Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    299s
  • max time network
    301s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/04/2024, 04:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    012ef7824ca1930a472c672ffca4c5ab7d332b13094adcaf2cac06bc3ad09905.exe
  • Size 1.9MB
  • Sample240401-fejx6sec43
  • SHA256 012ef7824ca1930a472c672ffca4c5ab7d332b13094adcaf2cac06bc3ad09905
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygluptebalummaredlineriseprozgrat@oleh_pspgooglediscoverydropperevasioninfostealerloaderpersistencephishingratrootkitspywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.18

C2

  • http://193.233.132.56

Attributes
  • install_dir

    09fd851a4f

  • install_file

    explorha.exe

  • strings_key

    443351145ece4966ded809641c77cfa8

  • url_paths

    /Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

  • amadey

Version

  • 4.17

C2

  • http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • @OLEH_PSP

C2

  • 185.172.128.33:8970

Extracted

Family

  • lumma

C2

  • https://affordcharmcropwo.shop/api

  • https://enthusiasimtitleow.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 3 IoCs
  • Detected google phishing page
    phishinggoogle
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Windows security bypass 2 TTPs 9 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Blocklisted process makes network request 6 IoCs
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 50 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 17 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 9 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 19 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 3 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 18 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\012ef7824ca1930a472c672ffca4c5ab7d332b13094adcaf2cac06bc3ad09905.exe
    "C:\Users\Admin\AppData\Local\Temp\012ef7824ca1930a472c672ffca4c5ab7d332b13094adcaf2cac06bc3ad09905.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:496
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3532
      • C:\Users\Admin\AppData\Local\Temp\1000042001\e6b5d5cf9a.exe
        "C:\Users\Admin\AppData\Local\Temp\1000042001\e6b5d5cf9a.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:4944
      • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
        "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:1536
      • C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
        "C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:844
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
          4⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Windows\system32\netsh.exe
            netsh wlan show profiles
            5⤵
              PID:2892
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\104443672357_Desktop.zip' -CompressionLevel Optimal
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5168
        • C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
          "C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          PID:5160
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
          3⤵
          • Blocklisted process makes network request
          • Loads dropped DLL
          PID:5560
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2548
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:4996
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:280
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2240
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2124
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:964
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4228
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:5888
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:5296
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:5168
    • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2004
    • C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2380
      • C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe
        "C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        PID:5420
      • C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
        "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:2220
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:5200
            • C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
              4⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5836
            • C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
              "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5412
        • C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
          "C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:6120
        • C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
          "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:568
        • C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
          "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:6036
        • C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
          "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:2424
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2892
        • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
          "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
          2⤵
          • Executes dropped EXE
          PID:4616
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
            3⤵
            • Creates scheduled task(s)
            PID:5976
          • C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe
            "C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:5268
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:6400
              • C:\Users\Admin\Pictures\ks3p1lBUP3NP8CeowxTuPFRZ.exe
                "C:\Users\Admin\Pictures\ks3p1lBUP3NP8CeowxTuPFRZ.exe"
                5⤵
                • Executes dropped EXE
                PID:6364
                • C:\Users\Admin\AppData\Local\Temp\u4ws.0.exe
                  "C:\Users\Admin\AppData\Local\Temp\u4ws.0.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4620
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\GCBKECAKFB.exe"
                    7⤵
                      PID:7668
                      • C:\Users\Admin\AppData\Local\Temp\GCBKECAKFB.exe
                        "C:\Users\Admin\AppData\Local\Temp\GCBKECAKFB.exe"
                        8⤵
                        • Executes dropped EXE
                        PID:7968
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\GCBKECAKFB.exe
                          9⤵
                            PID:8116
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 2.2.2.2 -n 1 -w 3000
                              10⤵
                              • Runs ping.exe
                              PID:2424
                    • C:\Users\Admin\AppData\Local\Temp\u4ws.1.exe
                      "C:\Users\Admin\AppData\Local\Temp\u4ws.1.exe"
                      6⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      PID:6820
                      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                        7⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:7520
                  • C:\Users\Admin\Pictures\fBo8SNDbcUBvX3OZaiuZsJDc.exe
                    "C:\Users\Admin\Pictures\fBo8SNDbcUBvX3OZaiuZsJDc.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6580
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      6⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:6396
                    • C:\Users\Admin\Pictures\fBo8SNDbcUBvX3OZaiuZsJDc.exe
                      "C:\Users\Admin\Pictures\fBo8SNDbcUBvX3OZaiuZsJDc.exe"
                      6⤵
                      • Windows security bypass
                      • Executes dropped EXE
                      • Windows security modification
                      • Adds Run key to start application
                      • Checks for VirtualBox DLLs, possible anti-VM trick
                      • Drops file in Windows directory
                      PID:7164
