amadey | 767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
29-03-2024 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
Size

1.8MB
MD5

ec1b525083229e5484cb3cd7e2619596
SHA1

d298601c571331ba7cf09250eb20c541197a6035
SHA256

767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505
SHA512

6eb1ba30fa3516c0e8178403797c2abd6eca69e935f0dd3cecee1ae6cb49f113dd215b66dbdf20e9847a2d0f25efd7d46965d013136a7bf23a91ce04df28fd49
SSDEEP

49152:mg3fjaa2gjscInSCQ3txytmPrIp0KeVeYZZQs4yw:m2+arsjSCctx2mDIpWpn74yw

Score

10^/10

amadey redline risepro zgrat livetraffic discovery evasion infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

4.185.137.132:1632

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe	family_zgrat_v1
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe	family_zgrat_v1
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe	family_zgrat_v1

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe	family_redline
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe	family_redline
behavioral2/memory/3420-779-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exeexplorha.exeexplorha.exe3d3de2df40.exeexplorgu.exeexplorha.exeamadka.exeexplorha.exeexplorha.exeamert.exerandom.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3d3de2df40.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amadka.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe

Blocklisted process makes network request 4 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exe

flow pid process

39 5240 rundll32.exe
45 5732 rundll32.exe
64 5632 rundll32.exe
66 5520 rundll32.exe
Downloads MZ/PE file

flow	pid	process
39	5240	rundll32.exe
45	5732	rundll32.exe
64	5632	rundll32.exe
66	5520	rundll32.exe

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

random.exeexplorha.exeamadka.exeexplorha.exeexplorha.exe3d3de2df40.exeexplorha.exeamert.exeexplorgu.exe767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exeexplorha.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amadka.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3d3de2df40.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amadka.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3d3de2df40.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe

Executes dropped EXE 20 IoCs

Processes:

explorha.exeexplorha.exe3d3de2df40.exeexplorha.exego.exeamert.exeexplorgu.exeexplorha.exerandom.exealex1234.exeTraffic.exepropro.exeamadka.exeredlinepanel.exe32456.exegoldprimeldlldf.exeNewB.exeSecond2.exeNewB.exeexplorha.exe

pid	process
3824	explorha.exe
2464	explorha.exe
2100	3d3de2df40.exe
4540	explorha.exe
4036	go.exe
5488	amert.exe
3856	explorgu.exe
5988	explorha.exe
5236	random.exe
5332	alex1234.exe
5456	Traffic.exe
5968	propro.exe
3892	amadka.exe
5296	redlinepanel.exe
5688	32456.exe
380	goldprimeldlldf.exe
5916	NewB.exe
4124	Second2.exe
5428	NewB.exe
5420	explorha.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

explorha.exeexplorha.exeexplorha.exe3d3de2df40.exeexplorgu.exeexplorha.exerandom.exeamadka.exe767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exeexplorha.exeamert.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	3d3de2df40.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	amadka.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Wine	amert.exe

Loads dropped DLL 7 IoCs

Processes:

rundll32.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exeSecond2.exe

pid process

4308 rundll32.exe
5240 rundll32.exe
5732 rundll32.exe
1904 rundll32.exe
5632 rundll32.exe
5520 rundll32.exe
4124 Second2.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4308	rundll32.exe
5240	rundll32.exe
5732	rundll32.exe
1904	rundll32.exe
5632	rundll32.exe
5520	rundll32.exe
4124	Second2.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorha.exeexplorgu.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\3d3de2df40.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000042001\\3d3de2df40.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044001\\go.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\random.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000873001\\random.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1637591879-962683004-3585269084-1000\Software\Microsoft\Windows\CurrentVersion\Run\amadka.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001031001\\amadka.exe"	explorgu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exeexplorha.exeexplorha.exeamert.exeexplorgu.exeexplorha.exeamadka.exeexplorha.exe

pid	process
3728	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
3824	explorha.exe
2464	explorha.exe
5488	amert.exe
3856	explorgu.exe
5988	explorha.exe
3892	amadka.exe
5420	explorha.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

explorha.exealex1234.exegoldprimeldlldf.exeSecond2.exe

description	pid	process	target process
PID 3824 set thread context of 4540	3824	explorha.exe	explorha.exe
PID 5332 set thread context of 2436	5332	alex1234.exe	RegAsm.exe
PID 380 set thread context of 3420	380	goldprimeldlldf.exe	RegAsm.exe
PID 4124 set thread context of 5640	4124	Second2.exe	MsBuild.exe

