File name:

Install-trim.exe

Full analysis: https://app.any.run/tasks/9c5a36c6-5668-4b84-9305-2a83ae6ae66e
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: April 03, 2023, 11:01:25
OS: Windows 10 Professional (build: 19044, 32 bit)
Tags:
evasion
opendir
privateloader
loader
rat
redline
smoke
trojan
amadey
glupteba
gcleaner
xmrig
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
MD5:

497C0C8026727139EBFF3CCBCC8DFC38

SHA1:

41494C1585D92F440A8F32F1809452E8EB7813B8

SHA256:

9B4ADDDF6322B802A5B5074DFC69C81D77D7AA413B22CD2535D4545F9C5AD95E

SSDEEP:

98304:W6EqhYGJdReRkYc/OpmRQ2GXJVrUMkBdqzKOcZNLhKVgqwqBICISel84:RbRzYc2pmAnAPqzKOcZRhKVVwqeCISF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • Install-trim.exe (PID: 860)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • AppLaunch.exe (PID: 4584)
      • 123.exe (PID: 2412)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • explorer.exe (PID: 3516)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • FRec43.exe (PID: 3376)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)
      • oneetx.exe (PID: 876)
      • Gx97262lYh.exe (PID: 5752)
      • csrss.exe (PID: 2984)

    • PRIVATELOADER detected by memory dumps

      • Install-trim.exe (PID: 860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)

    • Actions looks like stealing of personal data

      • Install-trim.exe (PID: 860)
      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • AppLaunch.exe (PID: 4584)
      • 321.exe (PID: 4364)
      • 123.exe (PID: 2412)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • WdDjlez.exe (PID: 1560)
      • XLbLpcA.exe (PID: 4456)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)
      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)

    • Application was dropped or rewritten from another process

      • qFhmIDb8BIxQUFdW5UWHnMNs.exe (PID: 3528)
      • OQbOPyQ89XHaNNwzLvsqBV5p.exe (PID: 404)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • r0ZMjCbgQ3GitcxiLNxCz0ZV.exe (PID: 2288)
      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • kina7449.exe (PID: 4784)
      • kina2954.exe (PID: 1112)
      • kina5082.exe (PID: 5924)
      • bu899475.exe (PID: 4332)
      • 123.exe (PID: 2412)
      • 321.exe (PID: 4364)
      • Install.exe (PID: 1564)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • cor3860.exe (PID: 4920)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • dbm02s42.exe (PID: 928)
      • config.exe (PID: 2396)
      • en951568.exe (PID: 1796)
      • oneetx.exe (PID: 876)
      • ge005441.exe (PID: 2856)
      • AUQC_TyXdF2NxpjisVyXHUz4.exe (PID: 1532)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 3672)
      • uErVDzKGHwpWnWaFnBY_YCHs.exe (PID: 4644)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)
      • 6kFD86hI9wkIj8VXsCkolHzm.exe (PID: 3236)
      • Install.exe (PID: 5852)
      • Install.exe (PID: 4784)
      • JuZHKn.exe (PID: 2348)
      • csrss.exe (PID: 2984)
      • Gx97262lYh.exe (PID: 5752)
      • XLbLpcA.exe (PID: 4456)
      • WdDjlez.exe (PID: 1560)
      • oneetx.exe (PID: 4432)
      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)
      • oneetx.exe (PID: 2344)
      • oneetx.exe (PID: 5908)
      • oneetx.exe (PID: 2972)
      • oneetx.exe (PID: 2812)
      • oneetx.exe (PID: 4876)

    • Loads dropped or rewritten executable

      • is-VP8BJ.tmp (PID: 5648)

    • Disables Windows Defender

      • bu899475.exe (PID: 4332)
      • cor3860.exe (PID: 4920)

    • Runs injected code in another process

      • r0ZMjCbgQ3GitcxiLNxCz0ZV.exe (PID: 2288)
      • AUQC_TyXdF2NxpjisVyXHUz4.exe (PID: 1532)

    • Uses Task Scheduler to run other applications

      • config.exe (PID: 2396)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • oneetx.exe (PID: 876)
      • csrss.exe (PID: 2984)
      • Install.exe (PID: 4784)
      • WdDjlez.exe (PID: 1560)
      • AFcozsM.exe (PID: 2832)
      • XLbLpcA.exe (PID: 4456)
      • ElaBZGM.exe (PID: 4056)

    • Application was injected by another process

      • explorer.exe (PID: 3516)

    • Uses Task Scheduler to autorun other applications

      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • csrss.exe (PID: 2984)
      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)

    • Changes the Windows auto-update feature

      • bu899475.exe (PID: 4332)
      • cor3860.exe (PID: 4920)

    • REDLINE was detected

      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • AppLaunch.exe (PID: 4584)
      • 123.exe (PID: 2412)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 4584)
      • 123.exe (PID: 2412)
      • en951568.exe (PID: 1796)
      • dbm02s42.exe (PID: 928)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)
      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)

    • REDLINE detected by memory dumps

      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • NAcJuQJoInPC4o96TSeV64RA.exe (PID: 2952)

    • The DLL Hijacking

      • msedge.exe (PID: 480)

    • Changes the autorun value in the registry

      • oneetx.exe (PID: 876)
      • csrss.exe (PID: 2984)

    • Glupteba is detected

      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)

    • Creates a writable file the system directory

      • csrss.exe (PID: 2984)

    • GCLEANER detected by memory dumps

      • FRec43.exe (PID: 3376)

    • SMOKE was detected

      • explorer.exe (PID: 3516)

    • AMADEY detected by memory dumps

      • oneetx.exe (PID: 876)

    • Starts CMD.EXE for self-deleting

      • FRec43.exe (PID: 3376)

    • AMADEY was detected

      • oneetx.exe (PID: 876)

    • Modifies files in the Chrome extension folder

      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)

    • GLUPTEBA was detected

      • csrss.exe (PID: 2984)

  • SUSPICIOUS

    • Reads the BIOS version

      • Install-trim.exe (PID: 860)
      • config.exe (PID: 2396)
      • 321.exe (PID: 4364)
      • 123.exe (PID: 2412)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • Install.exe (PID: 4784)

    • Connects to the server without a host name

      • Install-trim.exe (PID: 860)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • FRec43.exe (PID: 3376)
      • oneetx.exe (PID: 876)
      • Gx97262lYh.exe (PID: 5752)

    • Reads settings of System Certificates

      • explorer.exe (PID: 3516)
      • Install-trim.exe (PID: 860)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • 321.exe (PID: 4364)

    • Checks for external IP

      • Install-trim.exe (PID: 860)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)

    • Reads security settings of Internet Explorer

      • Install-trim.exe (PID: 860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)

    • Executable content was dropped or overwritten

      • Install-trim.exe (PID: 860)
      • qFhmIDb8BIxQUFdW5UWHnMNs.exe (PID: 3528)
      • OQbOPyQ89XHaNNwzLvsqBV5p.exe (PID: 404)
      • kina7449.exe (PID: 4784)
      • kina2954.exe (PID: 1112)
      • kina5082.exe (PID: 5924)
      • is-VP8BJ.tmp (PID: 5648)
      • ENHyIm3XYZ0e3IdDbGVY0Gnm.exe (PID: 5456)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • 90dmHy_NLIqw9crC48CH28EB.exe (PID: 2844)
      • explorer.exe (PID: 3516)
      • config.exe (PID: 2396)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • ge005441.exe (PID: 2856)
      • uErVDzKGHwpWnWaFnBY_YCHs.exe (PID: 4644)
      • is-JNR1C.tmp (PID: 3904)
      • 6kFD86hI9wkIj8VXsCkolHzm.exe (PID: 3236)
      • Install.exe (PID: 5852)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)
      • FRec43.exe (PID: 3376)
      • csrss.exe (PID: 2984)
      • Install.exe (PID: 4784)
      • WdDjlez.exe (PID: 1560)
      • oneetx.exe (PID: 876)
      • AFcozsM.exe (PID: 2832)
      • XLbLpcA.exe (PID: 4456)
      • ElaBZGM.exe (PID: 4056)

    • Process requests binary or script from the Internet

      • Install-trim.exe (PID: 860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • oneetx.exe (PID: 876)

    • Checks Windows Trust Settings

      • Install-trim.exe (PID: 860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)

    • Reads the Windows owner or organization settings

      • is-VP8BJ.tmp (PID: 5648)
      • is-JNR1C.tmp (PID: 3904)

    • Executes application which crashes

      • NAcJuQJoInPC4o96TSeV64RA.exe (PID: 2952)
      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)

    • Starts CMD.EXE for commands execution

      • forfiles.exe (PID: 896)
      • forfiles.exe (PID: 5836)
      • cmd.exe (PID: 1744)
      • oneetx.exe (PID: 876)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)
      • forfiles.exe (PID: 1468)
      • forfiles.exe (PID: 5480)
      • csrss.exe (PID: 2984)
      • FRec43.exe (PID: 3376)
      • powershell.exe (PID: 5468)
      • powershell.exe (PID: 6128)
      • AFcozsM.exe (PID: 2832)
      • powershell.exe (PID: 5644)
      • powershell.exe (PID: 4004)
      • ElaBZGM.exe (PID: 4056)

    • Found strings related to reading or modifying Windows Defender settings

      • forfiles.exe (PID: 896)
      • forfiles.exe (PID: 5836)
      • forfiles.exe (PID: 1468)
      • forfiles.exe (PID: 5480)
      • powershell.exe (PID: 6128)
      • powershell.exe (PID: 5468)
      • AFcozsM.exe (PID: 2832)
      • powershell.exe (PID: 5644)
      • powershell.exe (PID: 4004)
      • ElaBZGM.exe (PID: 4056)

    • Uses REG/REGEDIT.EXE to modify register

      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 5784)
      • cmd.exe (PID: 2160)
      • cmd.exe (PID: 1528)
      • cmd.exe (PID: 1324)
      • powershell.exe (PID: 6128)
      • cmd.exe (PID: 5648)
      • powershell.exe (PID: 5468)
      • cmd.exe (PID: 5300)
      • cmd.exe (PID: 5456)
      • cmd.exe (PID: 6096)
      • powershell.exe (PID: 5644)
      • powershell.exe (PID: 4004)
      • cmd.exe (PID: 2196)
      • cmd.exe (PID: 5204)
      • cmd.exe (PID: 520)
      • cmd.exe (PID: 2696)
      • cmd.exe (PID: 5856)
      • cmd.exe (PID: 5356)
      • cmd.exe (PID: 5352)

    • Searches for installed software

      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • AppLaunch.exe (PID: 4584)
      • 123.exe (PID: 2412)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • is-JNR1C.tmp (PID: 3904)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)

    • Reads browser cookies

      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • 123.exe (PID: 2412)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • AppLaunch.exe (PID: 4584)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)

    • Connects to unusual port

      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • AppLaunch.exe (PID: 4584)
      • 123.exe (PID: 2412)
      • en951568.exe (PID: 1796)
      • dbm02s42.exe (PID: 928)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)

    • Starts itself from another location

      • ge005441.exe (PID: 2856)
      • 6kFD86hI9wkIj8VXsCkolHzm.exe (PID: 3236)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)

    • Application launched itself

      • cmd.exe (PID: 1744)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 3672)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1744)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 3984)

    • Creates files in the driver directory

      • csrss.exe (PID: 2984)

    • The process creates files with name similar to system file names

      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 2324)

    • Drops a system driver (possible attempt to evade defenses)

      • csrss.exe (PID: 2984)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 5896)

    • Starts POWERSHELL.EXE for commands execution

      • WdDjlez.exe (PID: 1560)
      • XLbLpcA.exe (PID: 4456)

    • Uses RUNDLL32.EXE to load library

      • oneetx.exe (PID: 876)

    • Xmrig is detected

      • csrss.exe (PID: 2984)