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        7⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious use of AdjustPrivilegeToken
                        PID:7628
                      • C:\Windows\System32\cmd.exe
                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                        7⤵
                          PID:7924
                          • C:\Windows\system32\netsh.exe
                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                            8⤵
                            • Modifies Windows Firewall
                            PID:7416
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          7⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:8184
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          7⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4636
                    • C:\Users\Admin\Pictures\0wkalP8FOIMLllXFoLLpgMSM.exe
                      "C:\Users\Admin\Pictures\0wkalP8FOIMLllXFoLLpgMSM.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4288
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6332
                      • C:\Users\Admin\Pictures\0wkalP8FOIMLllXFoLLpgMSM.exe
                        "C:\Users\Admin\Pictures\0wkalP8FOIMLllXFoLLpgMSM.exe"
                        6⤵
                        • Windows security bypass
                        • Executes dropped EXE
                        • Windows security modification
                        • Adds Run key to start application
                        • Checks for VirtualBox DLLs, possible anti-VM trick
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        PID:5184
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          7⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:7540
                        • C:\Windows\System32\cmd.exe
                          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                          7⤵
                            PID:7672
                            • C:\Windows\system32\netsh.exe
                              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                              8⤵
                              • Modifies Windows Firewall
                              PID:6172
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            7⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:7012
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            7⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6956
                          • C:\Windows\rss\csrss.exe
                            C:\Windows\rss\csrss.exe
                            7⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Manipulates WinMonFS driver.
                            • Drops file in Windows directory
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6520
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              8⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2272
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                              8⤵
                              • Creates scheduled task(s)
                              PID:6044
                            • C:\Windows\SYSTEM32\schtasks.exe
                              schtasks /delete /tn ScheduledUpdate /f
                              8⤵
                                PID:6616
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                8⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:6932
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                8⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3116
                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                8⤵
                                • Executes dropped EXE
                                PID:4724
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                8⤵
                                • Creates scheduled task(s)
                                PID:6984
                              • C:\Windows\windefender.exe
                                "C:\Windows\windefender.exe"
                                8⤵
                                • Executes dropped EXE
                                PID:7716
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  9⤵
                                    PID:708
                                    • C:\Windows\SysWOW64\sc.exe
                                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                      10⤵
                                      • Launches sc.exe
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5008
                          • C:\Users\Admin\Pictures\5k89v6OxhHHcCZqK7l0SDESv.exe
                            "C:\Users\Admin\Pictures\5k89v6OxhHHcCZqK7l0SDESv.exe"
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6888
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              6⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:6168
                            • C:\Users\Admin\Pictures\5k89v6OxhHHcCZqK7l0SDESv.exe
                              "C:\Users\Admin\Pictures\5k89v6OxhHHcCZqK7l0SDESv.exe"
                              6⤵
                              • Windows security bypass
                              • Executes dropped EXE
                              • Windows security modification
                              • Adds Run key to start application
                              • Checks for VirtualBox DLLs, possible anti-VM trick
                              • Drops file in Windows directory
                              PID:6632
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -nologo -noprofile
                                7⤵
                                • Drops file in System32 directory
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:6072
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  8⤵
                                    PID:2424
                                • C:\Windows\System32\cmd.exe
                                  C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                  7⤵
                                    PID:8180
                                    • C:\Windows\system32\netsh.exe
                                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                      8⤵
                                      • Modifies Windows Firewall
                                      PID:7904
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    7⤵
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:6188
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    7⤵
                                    • Drops file in System32 directory
                                    • Modifies data under HKEY_USERS
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:7036
                              • C:\Users\Admin\Pictures\PQL8qIa2Al1mFv8nwjTeDbiz.exe
                                "C:\Users\Admin\Pictures\PQL8qIa2Al1mFv8nwjTeDbiz.exe"
                                5⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6908
                              • C:\Users\Admin\Pictures\tTIPaI6X8QNZusmUCpab1Rrq.exe
                                "C:\Users\Admin\Pictures\tTIPaI6X8QNZusmUCpab1Rrq.exe" --silent --allusers=0
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Enumerates connected drives
                                • Modifies system certificate store
                                PID:6240
                                • C:\Users\Admin\Pictures\tTIPaI6X8QNZusmUCpab1Rrq.exe
                                  C:\Users\Admin\Pictures\tTIPaI6X8QNZusmUCpab1Rrq.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6b40e1d0,0x6b40e1dc,0x6b40e1e8
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:7160
                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\tTIPaI6X8QNZusmUCpab1Rrq.exe
                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\tTIPaI6X8QNZusmUCpab1Rrq.exe" --version
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:6680
                                • C:\Users\Admin\Pictures\tTIPaI6X8QNZusmUCpab1Rrq.exe