Drops file in Windows directory 2 IoCs

Processes:

767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exeamert.exe

description	ioc	process
File created	C:\Windows\Tasks\explorha.job	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
File created	C:\Windows\Tasks\explorgu.job	amert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5264 5640 WerFault.exe MsBuild.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

6004 schtasks.exe

pid	pid_target	process	target process
5264	5640	WerFault.exe	MsBuild.exe

pid	process
6004	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

propro.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	propro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	propro.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exeexplorha.exeexplorha.exemsedge.exemsedge.exemsedge.exerundll32.exeamert.exepowershell.exeidentity_helper.exemsedge.exeexplorgu.exeexplorha.exeamadka.exeTraffic.exepropro.exerundll32.exe32456.exe

pid	process
3728	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
3728	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
3824	explorha.exe
3824	explorha.exe
2464	explorha.exe
2464	explorha.exe
3940	msedge.exe
3940	msedge.exe
3532	msedge.exe
3532	msedge.exe
2232	msedge.exe
2232	msedge.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5488	amert.exe
5488	amert.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5240	rundll32.exe
5988	powershell.exe
5988	powershell.exe
5988	powershell.exe
5792	identity_helper.exe
5792	identity_helper.exe
2052	msedge.exe
2052	msedge.exe
3856	explorgu.exe
3856	explorgu.exe
5988	explorha.exe
5988	explorha.exe
3892	amadka.exe
3892	amadka.exe
5456	Traffic.exe
5456	Traffic.exe
5968	propro.exe
5968	propro.exe
5632	rundll32.exe
5632	rundll32.exe
5632	rundll32.exe
5632	rundll32.exe
5632	rundll32.exe
5632	rundll32.exe
5688	32456.exe
5688	32456.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe
5968	propro.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

powershell.exeTraffic.exe32456.exepropro.exepowershell.exeredlinepanel.exeRegAsm.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	5988	powershell.exe
Token: SeDebugPrivilege	5456	Traffic.exe
Token: SeBackupPrivilege	5456	Traffic.exe
Token: SeSecurityPrivilege	5456	Traffic.exe
Token: SeSecurityPrivilege	5456	Traffic.exe
Token: SeSecurityPrivilege	5456	Traffic.exe
Token: SeSecurityPrivilege	5456	Traffic.exe
Token: SeDebugPrivilege	5688	32456.exe
Token: SeBackupPrivilege	5688	32456.exe
Token: SeSecurityPrivilege	5688	32456.exe
Token: SeSecurityPrivilege	5688	32456.exe
Token: SeSecurityPrivilege	5688	32456.exe
Token: SeSecurityPrivilege	5688	32456.exe
Token: SeDebugPrivilege	5968	propro.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	5296	redlinepanel.exe
Token: SeDebugPrivilege	3420	RegAsm.exe
Token: SeDebugPrivilege	2436	RegAsm.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

go.exemsedge.exe

pid	process
4036	go.exe
4036	go.exe
4036	go.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 15 IoCs

Processes:

go.exemsedge.exe

pid	process
4036	go.exe
4036	go.exe
4036	go.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exeexplorha.exego.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 3728 wrote to memory of 3824	3728	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe	explorha.exe
PID 3728 wrote to memory of 3824	3728	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe	explorha.exe
PID 3728 wrote to memory of 3824	3728	767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe	explorha.exe
PID 3824 wrote to memory of 2100	3824	explorha.exe	3d3de2df40.exe
PID 3824 wrote to memory of 2100	3824	explorha.exe	3d3de2df40.exe
PID 3824 wrote to memory of 2100	3824	explorha.exe	3d3de2df40.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4540	3824	explorha.exe	explorha.exe
PID 3824 wrote to memory of 4036	3824	explorha.exe	go.exe
PID 3824 wrote to memory of 4036	3824	explorha.exe	go.exe
PID 3824 wrote to memory of 4036	3824	explorha.exe	go.exe
PID 4036 wrote to memory of 3532	4036	go.exe	msedge.exe
PID 4036 wrote to memory of 3532	4036	go.exe	msedge.exe
PID 3532 wrote to memory of 2392	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 2392	3532	msedge.exe	msedge.exe
PID 4036 wrote to memory of 3388	4036	go.exe	msedge.exe
PID 4036 wrote to memory of 3388	4036	go.exe	msedge.exe
PID 3388 wrote to memory of 3424	3388	msedge.exe	msedge.exe
PID 3388 wrote to memory of 3424	3388	msedge.exe	msedge.exe
PID 4036 wrote to memory of 3324	4036	go.exe	msedge.exe
PID 4036 wrote to memory of 3324	4036	go.exe	msedge.exe
PID 3324 wrote to memory of 4812	3324	msedge.exe	msedge.exe
PID 3324 wrote to memory of 4812	3324	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe
PID 3532 wrote to memory of 3708	3532	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe
"C:\Users\Admin\AppData\Local\Temp\767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3728