  • INFO

    • Checks supported languages

      • Install-trim.exe (PID: 860)
      • TextInputHost.exe (PID: 4712)
      • qFhmIDb8BIxQUFdW5UWHnMNs.exe (PID: 3528)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • OQbOPyQ89XHaNNwzLvsqBV5p.exe (PID: 404)
      • r0ZMjCbgQ3GitcxiLNxCz0ZV.exe (PID: 2288)
      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • kina7449.exe (PID: 4784)
      • is-VP8BJ.tmp (PID: 5648)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • kina2954.exe (PID: 1112)
      • kina5082.exe (PID: 5924)
      • bu899475.exe (PID: 4332)
      • ENHyIm3XYZ0e3IdDbGVY0Gnm.exe (PID: 5456)
      • 90dmHy_NLIqw9crC48CH28EB.exe (PID: 2844)
      • NAcJuQJoInPC4o96TSeV64RA.exe (PID: 2952)
      • AppLaunch.exe (PID: 4584)
      • 123.exe (PID: 2412)
      • 321.exe (PID: 4364)
      • Install.exe (PID: 1564)
      • FRec43.exe (PID: 2352)
      • config.exe (PID: 2396)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • cor3860.exe (PID: 4920)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • ge005441.exe (PID: 2856)
      • oneetx.exe (PID: 876)
      • AUQC_TyXdF2NxpjisVyXHUz4.exe (PID: 1532)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 3672)
      • uErVDzKGHwpWnWaFnBY_YCHs.exe (PID: 4644)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)
      • 6kFD86hI9wkIj8VXsCkolHzm.exe (PID: 3236)
      • FRec43.exe (PID: 3376)
      • is-JNR1C.tmp (PID: 3904)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)
      • Install.exe (PID: 5852)
      • Install.exe (PID: 4784)
      • csrss.exe (PID: 2984)
      • JuZHKn.exe (PID: 2348)
      • Gx97262lYh.exe (PID: 5752)
      • WdDjlez.exe (PID: 1560)
      • XLbLpcA.exe (PID: 4456)
      • oneetx.exe (PID: 4432)
      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)
      • oneetx.exe (PID: 2344)
      • oneetx.exe (PID: 5908)
      • oneetx.exe (PID: 2972)
      • oneetx.exe (PID: 2812)
      • oneetx.exe (PID: 4876)

    • Process checks are UAC notifies on

      • Install-trim.exe (PID: 860)
      • 321.exe (PID: 4364)
      • 123.exe (PID: 2412)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)

    • Reads the computer name

      • Install-trim.exe (PID: 860)
      • TextInputHost.exe (PID: 4712)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • is-VP8BJ.tmp (PID: 5648)
      • bu899475.exe (PID: 4332)
      • ENHyIm3XYZ0e3IdDbGVY0Gnm.exe (PID: 5456)
      • AppLaunch.exe (PID: 4584)
      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • config.exe (PID: 2396)
      • 321.exe (PID: 4364)
      • 123.exe (PID: 2412)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • cor3860.exe (PID: 4920)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • ge005441.exe (PID: 2856)
      • oneetx.exe (PID: 876)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)
      • is-JNR1C.tmp (PID: 3904)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 3672)
      • Install.exe (PID: 4784)
      • FRec43.exe (PID: 3376)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)
      • csrss.exe (PID: 2984)
      • Gx97262lYh.exe (PID: 5752)
      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)

    • The process checks LSA protection

      • Install-trim.exe (PID: 860)
      • TextInputHost.exe (PID: 4712)
      • mmc.exe (PID: 5708)
      • is-VP8BJ.tmp (PID: 5648)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • bu899475.exe (PID: 4332)
      • ENHyIm3XYZ0e3IdDbGVY0Gnm.exe (PID: 5456)
      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • AppLaunch.exe (PID: 4584)
      • WerFault.exe (PID: 5336)
      • config.exe (PID: 2396)
      • conhost.exe (PID: 3760)
      • conhost.exe (PID: 4580)
      • 321.exe (PID: 4364)
      • 123.exe (PID: 2412)
      • schtasks.exe (PID: 1092)
      • schtasks.exe (PID: 4352)
      • WerFault.exe (PID: 2992)
      • schtasks.exe (PID: 4984)
      • schtasks.exe (PID: 956)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • cor3860.exe (PID: 4920)
      • schtasks.exe (PID: 620)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • explorer.exe (PID: 3516)
      • schtasks.exe (PID: 5772)
      • schtasks.exe (PID: 5844)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • ge005441.exe (PID: 2856)
      • oneetx.exe (PID: 876)
      • schtasks.exe (PID: 4500)
      • is-JNR1C.tmp (PID: 3904)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 3672)
      • conhost.exe (PID: 8)
      • conhost.exe (PID: 4456)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)
      • netsh.exe (PID: 5368)
      • Install.exe (PID: 4784)
      • FRec43.exe (PID: 3376)
      • csrss.exe (PID: 2984)
      • schtasks.exe (PID: 4640)
      • schtasks.exe (PID: 5076)
      • schtasks.exe (PID: 5868)
      • schtasks.exe (PID: 2964)
      • schtasks.exe (PID: 2848)
      • schtasks.exe (PID: 4896)
      • taskkill.exe (PID: 3164)
      • schtasks.exe (PID: 5092)
      • Gx97262lYh.exe (PID: 5752)
      • powershell.exe (PID: 6128)
      • powershell.exe (PID: 5468)
      • schtasks.exe (PID: 6120)
      • schtasks.exe (PID: 4932)
      • powershell.exe (PID: 5644)
      • schtasks.exe (PID: 5136)
      • schtasks.exe (PID: 1184)
      • AFcozsM.exe (PID: 2832)
      • schtasks.exe (PID: 4064)
      • schtasks.exe (PID: 4292)
      • powershell.exe (PID: 4004)
      • schtasks.exe (PID: 928)
      • schtasks.exe (PID: 2136)
      • schtasks.exe (PID: 5992)
      • schtasks.exe (PID: 1816)
      • schtasks.exe (PID: 840)
      • schtasks.exe (PID: 5620)
      • schtasks.exe (PID: 3112)
      • schtasks.exe (PID: 5256)
      • schtasks.exe (PID: 5924)
      • schtasks.exe (PID: 4176)
      • ElaBZGM.exe (PID: 4056)
      • schtasks.exe (PID: 3560)
      • schtasks.exe (PID: 1108)
      • schtasks.exe (PID: 2088)
      • schtasks.exe (PID: 4760)
      • schtasks.exe (PID: 872)
      • schtasks.exe (PID: 5588)
      • schtasks.exe (PID: 5120)
      • schtasks.exe (PID: 1960)
      • schtasks.exe (PID: 72)
      • schtasks.exe (PID: 5068)
      • schtasks.exe (PID: 3212)
      • schtasks.exe (PID: 5524)
      • schtasks.exe (PID: 5376)
      • schtasks.exe (PID: 2160)
      • schtasks.exe (PID: 4276)
      • schtasks.exe (PID: 388)
      • schtasks.exe (PID: 5252)

    • Reads the machine GUID from the registry

      • Install-trim.exe (PID: 860)
      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • AppLaunch.exe (PID: 4584)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • 321.exe (PID: 4364)
      • 123.exe (PID: 2412)
      • cor3860.exe (PID: 4920)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 3672)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)
      • ywmu4KSAqsT_ea2q7SFQIKHm.exe (PID: 2716)
      • csrss.exe (PID: 2984)
      • FRec43.exe (PID: 3376)
      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)

    • Checks proxy server information

      • Install-trim.exe (PID: 860)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • 321.exe (PID: 4364)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • explorer.exe (PID: 3516)
      • oneetx.exe (PID: 876)
      • FRec43.exe (PID: 3376)
      • Gx97262lYh.exe (PID: 5752)

    • Process checks computer location settings

      • Install-trim.exe (PID: 860)
      • ENHyIm3XYZ0e3IdDbGVY0Gnm.exe (PID: 5456)
      • config.exe (PID: 2396)
      • 321.exe (PID: 4364)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • ge005441.exe (PID: 2856)
      • oneetx.exe (PID: 876)
      • Install.exe (PID: 4784)
      • FRec43.exe (PID: 3376)
      • csrss.exe (PID: 2984)
      • ElaBZGM.exe (PID: 4056)
      • AFcozsM.exe (PID: 2832)

    • Reads the software policy settings

      • Install-trim.exe (PID: 860)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 1860)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • 321.exe (PID: 4364)
      • powershell.exe (PID: 5468)
      • powershell.exe (PID: 6128)
      • powershell.exe (PID: 5644)
      • powershell.exe (PID: 4004)

    • Manual execution by a user

      • mmc.exe (PID: 388)
      • mmc.exe (PID: 5708)

    • Creates files or folders in the user directory

      • Install-trim.exe (PID: 860)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • 321.exe (PID: 4364)
      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • bu899475.exe (PID: 4332)
      • AppLaunch.exe (PID: 4584)
      • UyXyFj8BzRYAWuLz2_yZxCty.exe (PID: 3936)
      • cor3860.exe (PID: 4920)
      • 123.exe (PID: 2412)
      • explorer.exe (PID: 3516)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • FRec43.exe (PID: 3376)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)
      • oneetx.exe (PID: 876)
      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)

    • Create files in a temporary directory

      • qFhmIDb8BIxQUFdW5UWHnMNs.exe (PID: 3528)
      • OQbOPyQ89XHaNNwzLvsqBV5p.exe (PID: 404)
      • is-VP8BJ.tmp (PID: 5648)
      • kina7449.exe (PID: 4784)
      • kina2954.exe (PID: 1112)
      • kina5082.exe (PID: 5924)
      • 90dmHy_NLIqw9crC48CH28EB.exe (PID: 2844)
      • Install.exe (PID: 1564)
      • chrome.exe (PID: 5288)
      • config.exe (PID: 2396)
      • msedge.exe (PID: 1304)
      • ge005441.exe (PID: 2856)
      • uErVDzKGHwpWnWaFnBY_YCHs.exe (PID: 4644)
      • is-JNR1C.tmp (PID: 3904)
      • 6kFD86hI9wkIj8VXsCkolHzm.exe (PID: 3236)
      • Install.exe (PID: 5852)
      • Install.exe (PID: 4784)

    • Creates files in the program directory

      • is-VP8BJ.tmp (PID: 5648)
      • tgbNAjO2NE2EyJodUdX4yQPl.exe (PID: 3296)
      • aSFBx7xAgYNAhSZOuwTeFHAR.exe (PID: 4656)
      • is-JNR1C.tmp (PID: 3904)
      • AFcozsM.exe (PID: 2832)
      • ElaBZGM.exe (PID: 4056)

    • Application was dropped or rewritten from another process

      • is-VP8BJ.tmp (PID: 5648)
      • is-JNR1C.tmp (PID: 3904)

    • Reads product name

      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • AppLaunch.exe (PID: 4584)
      • 123.exe (PID: 2412)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)

    • Reads Environment values

      • TV58WTC0zcbhmffbh6DL_vTe.exe (PID: 2204)
      • AppLaunch.exe (PID: 4584)
      • 123.exe (PID: 2412)
      • 321.exe (PID: 4364)
      • dbm02s42.exe (PID: 928)
      • en951568.exe (PID: 1796)
      • oneetx.exe (PID: 876)
      • RDD8nmF3VJdcn1zPnv2O6WoV.exe (PID: 1260)

    • Application launched itself

      • chrome.exe (PID: 5288)
      • msedge.exe (PID: 1304)

    • [YARA] Firewall manipulation strings were found

      • mmc.exe (PID: 5708)
      • csrss.exe (PID: 2984)

    • Reads settings of System Certificates

      • powershell.exe (PID: 5468)
      • powershell.exe (PID: 6128)
      • powershell.exe (PID: 5644)
      • powershell.exe (PID: 4004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

