0gpwnzs5m.xyz/?s=2365&q=Adobe+Photoshop+CC+2022+23.1.1+Crack+++Keygen+Key+Download+%5BLatest%5D&dedica=23
US
html
177 b
malicious
4124
6288a1ea208a4_fd04fb523d.tmp
HEAD
200
151.115.10.1:80
http://cristaline.s3.pl-waw.scw.cloud/adv-matrix/poweroff.exe
FR
malicious
1068
iexplore.exe
GET
200
216.58.212.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDExSUZ712qmxLhqE9UUaDV
US
der
472 b
whitelisted
1068
iexplore.exe
GET
200
92.123.225.34:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6973aa0a37a4c3a8
unknown
compressed
4.70 Kb
whitelisted
1068
iexplore.exe
GET
200
216.58.212.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
268
chrome.exe
GET
200
67.26.83.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?332d555acecae02b
US
compressed
60.0 Kb
whitelisted
4124
6288a1ea208a4_fd04fb523d.tmp
GET
200
151.115.10.1:80
http://cristaline.s3.pl-waw.scw.cloud/adv-matrix/poweroff.exe
FR
executable
369 Kb
malicious
1068
iexplore.exe
GET
200
216.58.212.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFsL8ccV6MRJElibH7RYju4%3D
US
der
471 b
whitelisted
732
6288a1e916698_060a424.exe
GET
200
193.233.203.33:80
http://glicefud.com/checkversion.php?source=MIX2h1
RU
executable
84.0 Kb
suspicious
2908
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1068
iexplore.exe
142.250.186.131:443
ssl.gstatic.com
Google Inc.
US
whitelisted
1068
iexplore.exe
142.250.184.206:443
google.com
Google Inc.
US
whitelisted
268
chrome.exe
172.217.16.132:443
www.google.com
Google Inc.
US
whitelisted
2908
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
268
chrome.exe
142.250.185.142:443
clients2.google.com
Google Inc.
US
whitelisted
268
chrome.exe
142.250.185.67:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
268
chrome.exe
142.250.185.141:443
accounts.google.com
Google Inc.
US
whitelisted
2908
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1068
iexplore.exe
172.217.16.132:443
www.google.com
Google Inc.
US
whitelisted
1068
iexplore.exe
92.123.225.34:80
ctldl.windowsupdate.com
Akamai International B.V.
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
ctldl.windowsupdate.com
  • 92.123.225.34
  • 92.123.225.17
  • 67.26.83.254
  • 8.248.143.254
  • 8.248.139.254
  • 8.253.204.249
  • 8.248.149.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.pki.goog
  • 216.58.212.131
whitelisted
www.google.com
  • 172.217.16.132
  • 142.250.186.100
whitelisted
ssl.gstatic.com
  • 142.250.186.131
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
clientservices.googleapis.com
  • 142.250.185.67
whitelisted
accounts.google.com
  • 142.250.185.141
shared

Threats

PID
Process
Class
Message
268
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
4124
6288a1ea208a4_fd04fb523d.tmp
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
4124
6288a1ea208a4_fd04fb523d.tmp
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
4124
6288a1ea208a4_fd04fb523d.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
732
6288a1e916698_060a424.exe
Misc activity
ET INFO Packed Executable Download
732
6288a1e916698_060a424.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
732
6288a1e916698_060a424.exe
Misc activity
ET INFO EXE - Served Attached HTTP
732
6288a1e916698_060a424.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
732
6288a1e916698_060a424.exe
Misc activity
ET INFO EXE - Served Attached HTTP
186 ETPRO signatures available at the full report
No debug info