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3824

C:\Users\Admin\AppData\Local\Temp\1000042001\3d3de2df40.exe
"C:\Users\Admin\AppData\Local\Temp\1000042001\3d3de2df40.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
PID:2100

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
PID:4540

C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
"C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa33303cb8,0x7ffa33303cc8,0x7ffa33303cd8
5⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
5⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
5⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
5⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
5⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
5⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
5⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
5⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
5⤵
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:1
5⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
5⤵
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6488 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
5⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
5⤵
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,658741912733488053,5029062241287575856,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6620 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
4⤵
- Suspicious use of WriteProcessMemory
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa33303cb8,0x7ffa33303cc8,0x7ffa33303cd8
5⤵
PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1704,2808855818649396039,8070678101913430356,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:2
5⤵
PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1704,2808855818649396039,8070678101913430356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
4⤵
- Suspicious use of WriteProcessMemory
PID:3324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa33303cb8,0x7ffa33303cc8,0x7ffa33303cd8
5⤵
PID:4812

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
3⤵
- Loads dropped DLL
PID:4308

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5240

C:\Windows\system32\netsh.exe
netsh wlan show profiles
5⤵
PID:5428

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\637591879962_Desktop.zip' -CompressionLevel Optimal
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5988

C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
"C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:5488

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5732

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3520

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3856

C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
"C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
PID:5236

C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
"C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2436

C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5456

C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5968

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
4⤵
PID:4632

C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:4460

C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
"C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3892

C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
"C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5296

C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
"C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5688

C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
"C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3420

C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
"C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
2⤵
- Executes dropped EXE
PID:5916

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
3⤵
- Creates scheduled task(s)
PID:6004

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
2⤵
- Loads dropped DLL
PID:1904

C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5632

C:\Windows\system32\netsh.exe
netsh wlan show profiles
4⤵
PID:3468

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\637591879962_Desktop.zip' -CompressionLevel Optimal
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Users\Admin\AppData\Local\Temp\1001061001\Second2.exe
"C:\Users\Admin\AppData\Local\Temp\1001061001\Second2.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:4124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
3⤵
PID:3580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
3⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 2108
4⤵
- Program crash
PID:5264

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:5520

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5640 -ip 5640
1⤵
PID:2024

C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
1⤵
- Executes dropped EXE
PID:5428

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5420

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
656bb397c72d15efa159441f116440a6

SHA1
5b57747d6fdd99160af6d3e580114dbbd351921f

SHA256
770ed0fcd22783f60407cdc55b5998b08e37b3e06efb3d1168ffed8768751fab

SHA512
5923db1d102f99d0b29d60916b183b92e6be12cc55733998d3da36d796d6158c76e385cef320ec0e9afa242a42bfb596f7233b60b548f719f7d41cb8f404e73c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d459a8c16562fb3f4b1d7cadaca620aa

SHA1
7810bf83e8c362e0c69298e8c16964ed48a90d3a

SHA256
fa31bc49a2f9af06d325871104e36dd69bfe3847cd521059b62461a92912331a

SHA512
35cb00c21908e1332c3439af1ec9867c81befcc4792248ee392080b455b1f5ce2b0c0c2415e344d91537469b5eb72f330b79feb7e8a86eeb6cf41ec5be5dfd2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
960B