                                  "C:\Users\Admin\Pictures\tTIPaI6X8QNZusmUCpab1Rrq.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6240 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240401044834" --session-guid=a504f3b5-c277-4898-a784-00d8ef831203 --server-tracking-blob=NjdjYWZiNDI4YTQ5NzNjMjdkODgzODVlZDVjNGFjOGY1ZWNlZjE0ZjNiZjFjZDFlYjViODU5NzYyMmJiZmQwNDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N18xMjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE5NDY4OTkuMzA1NiIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N18xMjMiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImI2NTk3NDAwLTkyN2MtNGM1MS04OGUwLWU3NWYzYjNiNjRiMCJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=C004000000000000
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Enumerates connected drives
                                  PID:6348
                                  • C:\Users\Admin\Pictures\tTIPaI6X8QNZusmUCpab1Rrq.exe
                                    C:\Users\Admin\Pictures\tTIPaI6X8QNZusmUCpab1Rrq.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2ac,0x2b0,0x2b4,0x27c,0x2b8,0x6a7de1d0,0x6a7de1dc,0x6a7de1e8
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:7028
                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010448341\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010448341\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:5772
                                • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010448341\assistant\assistant_installer.exe
                                  "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010448341\assistant\assistant_installer.exe" --version
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:5188
                                  • C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010448341\assistant\assistant_installer.exe
                                    "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010448341\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x11d0040,0x11d004c,0x11d0058
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:7432
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                              4⤵
                                PID:6428
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                            2⤵
                            • Loads dropped DLL
                            PID:5432
                            • C:\Windows\system32\rundll32.exe
                              "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
                              3⤵
                              • Blocklisted process makes network request
                              • Loads dropped DLL
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1896
                              • C:\Windows\system32\netsh.exe
                                netsh wlan show profiles
                                4⤵
                                  PID:6120
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\104443672357_Desktop.zip' -CompressionLevel Optimal
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:6304
                            • C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
                              "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:6212
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                3⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:6456
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 784
                                3⤵
                                • Program crash
                                PID:6484
                            • C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
                              "C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:6692
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                3⤵
                                  PID:6916
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6692 -s 784
                                  3⤵
                                  • Program crash
                                  PID:6924
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  3⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:6936
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                                2⤵
                                • Blocklisted process makes network request
                                • Loads dropped DLL
                                PID:6584
                            • C:\Windows\system32\browser_broker.exe
                              C:\Windows\system32\browser_broker.exe -Embedding
                              1⤵
                                PID:4668
                              • C:\Windows\system32\browser_broker.exe
                                C:\Windows\system32\browser_broker.exe -Embedding
                                1⤵
                                  PID:7100
                                • C:\Windows\system32\browser_broker.exe
                                  C:\Windows\system32\browser_broker.exe -Embedding
                                  1⤵
                                    PID:1892
                                  • \??\c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                    1⤵
                                      PID:4416
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                      1⤵
                                        PID:6228
                                      • C:\Windows\system32\browser_broker.exe
                                        C:\Windows\system32\browser_broker.exe -Embedding
                                        1⤵
                                          PID:5192
                                        • C:\Windows\system32\browser_broker.exe
                                          C:\Windows\system32\browser_broker.exe -Embedding
                                          1⤵
                                            PID:5912
                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            1⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:7608
                                          • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                            C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:7888
                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            1⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:8084
                                          • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                            C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:7728
                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            1⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:7796
                                          • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                            C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:7316
                                          • C:\Windows\windefender.exe
                                            C:\Windows\windefender.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Modifies data under HKEY_USERS
                                            PID:3744
                                          • C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                            1⤵
                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                            • Checks BIOS information in registry
                                            • Executes dropped EXE
                                            • Identifies Wine through registry keys
                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                            PID:2884
                                          • C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                            C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                            1⤵
                                            • Executes dropped EXE
                                            PID:7220