PrivateLoader

(PID) Process(860) Install-trim.exe
C2 (6)http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
149.154.158.34
94.142.138.113
94.142.138.131
208.67.104.60
Attributes
Payload (36)https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
https://vk.com/doc746114504_647280734?hash=Doz4iot4bg0WOvZC8ZMInERV5U1fmjrKZZhl7jf6wBE&dl=G42DMMJRGQ2TANA:1661413506:vGfIf9YivGqE9gd11wvm9KZLzv9DMwdM9Wp0LmcsAhz&api=1&no_preview=1
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
http://mnbuiy.pw/adsli/note8876.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
https://iplogger.org/2BTmf7
https://iplogger.org/2BAmf7
https://iplogger.org/2BDmf7
https://iplogger.org/2BFmf7
https://iplogger.org/2s2pg6
https://iplogger.org/2s3pg6
https://iplogger.org/2s4pg6
https://iplogger.org/2s5pg6
https://iplogger.org/2s6pg6
https://iplogger.org/2s7pg6
Strings (821)Snowman+under_a_sn0wdrift_forgot_the_Snow_Maiden
iplogger.org/1nhuM4.js
SOFTWARE\LilFreske
Installed
SOFTWARE\LilFreskeUS
IsWow64Process
GetModuleHandleA
LoadLibraryA
SetPriorityClass
Sleep
GetTempPathA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
CreateThread
CloseHandle
VirtualAlloc
VirtualFree
OpenProcess
TerminateProcess
GetUserGeoID
ntdll.dll
NtQuerySystemInformation
RtlGetVersion
Shell32.dll
ShellExecuteA
SHGetFolderPathA
Advapi32.dll
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
ConvertSidToStringSidA
LookupAccountNameA
WINHTTP.dll
wininet.dll
GetComputerNameA
VerSetConditionMask
VerifyVersionInfoW
GetGeoInfoA
GetCurrentProcess
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
User32.dll
CharToOemA
//Minor Policy
SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions
Exclusions_Extensions
SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions
SOFTWARE\Policies\Microsoft\Windows Defender
DisableAntiSpyware
DisableRoutinelyTakingAction
SOFTWARE\Policies\Microsoft\Windows\System
EnableSmartScreen
SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring
DisableOnAccessProtection
DisableScanOnRealtimeEnable
DisableRealtimeMonitoring
DisableIOAVProtection
DisableRawWriteNotification
Windows Server 2016
Windows Server 2012 R2
Windows Server 2012
Windows Server 2008 R2
Windows Server 2008
Windows Server
Windows 10
Windows 8.1
Windows 8
Windows 7
Windows Vista
Windows XP
(x64)
(x32)
explorer.exe
current
children
SOFTWARE\Classes\ms-settings\Shell\Open\command
DelegateExecute
\ComputerDefaults.exe
SOFTWARE\Classes
ms-settings\Shell\Open\command
ms-settings\Shell\Open
ms-settings\Shell
ms-settings
data=
/api/firegate.php
Error!
onlyType
ext_url
cfg_url
ipinfo.io/widget
country
company
Google LLC
db-ip.com
data-api-key="
/self
countryCode
organization
www.maxmind.com/geoip/v2.1/city/me
iso_code
traits
GetIP
api.ipgeolocation.io/ipgeo?include=hostname&ip=
country_code2
/api/tracemap.php
http://
15.5pnp.10.lock
Guest Profile
System Profile
\Google\Chrome\Application
(x86)\Google\Chrome\Application
SOFTWARE\Google\Chrome\BLBeacon
version
\resources.pak
SOFTWARE\Google\Chrome\PreferenceMACs
\Google\Chrome\User Data\
\Secure Preferences
filter_browsers
chrome
browser
use_open_browser
extensions
settings
install_time
\Extensions\
\u003C
protection
extensions.settings.
super_mac
chrome.exe
ChromeRegistryHashStoreValidationSeed
\extensions.settings
SOFTWARE\Google\Chrome\PreferenceMACs\
\chrome.exe
\Microsoft\Edge\Application
(x86)\Microsoft\Edge\Application
SOFTWARE\Microsoft\Edge\BLBeacon
SOFTWARE\Microsoft\Edge\PreferenceMACs
\Microsoft\Edge\User Data\
msedge.exe
SOFTWARE\Microsoft\Edge\PreferenceMACs\
\msedge.exe
\Roaming
\atomic
\Atomic Wallet
\com.liberty.jaxx
\Electrum
\Exodus
\MultiDoge
\Monero
\binance.chain
\Binance
\Metamask
\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh
\Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn
\Local Extension Settings\aodkkagnadcbobfpggfnjeongemjbjca
\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
\Local Extension Settings\fmblappgoiilbgafhjklehhfifbdocee
\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf
\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
sorare.com
yobit.net
zb.com
binance.com
huobi.com
okex.com
hitbtc.com
bitfinex.com
kraken.com
bitstamp.net
payoneer.com
bittrex.com
bittrex.zendesk.com
gate.io
exmo.com
yobit.io
bitflyer.com
poloniex.com
kucoin.com
coinone.co.kr
localbitcoins.com
korbit.co.kr
cex.io
luno.com
bitkonan.com
jubi.com
koinex.in
koineks.com
kuna.io
koinim.com
kiwi-coin.com
leoxchange.com
lykke.com
localtrade.cc
magnr.com
lbank.info
itbit.com
gemini.com
gdax.com
gatehub.net
satoshitango.com
foxbit.com.br
flowbtc.com.br
exx.com
exrates.me
excambriorex.com
ezbtc.ca
infinitycoin.exchange
tdax.com
stex.com
vbtc.exchange
coinmarketcap.com
vwlpro.com
nocks.com
nlexch.com
novaexchange.com
mynxt.info
nzbcx.com
nevbit.com
mixcoins.com
mr.exchange
neraex.pro
dsx.uk
okcoin.com
liquid.com
quoine.com
quadrigacx.com
rightbtc.com
rippex.net
ripplefox.com
qryptos.com
ore.bz
openledger.info
omnidex.io
paribu.com
paymium.com
dcexchange.ru
dcexe.com
bitmex.com
funpay.ru
bitmaszyna.pl
bitonic.nl
bitpanda.com
bitsblockchain.net
bitmarket.net
bitlish.com
bitfex.trade
blockchain.com
blockchain.info
cryptofresh.com
btcmarkets.net
braziliex.com
btc-trade.com.ua
btc-alpha.com
bitspark.io
bitso.com
bittylicious.com
altcointrader.co.za
arenabitcoin.com
allcoin.com
796.com
abucoins.com
aidosmarket.com
bitcointrade.com
bitcointoyou.com
bitbanktrade.jp
big.one
bcex.ca
bitconnect.co
coinsbank.com
coinsecure.in
coinsquare.com
coinspot.io
coinsmarkets.com
crypto-bridge.org
dcex.com
dabtc.com
decentrex.com
deribit.com
dgtmarket.com
btcturk.com
btcxindia.com
bt.cx
bitstarcoin.com
coincheck.com
coinmate.io
coingi.com
coinnest.co.kr
coinrail.co.kr
coinpit.io
coingather.com
coinfloor.co.uk
coinegg.com
coincorner.com
coinexchange.io
pancakeswap.finance
coinbase.com
livecoin.net
mercatox.com
cryptobridge.freshdesk.com
volabit.com
tradeogre.com
bitkub.com
uphold.com
wallet.uphold.com
login.blockchain.com
tidex.com
coinome.com
coinpayments.net
bitmax.io
bitbank.cc
independentreserve.com
bitmart.com
cryptopia.co.nz
cryptonator.com
advcash.com
my.dogechain.info
spectrocoin.com
exir.io
exir.tech
coinbene.com
bitforex.com
gopax.co.kr
catex.io
vindax.com
coineal.com
maicoin.com
finexbox.com
etherflyer.com
bx.in.th
bitopro.com
citex.co.kr
coinzo.com
atomars.com
coinfinit.com
bitker.com
dobitrade.com
btcexa.com
satowallet.com
cpdax.com
trade.io
btcnext.io
exmarkets.com
btc-exchange.com
chaoex.com
jex.com
therocktrading.com
gdac.com
southxchange.com
tokens.net
fexpro.net
btcbox.co.jp
coinmex.com
cryptology.com
cointiger.com
cashierest.com
coinbit.co.kr
mxc.com
bilaxy.com
coinall.com
coindeal.com
omgfin.com
oceanex.pro
bithumb.com
ftx.com
shortex.net
coin.z.com
fcoin.com
fatbtc.com
tokenize.exchange
simex.global
instantbitex.com
\Login Data
SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
\BraveSoftware\Brave-Browser\User Data\
SOFTWARE\CryptoTab Browser\PreferenceMACs
\CryptoTab Browser\User Data\
\Opera Software\Opera Stable
ascendex.com
crypto.com
coins.ph
coins.th
dogechain.info
miningpoolhub.com
/vpn/index.html
portal/webclient
remote/login
/vpn/tmindex.html
/LogonPoint/tmindex.html
XenApp1/auth/login.aspx
auth/silentDetection.aspx
/citrix/
/RDWeb/
/+CSCOE+/
/global-protect/
sslvpn.
/dana-na/
/my.policy
ncsecu.org
penfed.org
becu.org
schoolsfirstfcu.org
firsttechfed.com
golden1.com
alliantcreditunion.org
americafirst.com
suncoastcreditunion.com
secumd.org
safecu.org
missionfed.com
greendot.com
rbfcu.org
macu.com
dcu.org
ssfcu.org
bethpagefcu.com
starone.org
alaskausa.org
sdccu.com
aacreditunion.org
lmcu.org
teachersfcu.org
patelco.org
esl.org
onpointcu.com
logixbanking.com
psecu.com
deltacommunitycu.com
ent.com
cefcu.com
greenstate.org
unfcu.org
pffcu.org
wingsfinancial.com
iccu.comdesertfinancial.com
iccu.com
desertfinancial.com
hvfcu.org
wpcu.coop
redwoodcu.org
tcunet.com
wsecu.org
joviafinancial.com
coastal24.com
myeecu.org
gecreditunion.org
nymcu.org
affinityfcu.com
towerfcu.org
ccu.com
communityamerica.com
langleyfcu.org
credithuman.com
techcu.com
gecu.com
kfcu.org
applefcu.org
nasafcu.com
sfcu.org
genisyscu.org
unifyfcu.com
apcocu.org
firstcommunity.com
unitedfcu.com
fairwinds.org
ufcu.org
wescom.org
bcu.org
vacu.org
citadelbanking.com
servicecu.org
summitcreditunion.com
gesa.com
chevronfcu.org
traviscu.org
uwcu.org
communityfirstcu.org
ecu.org
sccu.com
bfsfcu.org
bellco.org
dfcufinancial.com
msufcu.org
members1st.org
landmarkcu.com
kinecta.org
midflorida.com
visionsfcu.org
veridiancu.org
statefarmfcu.com
tinkerfcu.org
sefcu.com
americanheritagecu.org
robinsfcu.org
canvas.org
growfinancial.org
truliantfcu.org
ascend.org
foundersfcu.com
calcoastcu.org
ucu.org
connexuscu.org
slfcu.org
numericacu.com
eecu.org
georgiasown.org
nusenda.org
tvacreditunion.com
pcu.org
msgcu.org
nuvisionfederal.com
trumarkonline.org
navigantcu.org
ornlfcu.com
jscfcu.org
lgfcu.org
elevationscu.com
gtefinancial.org
chartway.com
ecu.com
sdfcu.org
apcu.com
schools.org
metrocu.org
campuscu.com
adviacu.org
psfcu.com
andrewsfcu.org
eglinfcu.org
imcu.com
americaneagle.org
ttcu.com
vantagewest.org
empowerfcu.com
rfcu.com
capcomfcu.org
arizonafederal.org
csecreditunion.com
communityfirstfl.org
bayportcu.org
gwcu.org
wecu.com
stgeorge.com.au
imb.com.au
ing.com.au
bankofmelbourne.com.au
regionalaustraliabank.com
suncorp.com.au
regionalaustraliabank.com.au
bmo.com
cwbank.com
royalbank.com
vancity.com
servus.ca
coastcapitalsavings.com
alterna.ca
interiorsavings.com
synergycu.ca
mainstreetcu.ca
cu.com
fcu.com
robinhood.com
navyfederal.org
tboholidays.com
24x7rooms.com
adonis.com
abreuonline.com
almundo.com.ar
bonotel.com
bookohotel.com
didatravel.com
dotwconnect.com
eetglobal.com
escalabeds.com
fastpayhotels.com
getaroom.com
goglobal.travel
hoteldo.com.mx
hotelspro.com
jumbonline.com
kaluahtours.com
lci-euro.com
lotsofhotels.com
mikinet.co.uk
misterroom.com
nexustours.com