MD5
bac65d84269d8ea0bf969da4fe022b12

SHA1
b049f05095d8016b1c49f308143d1b8bb501767a

SHA256
b239265e1173889570aa8ded4af07d5c84113f7430dfda24935e4fbd766ef1f0

SHA512
9852c24bbcef1d105b525ca8cdc421bb71da2af3f84ed32ef13a522d3cfb5cf3fa7ec0ac501253b7d49fdebf60c74457e30e25a27997fa751c2b8861398194e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
20KB

MD5
3ee05431aabc9a78a49b25bea1b7ce8a

SHA1
91ddaa6a11a674d53731590aced549b3338acef3

SHA256
c220185dcbfe3b83fc72a28c695929a63bd95f4d377996db66195c183aa92abe

SHA512
9b74cf94907bbcf73ff2d4a0c018be3c2c64bcc5728d78a9d8a97cacc26667911d79a8566ce670f1e48af36160b8f11e110df666f520cf17fe2d5c29ae163dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
2KB

MD5
7adc8ec0769529c60d8ee5be2e19cbb1

SHA1
1018503f6820c19723b02d7a39c4fdb9d3781555

SHA256
61a23937a0a7f38a589eec7c1398262ecdb3f5028f364231025f60d6ab617709

SHA512
18bf11677bdf25c59fe808f01d5d23476af6bdd8ee15bf1b8cb237de5acfcd4823ff61b187c73c760027442a53bd6b552b4373f4fb46f7fea273ed8841b712d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
e7c8b3d7b4cc0ca9e713ecce792dcf02

SHA1
0c58fb2ae6b18b33de72a49e39d0e6a2e558b4e7

SHA256
b8938f82f70a07be7b3bff41eef1f6dfe426fb9b58453e2081a035e87c204cd2

SHA512
cac64588d1f780d711947074d9772d920e7b83cf4ffb242eaa46ba6fff1269493c11ddeba7b4b2ce22e5eac38f0b2f11c670605b3b2fdf42882411e814c06b3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
7c807a8419bafd141bd5bfc711f833ec

SHA1
66316d32a8fa5f9080bf6f652d36854f16694c6a

SHA256
fa31494d8e1cae8c7fad6d8b86ba5a9ef27e1345255c6046f917d2e297e40210

SHA512
4f8b50ffc0b95d091d4dbdc6372b7863cfa4b7febebd64a37f1750aa6fb73eba42d60718ea68d21833700253b2716084bb9cae75867a956a99059cbf0133b973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
707B

MD5
ead6985098c62f86782f4f62a14705b9

SHA1
f3b5721d0a7f6cb916601deb27276390d0f0eb26

SHA256
525dc275f70b5008470ba5810f9d4dc22ed8c8b6e59bbeff2862554ef2ccecd3

SHA512
013454c15c15b4d5c365258c1f8f6b2f01f74a24689010bccdbec01aca1b6cbfa188d17d77c587320137993b47bd0eb8f8898ae2784a16ba83d4c79800e4bf86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
707B

MD5
686f078bf526a902e5c09905e85287d8

SHA1
a30ed347f69345855a2100334a1cd159678a18b5

SHA256
58f4dca61d33bc81a7d31f24f7886d997f60861514f61a8130485c9acc8e9a5d

SHA512
a7a8acd94243baf343ef2bcdd4af700b4a83ac4406dbe2e611b612fe9c52a39d7b690161c311ad50cf7b6d9523cc5796f86a6f4aefe5cfadd3075c49277b5475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eaae.TMP
Filesize
707B

MD5
5b80847c3189d95b89beb3c990df7a46

SHA1
686809d1e8e9cdf3a4d63985864dfab80e4cadfd

SHA256
2e595b7e37a4fc02ea4f40cf2e83010de02298ae861469156d1437598abc97d0

SHA512
9c8136007e40fdf8cd79b917d2c616b0236594e6b562e7d98dec8ba7d74694c966984b8e0a00a2c343d448a0b61a3cb7a31d2eb7f8561a9078c274b16320b0ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
8789c5e5d6587485077a60bf44c3a1c0

SHA1
30869f7813488bf94890f653aff9c00067e1332e

SHA256
b016c137e67ecc00d67596cd8745ecd5a3b8dfdc2f721229354b0ebf9b545004

SHA512
767bfbb540ae7164348bb985abace7b3534456ddab3e4160ecc57324e66cc86afd8003df7a852bf7965dc4d1cf2075fd6400b9d68155d49b87d8dd89797ce6c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
8KB