                                          Network

                                                MITRE ATT&CK Enterprise v15

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Privilege Escalation

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                1
                                                T1543

                                                Windows Service

                                                1
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Defense Evasion

                                                Impair Defenses

                                                3
                                                T1562

                                                Disable or Modify System Firewall

                                                1
                                                T1562.004

                                                Disable or Modify Tools

                                                2
                                                T1562.001

                                                Modify Registry

                                                5
                                                T1112

                                                Subvert Trust Controls

                                                1
                                                T1553

                                                Install Root Certificate

                                                1
                                                T1553.004

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Credential Access

                                                Unsecured Credentials

                                                6
                                                T1552

                                                Credentials In Files

                                                5
                                                T1552.001

                                                Credentials in Registry

                                                1
                                                T1552.002

                                                Discovery

                                                Peripheral Device Discovery

                                                2
                                                T1120

                                                Query Registry

                                                9
                                                T1012

                                                Remote System Discovery

                                                1
                                                T1018

                                                System Information Discovery

                                                7
                                                T1082

                                                Virtualization/Sandbox Evasion

                                                2
                                                T1497

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                6
                                                T1005

                                                Command and Control

                                                Web Service

                                                1
                                                T1102

                                                Exfiltration

                                                Impact

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                Are.docx
                                                • Path C:\ProgramData\Are.docx
                                                • Size 11KB
                                                • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                mozglue.dll
                                                • Path C:\ProgramData\mozglue.dll
                                                • Size 593KB
                                                • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                powershell.exe.log
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                • Size 3KB
                                                • SHA256 7031b6b7bc43cf4ee90d4ec4860b78a442352243ea28f5d959b56222b13de2e4
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                edgecompatviewlist[1].xml
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BDNVZVVU\edgecompatviewlist[1].xml
                                                • Size 74KB
                                                • SHA256 853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                StartupProfileData-NonInteractive
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                • Size 1KB
                                                • SHA256 2bd39f1dea3fe0d2956f1ec7cb3980fb4d5d44f5e8fa2746827a9332cfcb3dd2
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                suggestions[1].en-US
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\BEK53733\suggestions[1].en-US
                                                • Size 17KB
                                                • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                favicon[1].ico
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\DEU1SN1B\favicon[1].ico
                                                • Size 5KB
                                                • SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                4Kv5U5b1o3f[1].png
                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\W7BGIAKO\4Kv5U5b1o3f[1].png
                                                • Size 610B
                                                • SHA256 2bc7a47889c56ad49f1b8b97385d5a4d212e79bb8a9b30df0665a165f58b273e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Size 1KB
                                                • SHA256 131c777ed9d52e3945245f4c17159eb1b636542d04705284173e893b264de187
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                • Size 4KB
                                                • SHA256 9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Size 724B
                                                • SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                F07644E38ED7C9F37D11EEC6D4335E02_9E23C1D3BC042F285396F92A9773D1F3
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_9E23C1D3BC042F285396F92A9773D1F3
                                                • Size 471B
                                                • SHA256 5ba7c9591a4e9014f7ceb6111b48db1a55fb333b693885a2be7f13ea4d92af79
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Size 410B
                                                • SHA256 4c8ae74259ca815d557f5466b4ac3d53e40a7bb535860978f81fcf2989dc34ad
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
                                                • Size 410B
                                                • SHA256 a745d9268ef523170f079653c03f70af718b230f28c080b2b9ce5249addac5fb
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                • Size 338B
                                                • SHA256 ce951f39f1f479d22bb6a25b3f2274c4b8e5dea56003fd9579884ccec72cce5e
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                • Size 338B
                                                • SHA256 f7279e2e261a28b9f5d019b680f09f7e422ee3737ea457baf2bedf1fb3a684d2
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Size 392B
                                                • SHA256 2471bff62f5ca62179282190313f0741a2b5810ad804aba290b4d0b12631348c
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Size 392B
                                                • SHA256 b4bb21e195601cf64c1b58433c35c9ba05643acc9bd5ac3425891cef6e120a94
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
                                                • Size 392B
                                                • SHA256 07eb95323ea4dfe196deb089692071866abce46e865357dab689d01b10cca5d5
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                F07644E38ED7C9F37D11EEC6D4335E02_9E23C1D3BC042F285396F92A9773D1F3
                                                • Path C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_9E23C1D3BC042F285396F92A9773D1F3
                                                • Size 406B
                                                • SHA256 b70d13c8b60e5f9716c25d08400199cb949b0722ac14ffdabb4d21270af959f5
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                SxpoQSreXtCBWJ2xWA4ZUMih.exe
                                                • Path C:\Users\Admin\AppData\Local\SxpoQSreXtCBWJ2xWA4ZUMih.exe
                                                • Size 4.2MB
                                                • SHA256 5cb7c6eafa1793471b5a6606b202256a5f207b8d870f19f2d53853eb91bc74e0
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                additional_file0.tmp
                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010448341\additional_file0.tmp
                                                • Size 2.5MB
                                                • SHA256 fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                opera_package