olympiaeurope.com
paximum.com
restel.es
rezserver.com
rezlive.com
sunhotels.com
totalstay.com
travco.co.uk
travellanda.com
smyrooms.com
welcomebeds.com
yalago.com
hotelbeds.com
mercadolibre.com.mx
hsbc.com.mx
bbvanetcash.mx
scotiabank.com.mx
santander.com.mx
bbva.mx
opensea.io
plantvsundead.com
axieinfinity.com
cryptocars.me
bombcrypto.io
cryptoplanes.me
cryptozoon.io
bankalhabib.com
correosprepago.es
orangebank.es
amazon.it
amazon.ca
amazon.de
amazon.com
netspend.com
online.citi.com
cloud.ibm.com
ca.ovh.com
account.alibabacloud.com
cloud.huawei.com
cloud.tencent.com
vultr.com
aws.amazon.com
portal.azure.com
digitalocean.com
console.scaleway.com
hetzner.com
linode.com
oracle.com
rackspace.com
phoenixnap.com
leaseweb.com
sso.ctl.io
ctl.io
lumen.com
paypal.com
WW_P_7
WW_P_8
https://
WW_P_
WW_P_1
links
ezstat.ru/1BfPg7
USA_1
iplis.ru/1BX4j7.png
iplis.ru/1BV4j7.mp4
USA_2
iplogger.org/1nkuM4.jpeg
iplis.ru/1BNhx7.mp3
iplis.ru/1pRXr7.txt
SetIncrement|ww_starts
false
iplis.ru/1S2Qs7.mp3
iplis.ru/1S3fd7.mp3
iplis.ru/17VHv7.mp3
iplis.ru/1GLDc7.mp3
iplis.ru/1xDsk7.mp3
iplis.ru/1xFsk7.mp3
WW_OPERA
iplis.ru/1GCuv7.pdf
iplis.ru/1lmex.mp3
iplis.ru/1Gemv7.mp3
WW_10
iplis.ru/1Gymv7.mp3
WW_11
iplis.ru/1tqHh7.mp3
WW_12
iplis.ru/1aFYp7.mp3
WW_13
iplis.ru/1cC8u7.mp3
WW_14
iplis.ru/1cN8u7.mp3
WW_15
iplis.ru/1kicy7.mp3
iplis.ru/1BMhx7.mp3
WW_16
iplis.ru/1edLy7.png
WW_17
iplis.ru/1nGPt7.png
WW_P_2
iplis.ru/1Bshv7.mp3
WW_P_3
iplis.ru/1Lgnh7.mp3
WW_P_4
iplis.ru/1vt8c7.mp3
WW_P_5
iplis.ru/1IcfD.mp3
WW_P_6
iplis.ru/1eXqs7.mp3
iplis.ru/1Unzy7.mp3
WW_18
iplis.ru/12hYs7.mp3
WW_19
iplis.ru/12d8d7.mp3
WW_20
iplis.ru/1Uvgu7.mp3
WW_21
iplis.ru/1jvTz7.mp3
browsers
Chrome:
Edge:
os_country_code
ip_country
AddExtensionStat|
net_country_code
https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
https://vk.com/doc746114504_647280734?hash=Doz4iot4bg0WOvZC8ZMInERV5U1fmjrKZZhl7jf6wBE&dl=G42DMMJRGQ2TANA:1661413506:vGfIf9YivGqE9gd11wvm9KZLzv9DMwdM9Wp0LmcsAhz&api=1&no_preview=1
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://91.241.19.125/pub.php?pub=one
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
http://mnbuiy.pw/adsli/note8876.exe
http://sarfoods.com/index.php
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
https://iplogger.org/2BTmf7
https://iplogger.org/2BAmf7
https://iplogger.org/2BDmf7
https://iplogger.org/2BFmf7
https://iplogger.org/2s2pg6
https://iplogger.org/2s3pg6
https://iplogger.org/2s4pg6
https://iplogger.org/2s5pg6
https://iplogger.org/2s6pg6
https://iplogger.org/2s7pg6
crypto_wallets
domain
bank_wallets
cu_bank_wallets
shop_wallets
bank_au_wallets
amazon_eu
webhosts
paypal
bank_ca_wallets
browser_vbmt
GetCryptoSleeping
149.154.158.34
94.142.138.113
94.142.138.131
208.67.104.60
cryptoWallets
status
bankWallets
cuBankWallets
shops
bankAUWallets
bankCAWallets
cryptoWallets_part1
cryptoWallets_part2
bankWallets_part1
bankWallets_part2
bankMXWallets
cryptoGames
bankPKWallets
bankESWallets
SetLoaderAnalyze|
SetIncrement|not_elevated
WinHttpConnect
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpSetTimeouts
InternetOpenA
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenUrlA
HttpQueryInfoA
InternetQueryOptionA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
(PID) Process(1860) UyXyFj8BzRYAWuLz2_yZxCty.exe
C2 (6)http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
149.154.158.34
94.142.138.113
94.142.138.131
208.67.104.60
Attributes
Payload (36)https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
https://vk.com/doc746114504_647280734?hash=Doz4iot4bg0WOvZC8ZMInERV5U1fmjrKZZhl7jf6wBE&dl=G42DMMJRGQ2TANA:1661413506:vGfIf9YivGqE9gd11wvm9KZLzv9DMwdM9Wp0LmcsAhz&api=1&no_preview=1
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
http://mnbuiy.pw/adsli/note8876.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
https://iplogger.org/2BTmf7
https://iplogger.org/2BAmf7
https://iplogger.org/2BDmf7
https://iplogger.org/2BFmf7
https://iplogger.org/2s2pg6
https://iplogger.org/2s3pg6
https://iplogger.org/2s4pg6
https://iplogger.org/2s5pg6
https://iplogger.org/2s6pg6
https://iplogger.org/2s7pg6
Strings (821)Snowman+under_a_sn0wdrift_forgot_the_Snow_Maiden
iplogger.org/1nhuM4.js
SOFTWARE\LilFreske
Installed
SOFTWARE\LilFreskeUS
IsWow64Process
GetModuleHandleA
LoadLibraryA
SetPriorityClass
Sleep
GetTempPathA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
CreateThread
CloseHandle
VirtualAlloc
VirtualFree
OpenProcess
TerminateProcess
GetUserGeoID
ntdll.dll
NtQuerySystemInformation
RtlGetVersion
Shell32.dll
ShellExecuteA
SHGetFolderPathA
Advapi32.dll
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
ConvertSidToStringSidA
LookupAccountNameA
WINHTTP.dll
wininet.dll
GetComputerNameA
VerSetConditionMask
VerifyVersionInfoW
GetGeoInfoA
GetCurrentProcess
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
User32.dll
CharToOemA
//Minor Policy
SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions
Exclusions_Extensions
SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions
SOFTWARE\Policies\Microsoft\Windows Defender
DisableAntiSpyware
DisableRoutinelyTakingAction
SOFTWARE\Policies\Microsoft\Windows\System
EnableSmartScreen
SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring
DisableOnAccessProtection
DisableScanOnRealtimeEnable
DisableRealtimeMonitoring
DisableIOAVProtection
DisableRawWriteNotification
Windows Server 2016
Windows Server 2012 R2
Windows Server 2012
Windows Server 2008 R2
Windows Server 2008
Windows Server
Windows 10
Windows 8.1
Windows 8
Windows 7
Windows Vista
Windows XP
(x64)
(x32)
explorer.exe
current
children
SOFTWARE\Classes\ms-settings\Shell\Open\command
DelegateExecute
\ComputerDefaults.exe
SOFTWARE\Classes
ms-settings\Shell\Open\command
ms-settings\Shell\Open
ms-settings\Shell
ms-settings
data=
/api/firegate.php
Error!
onlyType
ext_url
cfg_url
ipinfo.io/widget
country
company
Google LLC
db-ip.com
data-api-key="
/self
countryCode
organization
www.maxmind.com/geoip/v2.1/city/me
iso_code
traits
GetIP
api.ipgeolocation.io/ipgeo?include=hostname&ip=
country_code2
/api/tracemap.php
http://
15.5pnp.10.lock
Guest Profile
System Profile
\Google\Chrome\Application
(x86)\Google\Chrome\Application
SOFTWARE\Google\Chrome\BLBeacon
version
\resources.pak
SOFTWARE\Google\Chrome\PreferenceMACs
\Google\Chrome\User Data\
\Secure Preferences
filter_browsers
chrome
browser
use_open_browser
extensions
settings
install_time
\Extensions\
\u003C
protection
extensions.settings.
super_mac
chrome.exe
ChromeRegistryHashStoreValidationSeed
\extensions.settings
SOFTWARE\Google\Chrome\PreferenceMACs\
\chrome.exe
\Microsoft\Edge\Application
(x86)\Microsoft\Edge\Application
SOFTWARE\Microsoft\Edge\BLBeacon
SOFTWARE\Microsoft\Edge\PreferenceMACs
\Microsoft\Edge\User Data\
msedge.exe
SOFTWARE\Microsoft\Edge\PreferenceMACs\
\msedge.exe
\Roaming
\atomic
\Atomic Wallet
\com.liberty.jaxx
\Electrum
\Exodus
\MultiDoge
\Monero
\binance.chain
\Binance
\Metamask
\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh
\Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn
\Local Extension Settings\aodkkagnadcbobfpggfnjeongemjbjca
\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
\Local Extension Settings\fmblappgoiilbgafhjklehhfifbdocee
\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf
\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
sorare.com
yobit.net
zb.com
binance.com
huobi.com
okex.com
hitbtc.com
bitfinex.com
kraken.com
bitstamp.net
payoneer.com
bittrex.com
bittrex.zendesk.com
gate.io
exmo.com
yobit.io
bitflyer.com
poloniex.com
kucoin.com
coinone.co.kr
localbitcoins.com
korbit.co.kr
cex.io
luno.com
bitkonan.com
jubi.com
koinex.in
koineks.com
kuna.io
koinim.com
kiwi-coin.com
leoxchange.com
lykke.com
localtrade.cc
magnr.com
lbank.info
itbit.com
gemini.com
gdax.com
gatehub.net
satoshitango.com
foxbit.com.br
flowbtc.com.br
exx.com
exrates.me
excambriorex.com
ezbtc.ca
infinitycoin.exchange
tdax.com
stex.com
vbtc.exchange
coinmarketcap.com
vwlpro.com
nocks.com
nlexch.com
novaexchange.com
mynxt.info
nzbcx.com
nevbit.com
mixcoins.com
mr.exchange
neraex.pro
dsx.uk
okcoin.com
liquid.com
quoine.com
quadrigacx.com
rightbtc.com
rippex.net
ripplefox.com
qryptos.com
ore.bz
openledger.info
omnidex.io
paribu.com
paymium.com
dcexchange.ru
dcexe.com
bitmex.com
funpay.ru
bitmaszyna.pl
bitonic.nl
bitpanda.com
bitsblockchain.net
bitmarket.net
bitlish.com
bitfex.trade
blockchain.com
blockchain.info
cryptofresh.com
btcmarkets.net
braziliex.com
btc-trade.com.ua
btc-alpha.com
bitspark.io
bitso.com
bittylicious.com
altcointrader.co.za
arenabitcoin.com
allcoin.com
796.com
abucoins.com
aidosmarket.com
bitcointrade.com
bitcointoyou.com
bitbanktrade.jp
big.one
bcex.ca
bitconnect.co
coinsbank.com
coinsecure.in
coinsquare.com
coinspot.io
coinsmarkets.com
crypto-bridge.org
dcex.com
dabtc.com
decentrex.com
deribit.com
dgtmarket.com
btcturk.com
btcxindia.com
bt.cx
bitstarcoin.com
coincheck.com
coinmate.io
coingi.com
coinnest.co.kr
coinrail.co.kr
coinpit.io
coingather.com
coinfloor.co.uk
coinegg.com
coincorner.com
coinexchange.io
pancakeswap.finance
coinbase.com
livecoin.net
mercatox.com
cryptobridge.freshdesk.com
volabit.com
tradeogre.com
bitkub.com
uphold.com
wallet.uphold.com
login.blockchain.com
tidex.com
coinome.com
coinpayments.net
bitmax.io
bitbank.cc
independentreserve.com
bitmart.com
cryptopia.co.nz
cryptonator.com
advcash.com
my.dogechain.info
spectrocoin.com
exir.io
exir.tech
coinbene.com
bitforex.com
gopax.co.kr
catex.io
vindax.com
coineal.com
maicoin.com
finexbox.com
etherflyer.com
bx.in.th
bitopro.com
citex.co.kr
coinzo.com
atomars.com
coinfinit.com
bitker.com
dobitrade.com
btcexa.com
satowallet.com
cpdax.com
trade.io
btcnext.io
exmarkets.com
btc-exchange.com
chaoex.com
jex.com
therocktrading.com
gdac.com
southxchange.com
tokens.net
fexpro.net
btcbox.co.jp
coinmex.com
cryptology.com
cointiger.com
cashierest.com
coinbit.co.kr
mxc.com
bilaxy.com
coinall.com
coindeal.com
omgfin.com