MD5
8dd3f94152d6981ce60d68c287e35b36

SHA1
9206558d572bd9e39079397cd8955cf6a5e77236

SHA256
656d2af1e8e149fc29ba51e2539c7c9a2f36403076feeaac887d2f0175c77bec

SHA512
5b1ad1502a6ad74197d57a60cca9dc778a776161ead73035c2f6dde2483e7e13252b755d4cd9e06fd9efd3610b6372849e1136b670007805343a1e9c856e3f91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d58e1c03b63b75d865486f04ae7aeb6b

SHA1
42adf1709ab47cb594ac801cf8da7b50118bf41a

SHA256
e5df8cd2e7abf7aff3afdf9bb6fc63f19bec8f37b265c3d484a5f0a71d1e1236

SHA512
ca00b3a2b8303e541aa47cdccc5370bcf01c6419ac69064f6515f858c5bcd31df1874133fd8c7d8a708565035f6edc0dd4f4e32480be76980f1a7df5d9563439

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
d6ef434cb951c5653e6e2c2c4c3ce591

SHA1
c92458fe7fc9301d95016894c047c6057c52c207

SHA256
80fd255edae89bfd02ca1357ce283e3d620a920e07eaa4ec8cd32d1d7d2e4447

SHA512
8776b589dca78afe2533ff45c2d9e24fb81b04505bc90f2d8fae9c8cab783570d137813569e0a2cfe043b929e8b73a5840d81b6e829a4b4669f523fdebe80123

Download Submit
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Filesize
1.8MB

MD5
ec1b525083229e5484cb3cd7e2619596

SHA1
d298601c571331ba7cf09250eb20c541197a6035

SHA256
767109f4f35c54cb3b58635dbbc26e47441cf9ea6c620dd42cb697f72506b505

SHA512
6eb1ba30fa3516c0e8178403797c2abd6eca69e935f0dd3cecee1ae6cb49f113dd215b66dbdf20e9847a2d0f25efd7d46965d013136a7bf23a91ce04df28fd49

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\3d3de2df40.exe
Filesize
3.0MB

MD5
e4d5ca0dc00dc6ce5584a0d04bb8bade

SHA1
93c1fa67c9650a5efbad94a641b104901d8449f2

SHA256
8551d3642c4bb73322527055bfc45a039e7749c9b20185fe9034f39c9758e6dd

SHA512
0d9ebd5bf09909bb906c5aa13ec4b5d7659e20d6b81c6c859160f9ce910b8b8e1c500e28c8b90f0d40ad3dcf644873bfc2786b05b75a80a5ee9e533790111ea9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
Filesize
894KB

MD5
2f8912af892c160c1c24c9f38a60c1ab

SHA1
d2deae508e262444a8f15c29ebcc7ebbe08a3fdb

SHA256
59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308

SHA512
0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
Filesize
1.9MB

MD5
864674e8be395eb28bb181184add5c01

SHA1
79bb9c0ae54bf8572328af06b6576327bd0a386c

SHA256
7ef012907eb337ad94d0635a9d1a1dd64ccb32b5c193a5bb732eee3dd22013da

SHA512
7f85146e5cca26f5a388aeea88cf9d86819aed6e240c3b94569967a2074654327e531be66f1335f9fa0790f13844c65315a3020d0e9c6bdce40c3605164abc25

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
Filesize
1.7MB

MD5
85a15f080b09acace350ab30460c8996

SHA1
3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

SHA256
3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

SHA512
ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
Filesize
301KB

MD5
832eb4dc3ed8ceb9a1735bd0c7acaf1b

SHA1
b622a406927fbb8f6cd5081bd4455fb831948fca

SHA256
2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7

SHA512
3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
Filesize
499KB

MD5
83d0b41c7a3a0d29a268b49a313c5de5

SHA1
46f3251c771b67b40b1f3268caef8046174909a5

SHA256
09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9

SHA512
705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
Filesize
464KB

MD5
c084d6f6ba40534fbfc5a64b21ef99ab

SHA1
0b4a17da83c0a8abbc8fab321931d5447b32b720

SHA256
afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

SHA512
a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001061001\Second2.exe
Filesize
4.6MB