                                                • Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010448341\opera_package
                                                • Size 103.9MB
                                                • SHA256 f62f4ebc7eca46d9cddfb02cc0305da5efdd6f3601fb0f53da555e19558869a3
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                explorha.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
                                                • Size 1.9MB
                                                • SHA256 012ef7824ca1930a472c672ffca4c5ab7d332b13094adcaf2cac06bc3ad09905
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                e6b5d5cf9a.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000042001\e6b5d5cf9a.exe
                                                • Size 3.0MB
                                                • SHA256 a3011027eb8c7672f1d540ef4e5cb07542c5884beb3764cf2b1571e4274b5911
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                go.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
                                                • Size 894KB
                                                • SHA256 59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                amert.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
                                                • Size 1.8MB
                                                • SHA256 b1d107ad03eebe9dea02a53578c223f5af87dd4c81d1520bbb40c04ce326dd2e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Uni400uni.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe
                                                • Size 379KB
                                                • SHA256 b443e71c000e0750a88e821dfcc804c8357a5017c12fa3e71256c486d93c6362
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                alex1234.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
                                                • Size 1.7MB
                                                • SHA256 3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                amadka.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe
                                                • Size 1.8MB
                                                • SHA256 b88322cd121a87058ba3df1623d4a3dcca79f80b0b4f6e033eedca8f9854af8c
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                redlinepanel.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
                                                • Size 301KB
                                                • SHA256 2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                32456.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
                                                • Size 499KB
                                                • SHA256 09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                goldprimeldlldf.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
                                                • Size 464KB
                                                • SHA256 afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                NewB.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
                                                • Size 418KB
                                                • SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                swiiiii.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
                                                • Size 321KB
                                                • SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                koooooo.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
                                                • Size 379KB
                                                • SHA256 23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Opera_installer_2404010448327316680.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404010448327316680.dll
                                                • Size 4.6MB
                                                • SHA256 3c5b34de987116a4d3240e319c0da89a951c96b81e6705476a0fea27b22b20af
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Tmp4E4A.tmp
                                                • Path C:\Users\Admin\AppData\Local\Temp\Tmp4E4A.tmp
                                                • Size 2KB
                                                • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                __PSScriptPolicyTest_mddqh3wj.zhz.ps1
                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mddqh3wj.zhz.ps1
                                                • Size 1B
                                                • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                ioloDMLog.txt
                                                • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                • Size 2KB
                                                • SHA256 f0b2a2e9de524f3c3545919f0a44dc8488fbdf0b54503de2ee4306c8dc646868
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                ioloDMLog.txt
                                                • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                                • Size 3KB
                                                • SHA256 1066662ef849fcb58accae3b06b7b3d2cd7f8e07f030c206e9e92ec641540f58
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                tmp6F70.tmp
                                                • Path C:\Users\Admin\AppData\Local\Temp\tmp6F70.tmp
                                                • Size 46KB
                                                • SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                clip64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                • Size 109KB
                                                • SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                cred64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                • Size 1.2MB
                                                • SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                clip64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
                                                • Size 109KB
                                                • SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                cred64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
                                                • Size 1.2MB
                                                • SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Traffic.exe
                                                • Path C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
                                                • Size 541KB
                                                • SHA256 f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                propro.exe
                                                • Path C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
                                                • Size 304KB
                                                • SHA256 bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                89W4ytdOnxP23WHa9s71TyFP.exe
                                                • Path C:\Users\Admin\Pictures\89W4ytdOnxP23WHa9s71TyFP.exe
                                                • Size 3KB
                                                • SHA256 c1429667bcd9715f08205931b0d5f66dfad084082062eec63f3397394c387b9a
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                9tpTCKB0thJzMCx8KWWFDCvN.exe
                                                • Path C:\Users\Admin\Pictures\9tpTCKB0thJzMCx8KWWFDCvN.exe
                                                • Size 3KB
                                                • SHA256 b9aebe5a68611b28ba47549ff5c2e9f20c0b875ad7a7d72d99d503e2e77e64c8
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                Wg95dKzcxJwSTrfoxtk7afpT.exe
                                                • Path C:\Users\Admin\Pictures\Wg95dKzcxJwSTrfoxtk7afpT.exe
                                                • Size 7KB
                                                • SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                ks3p1lBUP3NP8CeowxTuPFRZ.exe
                                                • Path C:\Users\Admin\Pictures\ks3p1lBUP3NP8CeowxTuPFRZ.exe
                                                • Size 410KB
                                                • SHA256 b2ff9214454fd3dcbf4da911620982c737247e78b47367d68f0cc2e973e48930
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                tTIPaI6X8QNZusmUCpab1Rrq.exe
                                                • Path C:\Users\Admin\Pictures\tTIPaI6X8QNZusmUCpab1Rrq.exe
                                                • Size 5.1MB
                                                • SHA256 2d29c6925d24a7341ad2699bdfb8beb5cb7ad1ca96a94bd15969cb88e904f6d7
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                gpt.ini
                                                • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                • Size 127B
                                                • SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                memory/496-6-0x0000000004B20000-0x0000000004B21000-memory.dmp
                                                Download