oceanex.pro
bithumb.com
ftx.com
shortex.net
coin.z.com
fcoin.com
fatbtc.com
tokenize.exchange
simex.global
instantbitex.com
\Login Data
SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
\BraveSoftware\Brave-Browser\User Data\
SOFTWARE\CryptoTab Browser\PreferenceMACs
\CryptoTab Browser\User Data\
\Opera Software\Opera Stable
ascendex.com
crypto.com
coins.ph
coins.th
dogechain.info
miningpoolhub.com
/vpn/index.html
portal/webclient
remote/login
/vpn/tmindex.html
/LogonPoint/tmindex.html
XenApp1/auth/login.aspx
auth/silentDetection.aspx
/citrix/
/RDWeb/
/+CSCOE+/
/global-protect/
sslvpn.
/dana-na/
/my.policy
ncsecu.org
penfed.org
becu.org
schoolsfirstfcu.org
firsttechfed.com
golden1.com
alliantcreditunion.org
americafirst.com
suncoastcreditunion.com
secumd.org
safecu.org
missionfed.com
greendot.com
rbfcu.org
macu.com
dcu.org
ssfcu.org
bethpagefcu.com
starone.org
alaskausa.org
sdccu.com
aacreditunion.org
lmcu.org
teachersfcu.org
patelco.org
esl.org
onpointcu.com
logixbanking.com
psecu.com
deltacommunitycu.com
ent.com
cefcu.com
greenstate.org
unfcu.org
pffcu.org
wingsfinancial.com
iccu.comdesertfinancial.com
iccu.com
desertfinancial.com
hvfcu.org
wpcu.coop
redwoodcu.org
tcunet.com
wsecu.org
joviafinancial.com
coastal24.com
myeecu.org
gecreditunion.org
nymcu.org
affinityfcu.com
towerfcu.org
ccu.com
communityamerica.com
langleyfcu.org
credithuman.com
techcu.com
gecu.com
kfcu.org
applefcu.org
nasafcu.com
sfcu.org
genisyscu.org
unifyfcu.com
apcocu.org
firstcommunity.com
unitedfcu.com
fairwinds.org
ufcu.org
wescom.org
bcu.org
vacu.org
citadelbanking.com
servicecu.org
summitcreditunion.com
gesa.com
chevronfcu.org
traviscu.org
uwcu.org
communityfirstcu.org
ecu.org
sccu.com
bfsfcu.org
bellco.org
dfcufinancial.com
msufcu.org
members1st.org
landmarkcu.com
kinecta.org
midflorida.com
visionsfcu.org
veridiancu.org
statefarmfcu.com
tinkerfcu.org
sefcu.com
americanheritagecu.org
robinsfcu.org
canvas.org
growfinancial.org
truliantfcu.org
ascend.org
foundersfcu.com
calcoastcu.org
ucu.org
connexuscu.org
slfcu.org
numericacu.com
eecu.org
georgiasown.org
nusenda.org
tvacreditunion.com
pcu.org
msgcu.org
nuvisionfederal.com
trumarkonline.org
navigantcu.org
ornlfcu.com
jscfcu.org
lgfcu.org
elevationscu.com
gtefinancial.org
chartway.com
ecu.com
sdfcu.org
apcu.com
schools.org
metrocu.org
campuscu.com
adviacu.org
psfcu.com
andrewsfcu.org
eglinfcu.org
imcu.com
americaneagle.org
ttcu.com
vantagewest.org
empowerfcu.com
rfcu.com
capcomfcu.org
arizonafederal.org
csecreditunion.com
communityfirstfl.org
bayportcu.org
gwcu.org
wecu.com
stgeorge.com.au
imb.com.au
ing.com.au
bankofmelbourne.com.au
regionalaustraliabank.com
suncorp.com.au
regionalaustraliabank.com.au
bmo.com
cwbank.com
royalbank.com
vancity.com
servus.ca
coastcapitalsavings.com
alterna.ca
interiorsavings.com
synergycu.ca
mainstreetcu.ca
cu.com
fcu.com
robinhood.com
navyfederal.org
tboholidays.com
24x7rooms.com
adonis.com
abreuonline.com
almundo.com.ar
bonotel.com
bookohotel.com
didatravel.com
dotwconnect.com
eetglobal.com
escalabeds.com
fastpayhotels.com
getaroom.com
goglobal.travel
hoteldo.com.mx
hotelspro.com
jumbonline.com
kaluahtours.com
lci-euro.com
lotsofhotels.com
mikinet.co.uk
misterroom.com
nexustours.com
olympiaeurope.com
paximum.com
restel.es
rezserver.com
rezlive.com
sunhotels.com
totalstay.com
travco.co.uk
travellanda.com
smyrooms.com
welcomebeds.com
yalago.com
hotelbeds.com
mercadolibre.com.mx
hsbc.com.mx
bbvanetcash.mx
scotiabank.com.mx
santander.com.mx
bbva.mx
opensea.io
plantvsundead.com
axieinfinity.com
cryptocars.me
bombcrypto.io
cryptoplanes.me
cryptozoon.io
bankalhabib.com
correosprepago.es
orangebank.es
amazon.it
amazon.ca
amazon.de
amazon.com
netspend.com
online.citi.com
cloud.ibm.com
ca.ovh.com
account.alibabacloud.com
cloud.huawei.com
cloud.tencent.com
vultr.com
aws.amazon.com
portal.azure.com
digitalocean.com
console.scaleway.com
hetzner.com
linode.com
oracle.com
rackspace.com
phoenixnap.com
leaseweb.com
sso.ctl.io
ctl.io
lumen.com
paypal.com
WW_P_7
WW_P_8
https://
WW_P_
WW_P_1
links
ezstat.ru/1BfPg7
USA_1
iplis.ru/1BX4j7.png
iplis.ru/1BV4j7.mp4
USA_2
iplogger.org/1nkuM4.jpeg
iplis.ru/1BNhx7.mp3
iplis.ru/1pRXr7.txt
SetIncrement|ww_starts
false
iplis.ru/1S2Qs7.mp3
iplis.ru/1S3fd7.mp3
iplis.ru/17VHv7.mp3
iplis.ru/1GLDc7.mp3
iplis.ru/1xDsk7.mp3
iplis.ru/1xFsk7.mp3
WW_OPERA
iplis.ru/1GCuv7.pdf
iplis.ru/1lmex.mp3
iplis.ru/1Gemv7.mp3
WW_10
iplis.ru/1Gymv7.mp3
WW_11
iplis.ru/1tqHh7.mp3
WW_12
iplis.ru/1aFYp7.mp3
WW_13
iplis.ru/1cC8u7.mp3
WW_14
iplis.ru/1cN8u7.mp3
WW_15
iplis.ru/1kicy7.mp3
iplis.ru/1BMhx7.mp3
WW_16
iplis.ru/1edLy7.png
WW_17
iplis.ru/1nGPt7.png
WW_P_2
iplis.ru/1Bshv7.mp3
WW_P_3
iplis.ru/1Lgnh7.mp3
WW_P_4
iplis.ru/1vt8c7.mp3
WW_P_5
iplis.ru/1IcfD.mp3
WW_P_6
iplis.ru/1eXqs7.mp3
iplis.ru/1Unzy7.mp3
WW_18
iplis.ru/12hYs7.mp3
WW_19
iplis.ru/12d8d7.mp3
WW_20
iplis.ru/1Uvgu7.mp3
WW_21
iplis.ru/1jvTz7.mp3
browsers
Chrome:
Edge:
os_country_code
ip_country
AddExtensionStat|
net_country_code
https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
https://vk.com/doc746114504_647280734?hash=Doz4iot4bg0WOvZC8ZMInERV5U1fmjrKZZhl7jf6wBE&dl=G42DMMJRGQ2TANA:1661413506:vGfIf9YivGqE9gd11wvm9KZLzv9DMwdM9Wp0LmcsAhz&api=1&no_preview=1
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://91.241.19.125/pub.php?pub=one
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
http://mnbuiy.pw/adsli/note8876.exe
http://sarfoods.com/index.php
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
https://iplogger.org/2BTmf7
https://iplogger.org/2BAmf7
https://iplogger.org/2BDmf7
https://iplogger.org/2BFmf7
https://iplogger.org/2s2pg6
https://iplogger.org/2s3pg6
https://iplogger.org/2s4pg6
https://iplogger.org/2s5pg6
https://iplogger.org/2s6pg6
https://iplogger.org/2s7pg6
crypto_wallets
domain
bank_wallets
cu_bank_wallets
shop_wallets
bank_au_wallets
amazon_eu
webhosts
paypal
bank_ca_wallets
browser_vbmt
GetCryptoSleeping
149.154.158.34
94.142.138.113
94.142.138.131
208.67.104.60
cryptoWallets
status
bankWallets
cuBankWallets
shops
bankAUWallets
bankCAWallets
cryptoWallets_part1
cryptoWallets_part2
bankWallets_part1
bankWallets_part2
bankMXWallets
cryptoGames
bankPKWallets
bankESWallets
SetLoaderAnalyze|
SetIncrement|not_elevated
WinHttpConnect
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpSetTimeouts
InternetOpenA
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenUrlA
HttpQueryInfoA
InternetQueryOptionA
HttpSendRequestA
InternetReadFile
InternetCloseHandle
(PID) Process(3936) UyXyFj8BzRYAWuLz2_yZxCty.exe
C2 (6)http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
149.154.158.34
94.142.138.113
94.142.138.131
208.67.104.60
Attributes
Payload (36)https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
https://vk.com/doc746114504_647280734?hash=Doz4iot4bg0WOvZC8ZMInERV5U1fmjrKZZhl7jf6wBE&dl=G42DMMJRGQ2TANA:1661413506:vGfIf9YivGqE9gd11wvm9KZLzv9DMwdM9Wp0LmcsAhz&api=1&no_preview=1
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
http://mnbuiy.pw/adsli/note8876.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
https://iplogger.org/2BTmf7
https://iplogger.org/2BAmf7
https://iplogger.org/2BDmf7
https://iplogger.org/2BFmf7
https://iplogger.org/2s2pg6
https://iplogger.org/2s3pg6
https://iplogger.org/2s4pg6
https://iplogger.org/2s5pg6
https://iplogger.org/2s6pg6
https://iplogger.org/2s7pg6
Strings (821)Snowman+under_a_sn0wdrift_forgot_the_Snow_Maiden
iplogger.org/1nhuM4.js
SOFTWARE\LilFreske
Installed
SOFTWARE\LilFreskeUS
IsWow64Process
GetModuleHandleA
LoadLibraryA
SetPriorityClass
Sleep
GetTempPathA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
CreateThread
CloseHandle
VirtualAlloc
VirtualFree
OpenProcess
TerminateProcess
GetUserGeoID
ntdll.dll
NtQuerySystemInformation
RtlGetVersion
Shell32.dll
ShellExecuteA
SHGetFolderPathA
Advapi32.dll
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
ConvertSidToStringSidA
LookupAccountNameA
WINHTTP.dll
wininet.dll
GetComputerNameA
VerSetConditionMask
VerifyVersionInfoW
GetGeoInfoA
GetCurrentProcess
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
User32.dll
CharToOemA
//Minor Policy
SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions
Exclusions_Extensions
SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions
SOFTWARE\Policies\Microsoft\Windows Defender
DisableAntiSpyware
DisableRoutinelyTakingAction
SOFTWARE\Policies\Microsoft\Windows\System
EnableSmartScreen
SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
DisableBehaviorMonitoring
DisableOnAccessProtection
DisableScanOnRealtimeEnable
DisableRealtimeMonitoring
DisableIOAVProtection
DisableRawWriteNotification
Windows Server 2016
Windows Server 2012 R2
Windows Server 2012
Windows Server 2008 R2
Windows Server 2008
Windows Server
Windows 10
Windows 8.1
Windows 8
Windows 7
Windows Vista
Windows XP
(x64)
(x32)
explorer.exe
current
children
SOFTWARE\Classes\ms-settings\Shell\Open\command
DelegateExecute
\ComputerDefaults.exe
SOFTWARE\Classes
ms-settings\Shell\Open\command
ms-settings\Shell\Open
ms-settings\Shell
ms-settings
data=
/api/firegate.php
Error!
onlyType
ext_url
cfg_url
ipinfo.io/widget
country
company
Google LLC
db-ip.com
data-api-key="
/self
countryCode
organization
www.maxmind.com/geoip/v2.1/city/me
iso_code
traits
GetIP
api.ipgeolocation.io/ipgeo?include=hostname&ip=
country_code2
/api/tracemap.php
http://
15.5pnp.10.lock
Guest Profile
System Profile
\Google\Chrome\Application
(x86)\Google\Chrome\Application
SOFTWARE\Google\Chrome\BLBeacon
version
\resources.pak
SOFTWARE\Google\Chrome\PreferenceMACs
\Google\Chrome\User Data\
\Secure Preferences
filter_browsers
chrome
browser
use_open_browser
extensions
settings
install_time
\Extensions\
\u003C
protection
extensions.settings.
super_mac
chrome.exe
ChromeRegistryHashStoreValidationSeed
\extensions.settings
SOFTWARE\Google\Chrome\PreferenceMACs\
\chrome.exe
\Microsoft\Edge\Application
(x86)\Microsoft\Edge\Application
SOFTWARE\Microsoft\Edge\BLBeacon