MD5
0c2d303852f827c4852bf46550ea2ed8

SHA1
7bb54cb67135bbb94d8a26356f3d1e170a71a1a7

SHA256
194234e48c362f1bf3be6d02c5b380bfc900a2cf7911a1fc658a5a2ec0d0164f

SHA512
c2ab4c4a4bcfd4f9f350e946a08a9be3ded6741ac3981a977c52331a403488b4f224c7f0b01d24af3e351e532b3c3cdeedfe356785e5858411c80793fb3ca307

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp7B26.tmp
Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_usfxxooc.pm3.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9410.tmp
Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9442.tmp
Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA43E.tmp
Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
109KB

MD5
2afdbe3b99a4736083066a13e4b5d11a

SHA1
4d4856cf02b3123ac16e63d4a448cdbcb1633546

SHA256
8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

SHA512
d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
1.2MB

MD5
92fbdfccf6a63acef2743631d16652a7

SHA1
971968b1378dd89d59d7f84bf92f16fc68664506

SHA256
b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

SHA512
b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
109KB

MD5
726cd06231883a159ec1ce28dd538699

SHA1
404897e6a133d255ad5a9c26ac6414d7134285a2

SHA256
12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

SHA512
9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
1.2MB

MD5
15a42d3e4579da615a384c717ab2109b

SHA1
22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

SHA256
3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

SHA512
1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
Filesize
541KB

MD5
1fc4b9014855e9238a361046cfbf6d66

SHA1
c17f18c8246026c9979ab595392a14fe65cc5e9f

SHA256
f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

SHA512
2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
Filesize
304KB

MD5
cc90e3326d7b20a33f8037b9aab238e4

SHA1
236d173a6ac462d85de4e866439634db3b9eeba3

SHA256
bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

SHA512
b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk
Filesize
2KB

MD5
fc3db660041d404d0cecb3983ac6a35d

SHA1
65db71feef229f58271c557fab2f37a8f1fa7f20

SHA256
b5a7ad81e764b1175822398e43956fc78201fee48a64a10b467d91c308327ec9

SHA512
152aae1d1e61400a39125ed0adc501ba6797efcc7562b09a1dca6cd9ee5ea7de7479759e7b60706dda8183a366aeca88a2b0000c064b599a4b2b2f44fa1beb69

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk
Filesize
2KB

MD5
7be54a3a091767af267e54049921a2b4

SHA1
9d3b5053813ebe90aa1183ff1aeb322e6cad253b

SHA256
8c8f02261e964d75c97ef5dd679b7da8338a73fcae12ddf6b14a00f251f1ce57

SHA512
3447094623187dc3d129062985b655d06dfe946b5ad5635b254d9b07d5a5a8fa07724cb24beb33c6ea97dc782eae280972f07c5d17342b8145f53985d8caf678

Download Submit
\??\pipe\LOCAL\crashpad_3532_LUOMYOOBBCPYPDOH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2100-773-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-61-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-365-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-952-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-410-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-352-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-972-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-444-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-446-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-457-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-63-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2100-528-0x0000000000F20000-0x00000000012CE000-memory.dmp

Filesize
3.7MB

Download
memory/2436-535-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/2464-42-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/2464-41-0x00000000051B0000-0x00000000051B1000-memory.dmp

Filesize
4KB

Download
memory/2464-40-0x0000000005180000-0x0000000005181000-memory.dmp

Filesize
4KB

Download
memory/2464-39-0x0000000005170000-0x0000000005171000-memory.dmp

Filesize
4KB

Download
memory/2464-37-0x0000000005190000-0x0000000005191000-memory.dmp

Filesize
4KB

Download
memory/2464-36-0x00000000051A0000-0x00000000051A1000-memory.dmp

Filesize
4KB

Download
memory/2464-38-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/2464-35-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/2464-34-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3420-779-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/3728-8-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/3728-22-0x00000000001D0000-0x00000000006A0000-memory.dmp

Filesize
4.8MB

Download
memory/3728-1-0x0000000077826000-0x0000000077828000-memory.dmp

Filesize
8KB

Download
memory/3728-2-0x00000000001D0000-0x00000000006A0000-memory.dmp

Filesize
4.8MB

Download
memory/3728-0-0x00000000001D0000-0x00000000006A0000-memory.dmp

Filesize
4.8MB

Download
memory/3728-4-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/3728-3-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/3728-5-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/3728-6-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/3728-7-0x00000000053C0000-0x00000000053C1000-memory.dmp