                                                memory/496-8-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
                                                Download

                                                memory/496-9-0x0000000004B10000-0x0000000004B11000-memory.dmp
                                                Download

                                                memory/496-19-0x00000000011E0000-0x00000000016BE000-memory.dmp
                                                Download

                                                memory/496-10-0x0000000004B40000-0x0000000004B41000-memory.dmp
                                                Download

                                                memory/496-7-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
                                                Download

                                                memory/496-3-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
                                                Download

                                                memory/496-5-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
                                                Download

                                                memory/496-4-0x0000000004B00000-0x0000000004B01000-memory.dmp
                                                Download

                                                memory/496-2-0x00000000011E0000-0x00000000016BE000-memory.dmp
                                                Download

                                                memory/496-1-0x0000000077D74000-0x0000000077D75000-memory.dmp
                                                Download

                                                memory/496-12-0x0000000004B30000-0x0000000004B31000-memory.dmp
                                                Download

                                                memory/496-0-0x00000000011E0000-0x00000000016BE000-memory.dmp
                                                Download

                                                memory/1536-60-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-73-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-46-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-95-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-50-0x0000000001310000-0x00000000017EE000-memory.dmp
                                                Download

                                                memory/1536-49-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-51-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-52-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-53-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-89-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-91-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-87-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-54-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-55-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-56-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-57-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-58-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-86-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-59-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-61-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-62-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-63-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-64-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-65-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-66-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-67-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-69-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-70-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-679-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-72-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-651-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-71-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-68-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-84-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-75-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/1536-74-0x0000000000400000-0x00000000007BA000-memory.dmp
                                                Download

                                                memory/2004-720-0x0000000001310000-0x00000000017EE000-memory.dmp
                                                Download

                                                memory/2004-735-0x0000000004E20000-0x0000000004E21000-memory.dmp
                                                Download