SOFTWARE\Microsoft\Edge\PreferenceMACs
\Microsoft\Edge\User Data\
msedge.exe
SOFTWARE\Microsoft\Edge\PreferenceMACs\
\msedge.exe
\Roaming
\atomic
\Atomic Wallet
\com.liberty.jaxx
\Electrum
\Exodus
\MultiDoge
\Monero
\binance.chain
\Binance
\Metamask
\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh
\Local Extension Settings\mgffkfbidihjpoaomajlbgchddlicgpn
\Local Extension Settings\aodkkagnadcbobfpggfnjeongemjbjca
\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
\Local Extension Settings\fmblappgoiilbgafhjklehhfifbdocee
\Local Extension Settings\hmeobnfnfcmdkdcmlblgagmfpfboieaf
\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
sorare.com
yobit.net
zb.com
binance.com
huobi.com
okex.com
hitbtc.com
bitfinex.com
kraken.com
bitstamp.net
payoneer.com
bittrex.com
bittrex.zendesk.com
gate.io
exmo.com
yobit.io
bitflyer.com
poloniex.com
kucoin.com
coinone.co.kr
localbitcoins.com
korbit.co.kr
cex.io
luno.com
bitkonan.com
jubi.com
koinex.in
koineks.com
kuna.io
koinim.com
kiwi-coin.com
leoxchange.com
lykke.com
localtrade.cc
magnr.com
lbank.info
itbit.com
gemini.com
gdax.com
gatehub.net
satoshitango.com
foxbit.com.br
flowbtc.com.br
exx.com
exrates.me
excambriorex.com
ezbtc.ca
infinitycoin.exchange
tdax.com
stex.com
vbtc.exchange
coinmarketcap.com
vwlpro.com
nocks.com
nlexch.com
novaexchange.com
mynxt.info
nzbcx.com
nevbit.com
mixcoins.com
mr.exchange
neraex.pro
dsx.uk
okcoin.com
liquid.com
quoine.com
quadrigacx.com
rightbtc.com
rippex.net
ripplefox.com
qryptos.com
ore.bz
openledger.info
omnidex.io
paribu.com
paymium.com
dcexchange.ru
dcexe.com
bitmex.com
funpay.ru
bitmaszyna.pl
bitonic.nl
bitpanda.com
bitsblockchain.net
bitmarket.net
bitlish.com
bitfex.trade
blockchain.com
blockchain.info
cryptofresh.com
btcmarkets.net
braziliex.com
btc-trade.com.ua
btc-alpha.com
bitspark.io
bitso.com
bittylicious.com
altcointrader.co.za
arenabitcoin.com
allcoin.com
796.com
abucoins.com
aidosmarket.com
bitcointrade.com
bitcointoyou.com
bitbanktrade.jp
big.one
bcex.ca
bitconnect.co
coinsbank.com
coinsecure.in
coinsquare.com
coinspot.io
coinsmarkets.com
crypto-bridge.org
dcex.com
dabtc.com
decentrex.com
deribit.com
dgtmarket.com
btcturk.com
btcxindia.com
bt.cx
bitstarcoin.com
coincheck.com
coinmate.io
coingi.com
coinnest.co.kr
coinrail.co.kr
coinpit.io
coingather.com
coinfloor.co.uk
coinegg.com
coincorner.com
coinexchange.io
pancakeswap.finance
coinbase.com
livecoin.net
mercatox.com
cryptobridge.freshdesk.com
volabit.com
tradeogre.com
bitkub.com
uphold.com
wallet.uphold.com
login.blockchain.com
tidex.com
coinome.com
coinpayments.net
bitmax.io
bitbank.cc
independentreserve.com
bitmart.com
cryptopia.co.nz
cryptonator.com
advcash.com
my.dogechain.info
spectrocoin.com
exir.io
exir.tech
coinbene.com
bitforex.com
gopax.co.kr
catex.io
vindax.com
coineal.com
maicoin.com
finexbox.com
etherflyer.com
bx.in.th
bitopro.com
citex.co.kr
coinzo.com
atomars.com
coinfinit.com
bitker.com
dobitrade.com
btcexa.com
satowallet.com
cpdax.com
trade.io
btcnext.io
exmarkets.com
btc-exchange.com
chaoex.com
jex.com
therocktrading.com
gdac.com
southxchange.com
tokens.net
fexpro.net
btcbox.co.jp
coinmex.com
cryptology.com
cointiger.com
cashierest.com
coinbit.co.kr
mxc.com
bilaxy.com
coinall.com
coindeal.com
omgfin.com
oceanex.pro
bithumb.com
ftx.com
shortex.net
coin.z.com
fcoin.com
fatbtc.com
tokenize.exchange
simex.global
instantbitex.com
\Login Data
SOFTWARE\BraveSoftware\Brave-Browser\PreferenceMACs
\BraveSoftware\Brave-Browser\User Data\
SOFTWARE\CryptoTab Browser\PreferenceMACs
\CryptoTab Browser\User Data\
\Opera Software\Opera Stable
ascendex.com
crypto.com
coins.ph
coins.th
dogechain.info
miningpoolhub.com
/vpn/index.html
portal/webclient
remote/login
/vpn/tmindex.html
/LogonPoint/tmindex.html
XenApp1/auth/login.aspx
auth/silentDetection.aspx
/citrix/
/RDWeb/
/+CSCOE+/
/global-protect/
sslvpn.
/dana-na/
/my.policy
ncsecu.org
penfed.org
becu.org
schoolsfirstfcu.org
firsttechfed.com
golden1.com
alliantcreditunion.org
americafirst.com
suncoastcreditunion.com
secumd.org
safecu.org
missionfed.com
greendot.com
rbfcu.org
macu.com
dcu.org
ssfcu.org
bethpagefcu.com
starone.org
alaskausa.org
sdccu.com
aacreditunion.org
lmcu.org
teachersfcu.org
patelco.org
esl.org
onpointcu.com
logixbanking.com
psecu.com
deltacommunitycu.com
ent.com
cefcu.com
greenstate.org
unfcu.org
pffcu.org
wingsfinancial.com
iccu.comdesertfinancial.com
iccu.com
desertfinancial.com
hvfcu.org
wpcu.coop
redwoodcu.org
tcunet.com
wsecu.org
joviafinancial.com
coastal24.com
myeecu.org
gecreditunion.org
nymcu.org
affinityfcu.com
towerfcu.org
ccu.com
communityamerica.com
langleyfcu.org
credithuman.com
techcu.com
gecu.com
kfcu.org
applefcu.org
nasafcu.com
sfcu.org
genisyscu.org
unifyfcu.com
apcocu.org
firstcommunity.com
unitedfcu.com
fairwinds.org
ufcu.org
wescom.org
bcu.org
vacu.org
citadelbanking.com
servicecu.org
summitcreditunion.com
gesa.com
chevronfcu.org
traviscu.org
uwcu.org
communityfirstcu.org
ecu.org
sccu.com
bfsfcu.org
bellco.org
dfcufinancial.com
msufcu.org
members1st.org
landmarkcu.com
kinecta.org
midflorida.com
visionsfcu.org
veridiancu.org
statefarmfcu.com
tinkerfcu.org
sefcu.com
americanheritagecu.org
robinsfcu.org
canvas.org
growfinancial.org
truliantfcu.org
ascend.org
foundersfcu.com
calcoastcu.org
ucu.org
connexuscu.org
slfcu.org
numericacu.com
eecu.org
georgiasown.org
nusenda.org
tvacreditunion.com
pcu.org
msgcu.org
nuvisionfederal.com
trumarkonline.org
navigantcu.org
ornlfcu.com
jscfcu.org
lgfcu.org
elevationscu.com
gtefinancial.org
chartway.com
ecu.com
sdfcu.org
apcu.com
schools.org
metrocu.org
campuscu.com
adviacu.org
psfcu.com
andrewsfcu.org
eglinfcu.org
imcu.com
americaneagle.org
ttcu.com
vantagewest.org
empowerfcu.com
rfcu.com
capcomfcu.org
arizonafederal.org
csecreditunion.com
communityfirstfl.org
bayportcu.org
gwcu.org
wecu.com
stgeorge.com.au
imb.com.au
ing.com.au
bankofmelbourne.com.au
regionalaustraliabank.com
suncorp.com.au
regionalaustraliabank.com.au
bmo.com
cwbank.com
royalbank.com
vancity.com
servus.ca
coastcapitalsavings.com
alterna.ca
interiorsavings.com
synergycu.ca
mainstreetcu.ca
cu.com
fcu.com
robinhood.com
navyfederal.org
tboholidays.com
24x7rooms.com
adonis.com
abreuonline.com
almundo.com.ar
bonotel.com
bookohotel.com
didatravel.com
dotwconnect.com
eetglobal.com
escalabeds.com
fastpayhotels.com
getaroom.com
goglobal.travel
hoteldo.com.mx
hotelspro.com
jumbonline.com
kaluahtours.com
lci-euro.com
lotsofhotels.com
mikinet.co.uk
misterroom.com
nexustours.com
olympiaeurope.com
paximum.com
restel.es
rezserver.com
rezlive.com
sunhotels.com
totalstay.com
travco.co.uk
travellanda.com
smyrooms.com
welcomebeds.com
yalago.com
hotelbeds.com
mercadolibre.com.mx
hsbc.com.mx
bbvanetcash.mx
scotiabank.com.mx
santander.com.mx
bbva.mx
opensea.io
plantvsundead.com
axieinfinity.com
cryptocars.me
bombcrypto.io
cryptoplanes.me
cryptozoon.io
bankalhabib.com
correosprepago.es
orangebank.es
amazon.it
amazon.ca
amazon.de
amazon.com
netspend.com
online.citi.com
cloud.ibm.com
ca.ovh.com
account.alibabacloud.com
cloud.huawei.com
cloud.tencent.com
vultr.com
aws.amazon.com
portal.azure.com
digitalocean.com
console.scaleway.com
hetzner.com
linode.com
oracle.com
rackspace.com
phoenixnap.com
leaseweb.com
sso.ctl.io
ctl.io
lumen.com
paypal.com
WW_P_7
WW_P_8
https://
WW_P_
WW_P_1
links
ezstat.ru/1BfPg7
USA_1
iplis.ru/1BX4j7.png
iplis.ru/1BV4j7.mp4
USA_2
iplogger.org/1nkuM4.jpeg
iplis.ru/1BNhx7.mp3
iplis.ru/1pRXr7.txt
SetIncrement|ww_starts
false
iplis.ru/1S2Qs7.mp3
iplis.ru/1S3fd7.mp3
iplis.ru/17VHv7.mp3
iplis.ru/1GLDc7.mp3
iplis.ru/1xDsk7.mp3
iplis.ru/1xFsk7.mp3
WW_OPERA
iplis.ru/1GCuv7.pdf
iplis.ru/1lmex.mp3
iplis.ru/1Gemv7.mp3
WW_10
iplis.ru/1Gymv7.mp3
WW_11
iplis.ru/1tqHh7.mp3
WW_12
iplis.ru/1aFYp7.mp3
WW_13
iplis.ru/1cC8u7.mp3
WW_14
iplis.ru/1cN8u7.mp3
WW_15
iplis.ru/1kicy7.mp3
iplis.ru/1BMhx7.mp3
WW_16
iplis.ru/1edLy7.png
WW_17
iplis.ru/1nGPt7.png
WW_P_2
iplis.ru/1Bshv7.mp3
WW_P_3
iplis.ru/1Lgnh7.mp3
WW_P_4
iplis.ru/1vt8c7.mp3
WW_P_5
iplis.ru/1IcfD.mp3
WW_P_6
iplis.ru/1eXqs7.mp3
iplis.ru/1Unzy7.mp3
WW_18
iplis.ru/12hYs7.mp3
WW_19
iplis.ru/12d8d7.mp3
WW_20
iplis.ru/1Uvgu7.mp3
WW_21
iplis.ru/1jvTz7.mp3
browsers
Chrome:
Edge:
os_country_code
ip_country
AddExtensionStat|
net_country_code
https://vk.com/doc746114504_647280747?hash=cvDFKP5q0CQEjBCbeoeHvPNrWE0xbMxZEmrkIeNKcET&dl=G42DMMJRGQ2TANA:1661413520:uZNj68vRUvQaydRD8wpAK8zluN0I7otw5AHbA1ZlN9T&api=1&no_preview=1
https://vk.com/doc746114504_647280734?hash=Doz4iot4bg0WOvZC8ZMInERV5U1fmjrKZZhl7jf6wBE&dl=G42DMMJRGQ2TANA:1661413506:vGfIf9YivGqE9gd11wvm9KZLzv9DMwdM9Wp0LmcsAhz&api=1&no_preview=1
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://91.241.19.125/pub.php?pub=one
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
http://mnbuiy.pw/adsli/note8876.exe
http://sarfoods.com/index.php
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
https://iplogger.org/2BTmf7
https://iplogger.org/2BAmf7
https://iplogger.org/2BDmf7
https://iplogger.org/2BFmf7
https://iplogger.org/2s2pg6
https://iplogger.org/2s3pg6
https://iplogger.org/2s4pg6
https://iplogger.org/2s5pg6
https://iplogger.org/2s6pg6
https://iplogger.org/2s7pg6
crypto_wallets
domain
bank_wallets
cu_bank_wallets
shop_wallets
bank_au_wallets
amazon_eu
webhosts
paypal
bank_ca_wallets
browser_vbmt
GetCryptoSleeping
149.154.158.34
94.142.138.113
94.142.138.131
208.67.104.60
cryptoWallets
status
bankWallets
cuBankWallets
shops
bankAUWallets
bankCAWallets
cryptoWallets_part1
cryptoWallets_part2
bankWallets_part1
bankWallets_part2
bankMXWallets
cryptoGames
bankPKWallets
bankESWallets
SetLoaderAnalyze|
SetIncrement|not_elevated
WinHttpConnect
WinHttpQueryHeaders
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpReadData
WinHttpCloseHandle
WinHttpSetTimeouts
InternetOpenA
InternetSetOptionA
HttpOpenRequestA
InternetConnectA
InternetOpenUrlA
HttpQueryInfoA
InternetQueryOptionA
HttpSendRequestA
InternetReadFile
InternetCloseHandle