Filesize
4KB

Download
memory/3728-9-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/3728-10-0x0000000005440000-0x0000000005441000-memory.dmp

Filesize
4KB

Download
memory/3824-67-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-118-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-24-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-25-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/3824-23-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-27-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/3824-31-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/3824-30-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/3824-366-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-569-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-28-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

Filesize
4KB

Download
memory/3824-411-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-29-0x0000000004B60000-0x0000000004B61000-memory.dmp

Filesize
4KB

Download
memory/3824-458-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-974-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-968-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-447-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-841-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-445-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-32-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

Filesize
4KB

Download
memory/3824-119-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/3824-26-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/3856-913-0x0000000000F10000-0x00000000013E8000-memory.dmp

Filesize
4.8MB

Download
memory/3856-652-0x0000000000F10000-0x00000000013E8000-memory.dmp

Filesize
4.8MB

Download
memory/3856-470-0x0000000000F10000-0x00000000013E8000-memory.dmp

Filesize
4.8MB

Download
memory/3856-471-0x0000000000F10000-0x00000000013E8000-memory.dmp

Filesize
4.8MB

Download
memory/3856-971-0x0000000000F10000-0x00000000013E8000-memory.dmp

Filesize
4.8MB

Download
memory/3856-473-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/3856-474-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/3856-472-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/3856-475-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

Filesize
4KB

Download
memory/3892-650-0x0000000000250000-0x0000000000720000-memory.dmp

Filesize
4.8MB

Download
memory/4540-72-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-81-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-367-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-64-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-69-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/4540-68-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-70-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-71-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-73-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-75-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-74-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-76-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-77-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-78-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-79-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-80-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-82-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-387-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-83-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-85-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-84-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-86-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-87-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-88-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-121-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-105-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-117-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-106-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-115-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-112-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-94-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-93-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-92-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-91-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-89-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/4540-90-0x0000000000400000-0x00000000007AE000-memory.dmp

Filesize
3.7MB

Download
memory/5236-686-0x00000000009E0000-0x0000000000D8E000-memory.dmp

Filesize
3.7MB

Download
memory/5236-973-0x00000000009E0000-0x0000000000D8E000-memory.dmp

Filesize
3.7MB

Download
memory/5236-953-0x00000000009E0000-0x0000000000D8E000-memory.dmp

Filesize
3.7MB

Download
memory/5488-335-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/5488-267-0x0000000000490000-0x0000000000968000-memory.dmp

Filesize
4.8MB

Download
memory/5488-290-0x00000000054C0000-0x00000000054C1000-memory.dmp

Filesize
4KB

Download
memory/5488-298-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/5488-304-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/5488-303-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/5488-307-0x00000000054E0000-0x00000000054E1000-memory.dmp

Filesize
4KB

Download
memory/5488-301-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/5488-328-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/5488-288-0x0000000000490000-0x0000000000968000-memory.dmp

Filesize
4.8MB

Download
memory/5488-340-0x0000000000490000-0x0000000000968000-memory.dmp

Filesize
4.8MB

Download
memory/5488-293-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/5988-341-0x00007FFA1FDE0000-0x00007FFA208A2000-memory.dmp

Filesize
10.8MB

Download
memory/5988-351-0x000002667B7E0000-0x000002667B802000-memory.dmp

Filesize
136KB

Download
memory/5988-508-0x0000000000A80000-0x0000000000F50000-memory.dmp

Filesize
4.8MB

Download
memory/5988-353-0x000002667B880000-0x000002667B890000-memory.dmp

Filesize
64KB

Download
memory/5988-356-0x000002667B880000-0x000002667B890000-memory.dmp

Filesize
64KB

Download
memory/5988-357-0x000002667BB00000-0x000002667BB12000-memory.dmp

Filesize
72KB

Download
memory/5988-358-0x000002667B870000-0x000002667B87A000-memory.dmp

Filesize
40KB

Download
memory/5988-342-0x000002667B880000-0x000002667B890000-memory.dmp

Filesize
64KB

Download
memory/5988-364-0x00007FFA1FDE0000-0x00007FFA208A2000-memory.dmp

Filesize
10.8MB

Download