RedLine

(PID) Process(2204) TV58WTC0zcbhmffbh6DL_vTe.exe
C2 (1)185.11.61.125:22344
Botnet@chicago
Err_msgError
Auth_value21f863e0cbd09d0681058e068d0d1d7f
US (175)
Search
Reflection
Ammo
Function
Info
Roaming
UNKNOWN
cFileStreamredFileStreamit_cFileStreamardFileStreams
FileStream
\
ToString
os_crypt
encrypted_key
Network\
Inner
Unknown
:
Read
Kill
Microsoft
GetDirectories
MSObject12
EnumerateDirectories
String.Replace
String.Remove
net.tcp://
/
localhost
21f863e0cbd09d0681058e068d0d1d7f
Authorization
ns1
BDoUQSUYIBwFBCoIJRggHQc6HAkkGChUBy9OTQ==
GCk9HwglKwwTXEtN
GzY5CQtBLFk=
Inspired
MSValue3
EnumerateFiles
ExpandEnvironmentVariables
MSValue2
MSValue1
FullName
Replace
Directory
wa
l
et
d
a
t
.
*wallet*
_
T
e
gr
am
ex
\TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata
Environment
\Discord\Local Storage\leveldb
*.loSystem.Collections.Genericg
System.Collections.Generic
1
String
MyG
string.Replace
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl
serviceInterface.Extension
ProldCharotonVoldCharPN
oldChar
nSystem.CollectionspvoSystem.Collections*
System.Collections
EngSubs
Microsoft\Windоws
-
AddRange
%
(
UNIQUE
"
FileStream.IO
string.Empty
uint
UnmanagedType
hKey
pszProperty
Encoding
bMasterKey
{0}
|
https://api.ip.sb/ip
80
81
0.0.0.0
SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor
System.Windows.Forms
roSystem.Linqot\CISystem.LinqMV2
System.Linq
SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller
AdapterRAM
Name
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente
System.Management
SerialNumber
SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId='
System.Text.RegularExpressions
'
FileSystem
SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId='
System.
ExecutablePath
[
]
Concat0 MConcatb oConcatr Concat0
Concat
SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem
Memory
{0}{1}{2}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
_[
System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
System.Security.Cryptography.AesCryptoServiceProvider
6†6b”‘2tl‡œkdbŒ•‘.†ql“vq’6koh8h‹lib
{11111-22222-10009-11111}
{11111-22222-50001-00000}
GetDelegateForFunctionPointer
m_ptr
System.Reflection.RuntimeModule
m_pData
q–”œ34Ž›6h’‘c6.dv˜dn7Ž4œt‰55w1j85
__
clrjit.dll
System.Reflection.ReflectionContext
file:///
Location
Find
ResourceA
Virtual
Alloc
Write
Process
Protect
Open
Process
Close
Handle
kernel
32.dll
{11111-22222-10001-00001}
{11111-22222-10001-00002}
{11111-22222-20001-00001}
{11111-22222-20001-00002}
{11111-22222-40001-00001}
{11111-22222-40001-00002}
{11111-22222-50001-00001}
{11111-22222-50001-00002}
(PID) Process(2952) NAcJuQJoInPC4o96TSeV64RA.exe
C2 (1)176.123.9.142:14845
Botnetlux2
Err_msg
Auth_valuea190ebf01162a5f4150c75b51cfe6687
US (151)
LEnvironmentogiEnvironmentn DatEnvironmenta
Environment
WSystem.Texteb DatSystem.Texta
System.Text
CoCryptographyokieCryptographys
Cryptography
ExtGenericension CooGenerickies
Generic
OFileInfopeFileInfora GFileInfoX StabFileInfole
FileInfo
OpLinqera GLinqX
Linq
ApGenericpDaGenericta\RGenericoamiGenericng\
Network
Extension
UNKNOWN
cFileStreamredFileStreamit_cFileStreamardFileStreams
FileStream
\
Host
Port
:
User
Pass
cookies.sqlite
GetDirectories
Entity12
EnumerateDirectories
String.Replace
String.Remove
bcrFileStream.IOypt.dFileStream.IOll
FileStream.IO
BCrstring.EmptyyptOpestring.EmptynAlgorithmProvistring.Emptyder
string.Empty
BCruintyptCloseAlgorituinthmProvuintider
uint
BCrUnmanagedTypeyptDecrUnmanagedTypeypt
UnmanagedType
BCrhKeyyptDeshKeytroyKhKeyey
hKey
BCpszPropertyryptGepszPropertytPropepszPropertyrty
pszProperty
BCEncodingryptSEncodingetPrEncodingoperEncodingty
Encoding
BCrbMasterKeyyptImbMasterKeyportKbMasterKeyey
bMasterKey
windows-1251
AES
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
-
{0}
net.tcp://
/
localhost
a190ebf01162a5f4150c75b51cfe6687
Authorization
ns1
CCwAXi0DKBAjHnFNLwYkWSADAR8LPARcLzhQVA==
JzA1WCwOUFQ=
Exclaiming
Yandex\YaAddon
asf
*wallet*
ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtu...
_
T
e
l
gr
am
.
ex
\TeEnvironmentlegraEnvironmentm DEnvironmentesktoEnvironmentp\tdEnvironmentata
1
string.Replace
%USERPFile.WriteROFILE%\AppFile.WriteData\RoamiFile.Writeng
File.Write
Handler
npvo*
%USERPserviceInterface.ExtensionROFILE%\ApserviceInterface.ExtensionpData\LocaserviceInterface.Extensionl
serviceInterface.Extension
ProldCharotonVoldCharPN
oldChar
nSystem.CollectionspvoSystem.Collections*
System.Collections
(
UNIQUE
"
Armenia
Azerbaijan
Belarus
Kazakhstan
Kyrgyzstan
Moldova
Tajikistan
Uzbekistan
Ukraine
Russia
|
https://api.ip.sb/ip
SELSystem.Windows.FormsECT * FRSystem.Windows.FormsOM WinSystem.Windows.Forms32_ProcSystem.Windows.Formsessor
System.Windows.Forms
roSystem.Linqot\CISystem.LinqMV2
System.Linq
SELSystem.LinqECT * FRSystem.LinqOM WinSystem.Linq32_VideoCoSystem.Linqntroller
AdapterRAM
Name
SOFTWARE\WOW6432Node\Clients\StartMenuInternet
SOFTWARE\Clients\StartMenuInternet
shell\open\command
Unknown Version
SELESystem.ManagementCT * FRSystem.ManagementOM WiSystem.Managementn32_DisSystem.ManagementkDrivSystem.Managemente
System.Management
SerialNumber
SELSystem.Text.RegularExpressionsECT * FRSystem.Text.RegularExpressionsOM Win32_PSystem.Text.RegularExpressionsrocess WSystem.Text.RegularExpressionshere SessSystem.Text.RegularExpressionsionId='
System.Text.RegularExpressions
'
FileSystem
SSystem.ELECT * FRSystem.OM WiSystem.n32_ProcSystem.ess WherSystem.e SessiSystem.onId='
System.
ExecutablePath
[
]
Concat0 MConcatb oConcatr Concat0
Concat
SELEMemoryCT * FMemoryROM WiMemoryn32_OperMemoryatingSMemoryystem
Memory
{0}{1}{2}
x32
x64
x86
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
CSDVersion
Unknown
_[
Network\
String
Replace
80
81
0.0.0.0

Amadey

(PID) Process(876) oneetx.exe
C2 (1)http://193.233.20.29
Version3.69
Options
Drop directory550693dc87
Drop nameoneetx.exe
Strings (116)SCHTASKS
/Create /SC MINUTE /MO 1 /TN
/TR "
" /F
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Startup
Rem
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
rundll32
/Delete /TN "
Programs
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
%USERPROFILE%
\App
POST
GET
id=
&vs=
&sd=
&os=
&bi=
&ar=
&pc=
&un=
&dm=
&av=
&lv=
&og=
cred.dll|clip.dll|
d1
e1
e0
Main
http://
https://
exe
dll
cmd
ps1
<c>
<d>
Plugins/
+++
#
|
&unit=
=
shell32.dll
kernel32.dll
GetNativeSystemInfo
ProgramData\
AVAST Software
Avira
Kaspersky Lab
ESET
Panda Security
Doctor Web
AVG
360TotalSecurity
Bitdefender
Norton
Sophos
Comodo
WinDefender
0123456789
rb
wb
Content-Type: multipart/form-data; boundary=----
------
Content-Disposition: form-data; name="data"; filename="
" Content-Type: application/octet-stream
------
--
?scr=1
.jpg
Content-Type: application/x-www-form-urlencoded
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
ComputerName
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
SYSTEM\ControlSet001\Services\BasicDisplay\Video
VideoID
\0000
DefaultSettings.XResolution
DefaultSettings.YResolution
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
2019
2022
2016
CurrentBuild
&&
echo Y|CACLS "
" /P "
:N"
CACLS "
" /P "
:R" /E
:F" /E
&&Exit
..\
\
:::
rundll32.exe
/k
"taskkill /f /im "
" && timeout 1 && del
&& Exit"
" && ren
&&
Powershell.exe
-executionpolicy remotesigned -File "
"

GCleaner

(PID) Process(3376) FRec43.exe
C2 (4)45.12.253.564
5.12.253.724
5.12.253.98
45.12.253.75
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

AssemblyVersion: 0.4.0.0
ProductVersion: 0.4.0+a88c671bde
ProductName: Ben Core
OriginalFileName: Ben.Demystifier.dll
LegalCopyright:
InternalName: Ben.Demystifier.dll
FileVersion: 0.4.0.2
FileDescription: Ben.Demystifier
CompanyName: Ben Adams
Comments: High performance understanding for stack traces (Make error logs more productive)
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Dynamic link library
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.4.0.0
FileVersionNumber: 0.4.0.2
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0xbfa184
UninitializedDataSize: -
InitializedDataSize: 1000448
CodeSize: 2111488
LinkerVersion: 14.29
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit, No debug
TimeStamp: 2023:03:08 06:23:52+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 08-Mar-2023 06:23:52
Detected languages:
  • English - United States
Comments: High performance understanding for stack traces (Make error logs more productive)
CompanyName: Ben Adams
FileDescription: Ben.Demystifier
FileVersion: 0.4.0.2
InternalName: Ben.Demystifier.dll
LegalCopyright: -
OriginalFilename: Ben.Demystifier.dll
ProductName: Ben Core
ProductVersion: 0.4.0+a88c671bde
Assembly Version: 0.4.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0040
Pages in file: 0x0001
Relocations: 0x0000
Size of header: 0x0002
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0xB400
OEM information: 0xCD09
Address of NE header: 0x00000040

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 08-Mar-2023 06:23:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_DEBUG_STRIPPED
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.MPRESS1
0x00001000
0x00BF9000
0x004BD600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.99996
.MPRESS2\x10\x0d
0x00BFA000
0x00000D10
0x00000E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.73927
.rsrc
0x00BFB000
0x000293CC
0x00029400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.49343

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.01389
3650
UNKNOWN
English - United States
RT_MANIFEST
2
4.74055
16936
UNKNOWN
UNKNOWN
RT_ICON
3
4.46008
67624
UNKNOWN
UNKNOWN
RT_ICON
4
7.99175
69499
UNKNOWN
UNKNOWN
RT_ICON
4083
0
444
UNKNOWN
UNKNOWN
RT_STRING
MAINICON
2.69613
62
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

ADVAPI32.dll
KERNEL32.DLL
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
434
Monitored processes
309
Malicious processes
54
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject drop and start drop and start drop and start drop and start drop and start drop and start #PRIVATELOADER install-trim.exe textinputhost.exe no specs tiworker.exe no specs mmc.exe no specs mmc.exe tgbnajo2ne2eyjodudx4yqpl.exe qfhmidb8bixqufdw5uwhnmns.exe oqbopyq89xhannwzlvsqbv5p.exe asfbx7xagynahszouwtefhar.exe r0zmjcbgq3gitcxilnxcz0zv.exe no specs #REDLINE tv58wtc0zcbhmffbh6dl_vte.exe is-vp8bj.tmp kina7449.exe kina2954.exe kina5082.exe bu899475.exe no specs enhyim3xyz0e3iddbgvy0gnm.exe #REDLINE nacjuqjoinpc4o96tsev64ra.exe 90dmhy_nliqw9crc48ch28eb.exe conhost.exe no specs frec43.exe no specs #REDLINE applaunch.exe #REDLINE 123.exe 321.exe werfault.exe no specs install.exe no specs config.exe forfiles.exe no specs conhost.exe no specs forfiles.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs werfault.exe no specs #PRIVATELOADER uyxyfj8bzryawulz2_yzxcty.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cor3860.exe no specs #PRIVATELOADER uyxyfj8bzryawulz2_yzxcty.exe schtasks.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs #REDLINE dbm02s42.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs #REDLINE en951568.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ge005441.exe #AMADEY oneetx.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs cacls.exe no specs cacls.exe no specs auqc_tyxdf2nxpjisvyxhuz4.exe no specs ywmu4ksaqst_ea2q7sfqikhm.exe no specs uervdzkghwpwnwafnby_ychs.exe is-jnr1c.tmp 6kfd86hi9wkij8vxsckolhzm.exe #REDLINE rdd8nmf3vjdcn1zpnv2o6wov.exe #GCLEANER frec43.exe install.exe #GLUPTEBA ywmu4ksaqst_ea2q7sfqikhm.exe install.exe forfiles.exe no specs conhost.exe no specs forfiles.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs #GLUPTEBA csrss.exe juzhkn.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs gx97262lyh.exe cmd.exe no specs conhost.exe no specs taskkill.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs wddjlez.exe xlblpca.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs oneetx.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs rundll32.exe no specs schtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs afcozsm.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs #SMOKE explorer.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs elabzgm.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs schtasks.exe no specs conhost.exe no specs oneetx.exe no specs oneetx.exe no specs oneetx.exe no specs oneetx.exe no specs schtasks.exe no specs conhost.exe no specs oneetx.exe no specs install-trim.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
8\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
8\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
72schtasks /CREATE /TN "JzxgGfMfFuIWhHHUc" /SC once /ST 03:19:52 /RU "SYSTEM" /TR "rundll32 \"C:\WINDOWS\Temp\ncBToFFnpyDffBTR\htxyXkYt\UADecpd.dll\",#1 /site_id 525403" /V1 /FC:\Windows\System32\schtasks.exe—AFcozsM.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
132"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --headless --lang=en-US --remote-debugging-port=58527 --allow-pre-commit-input --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3188 --field-trial-handle=1464,i,6408086746087991193,4447533293897361792,131072 --disable-features=PaintHolding /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.50
232\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
388"C:\WINDOWS\system32\mmc.exe" "C:\WINDOWS\system32\taskschd.msc" /sC:\Windows\System32\mmc.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Management Console
Exit code:
3221226540
Version:
10.0.19041.1 (WinBuild.160101.0800)
388schtasks /CREATE /TN "bSuQNXvsyZXdML" /F /xml "C:\Program Files\PKzgMTTBxaSU2\yIlRVgJ.xml" /RU "SYSTEM"C:\Windows\System32\schtasks.exe—ElaBZGM.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
392"C:\WINDOWS\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6C:\Windows\System32\reg.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
404"C:\Users\admin\Pictures\Minor Policy\OQbOPyQ89XHaNNwzLvsqBV5p.exe" C:\Users\admin\Pictures\Minor Policy\OQbOPyQ89XHaNNwzLvsqBV5p.exe
Install-trim.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.17763.1 (WinBuild.160101.0800)
404"C:\WINDOWS\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6C:\Windows\System32\reg.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
174
Suspicious files
387
Text files
752
Unknown types
160

Dropped files

PID
Process
Filename
Type
860Install-trim.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A65DBECD82A40019E873CE4ED0A79570binary
MD5:—
SHA256:—
860Install-trim.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\XEXI5KK1\6523[1].exeexecutable
MD5:—
SHA256:—
860Install-trim.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96Cbinary
MD5:—
SHA256:—
860Install-trim.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A65DBECD82A40019E873CE4ED0A79570der
MD5:—
SHA256:—
860Install-trim.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96Cder
MD5:—
SHA256:—
860Install-trim.exeC:\WINDOWS\System32\GroupPolicy\gpt.initext
MD5:07EBC46A53113102243503E4ADD798EA
SHA256:0098D36711324F783FBEAE36010E4F00DD5B772BF7C1A70EEAFDE1933EFEFEBF
860Install-trim.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\XEXI5KK1\Service[1].vmpexecutable
MD5:021DB70D51C7EB264D8E3D201987DE59
SHA256:6858AF2688D2E14AF2F506E8A268045E38A9EE1A69759DED34C506C112910958
860Install-trim.exeC:\Users\admin\Pictures\Minor Policy\FlImFTjXAD2PWnIB9kH6ttJ_.exehtml
MD5:—
SHA256:—
860Install-trim.exeC:\Users\admin\Pictures\Minor Policy\QTIDhztuolEnH8rfiwCNDtn1.exeexecutable
MD5:—
SHA256:—
860Install-trim.exeC:\Users\admin\Pictures\Minor Policy\TV58WTC0zcbhmffbh6DL_vTe.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
78
TCP/UDP connections
179
DNS requests
81
Threats
306

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
860
Install-trim.exe
HEAD
200
45.12.253.74:80
http://45.12.253.74/pineapple.php?pub=mixinte
BG
—
—
malicious
860
Install-trim.exe
HEAD
200
193.233.20.35:80
http://193.233.20.35/gallery/photo_007.exe
RU
—
—
suspicious
860
Install-trim.exe
HEAD
200
163.123.143.4:80
http://163.123.143.4/download/Service_.vmp
unknown
—
—
malicious
860
Install-trim.exe
HEAD
200
163.123.143.4:80
http://163.123.143.4/download/Service.vmp
unknown
—
—
malicious
860
Install-trim.exe
HEAD
200
104.21.87.159:80
http://ji.ghwiwwff.com/m/oskg25
US
—
—
malicious
1160
svchost.exe
GET
200
93.184.221.240:80
http://download.windowsupdate.com/d/msdownload/update/others/2023/03/38677868_b5a11517e30342a48165e18e0c7aebeeab8923c9.cab
US
compressed
7.66 Kb
whitelisted
1160
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
860
Install-trim.exe
HEAD
200
194.110.203.101:80
http://194.110.203.101/puta/brazilx86.exe
RU
—
—
suspicious
860
Install-trim.exe
HEAD
200
91.215.85.147:80
http://hugersi.com/dl/6523.exe
RU
—
—
suspicious
860
Install-trim.exe
POST
200
208.67.104.60:80
http://208.67.104.60/api/firegate.php
US
text
108 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1160
svchost.exe
40.127.169.103:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
87.240.129.133:80
vk.com
VKontakte Ltd
RU
malicious
860
Install-trim.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
860
Install-trim.exe
208.67.104.60:80
—
Delis LLC
US
malicious
1160
svchost.exe
52.238.248.6:443
fe2cr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
860
Install-trim.exe
87.240.129.133:80
vk.com
VKontakte Ltd
RU
malicious
2380
SIHClient.exe
40.127.169.103:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
860
Install-trim.exe
87.240.129.133:443
vk.com
VKontakte Ltd
RU
malicious
1160
svchost.exe
93.184.221.240:80
download.windowsupdate.com
EDGECAST
GB
whitelisted
860
Install-trim.exe
93.186.225.194:443
vk.com
VKontakte Ltd
RU
suspicious

DNS requests

Domain
IP
Reputation
ipinfo.io
  • 34.117.59.81
shared
vk.com
  • 87.240.129.133
  • 93.186.225.194
  • 87.240.137.164
  • 87.240.132.78
  • 87.240.132.72
  • 87.240.132.67
whitelisted
officeclient.microsoft.com
  • 52.109.88.191
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.76
  • 40.126.32.74
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.20
  • 20.190.160.17
  • 20.190.159.71
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.4
  • 20.190.159.2
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
nexusrules.officeapps.live.com
  • 52.109.8.86
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
crl.microsoft.com
  • 2.21.20.133
  • 2.21.20.137
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 2.18.233.62
  • 88.221.169.152
whitelisted
fe2cr.update.microsoft.com
  • 52.238.248.6
  • 13.91.16.71
whitelisted

Threats

PID
Process
Class
Message
860
Install-trim.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
—
—
Potentially Bad Traffic
ET INFO URL Shortening Service Domain in DNS Lookup (vk .com)
860
Install-trim.exe
Potentially Bad Traffic
ET INFO Observed URL Shortening Service Domain (vk .com in TLS SNI)
860
Install-trim.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
860
Install-trim.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
860
Install-trim.exe
Potentially Bad Traffic
ET INFO Observed URL Shortening Service Domain (vk .com in TLS SNI)
860
Install-trim.exe
Potentially Bad Traffic
ET INFO Observed URL Shortening Service Domain (vk .com in TLS SNI)
860
Install-trim.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
860
Install-trim.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
860
Install-trim.exe
Potentially Bad Traffic
ET INFO Observed URL Shortening Service Domain (vk .com in TLS SNI)
30 ETPRO signatures available at the full report
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Google\Chrome\User Data5UE5K directory exists )
chrome.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Google\Chrome\User Data5UE5K directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Install-trim.exe