                                                memory/2004-741-0x0000000004E10000-0x0000000004E11000-memory.dmp
                                                Download

                                                memory/2004-743-0x0000000004E00000-0x0000000004E01000-memory.dmp
                                                Download

                                                memory/2004-739-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
                                                Download

                                                memory/2004-737-0x0000000004E50000-0x0000000004E51000-memory.dmp
                                                Download

                                                memory/2004-732-0x0000000004E30000-0x0000000004E31000-memory.dmp
                                                Download

                                                memory/2004-731-0x0000000001310000-0x00000000017EE000-memory.dmp
                                                Download

                                                memory/2380-746-0x0000000004950000-0x0000000004951000-memory.dmp
                                                Download

                                                memory/2380-744-0x00000000011E0000-0x000000000168E000-memory.dmp
                                                Download

                                                memory/2380-722-0x00000000011E0000-0x000000000168E000-memory.dmp
                                                Download

                                                memory/2548-96-0x00000233A2820000-0x00000233A2830000-memory.dmp
                                                Download

                                                memory/2548-112-0x00000233A3000000-0x00000233A3010000-memory.dmp
                                                Download

                                                memory/3532-27-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
                                                Download

                                                memory/3532-28-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
                                                Download

                                                memory/3532-24-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
                                                Download

                                                memory/3532-23-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
                                                Download

                                                memory/3532-25-0x0000000004B10000-0x0000000004B11000-memory.dmp
                                                Download

                                                memory/3532-92-0x0000000001310000-0x00000000017EE000-memory.dmp
                                                Download

                                                memory/3532-22-0x0000000001310000-0x00000000017EE000-memory.dmp
                                                Download

                                                memory/3532-26-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
                                                Download

                                                memory/3532-21-0x0000000001310000-0x00000000017EE000-memory.dmp
                                                Download

                                                memory/3532-199-0x0000000001310000-0x00000000017EE000-memory.dmp
                                                Download

                                                memory/3532-29-0x0000000004B40000-0x0000000004B41000-memory.dmp
                                                Download

                                                memory/3532-30-0x0000000004B30000-0x0000000004B31000-memory.dmp
                                                Download

                                                memory/3532-93-0x0000000001310000-0x00000000017EE000-memory.dmp
                                                Download

                                                memory/4944-45-0x0000000000C30000-0x0000000000FEA000-memory.dmp
                                                Download

                                                memory/4944-43-0x0000000000C30000-0x0000000000FEA000-memory.dmp
                                                Download

                                                memory/4944-285-0x0000000000C30000-0x0000000000FEA000-memory.dmp
                                                Download

                                                memory/5160-246-0x0000000004950000-0x0000000004951000-memory.dmp
                                                Download

                                                memory/5160-244-0x0000000004940000-0x0000000004941000-memory.dmp
                                                Download

                                                memory/5160-289-0x00000000049C0000-0x00000000049C1000-memory.dmp
                                                Download

                                                memory/5160-312-0x00000000049B0000-0x00000000049B1000-memory.dmp
                                                Download

                                                memory/5160-345-0x0000000000C50000-0x00000000010FE000-memory.dmp
                                                Download

                                                memory/5160-194-0x0000000000C50000-0x00000000010FE000-memory.dmp
                                                Download

                                                memory/5160-247-0x0000000004990000-0x0000000004991000-memory.dmp
                                                Download

                                                memory/5160-220-0x0000000000C50000-0x00000000010FE000-memory.dmp
                                                Download

                                                memory/5160-242-0x00000000049A0000-0x00000000049A1000-memory.dmp
                                                Download

                                                memory/5160-226-0x0000000004970000-0x0000000004971000-memory.dmp
                                                Download

                                                memory/5160-239-0x0000000004960000-0x0000000004961000-memory.dmp
                                                Download

                                                memory/5160-237-0x0000000004980000-0x0000000004981000-memory.dmp
                                                Download

                                                memory/5168-217-0x0000016A5EAE0000-0x0000016A5EB56000-memory.dmp
                                                Download

                                                memory/5168-403-0x00007FF989660000-0x00007FF98A04C000-memory.dmp
                                                Download

                                                memory/5168-213-0x0000016A5E9D0000-0x0000016A5E9E0000-memory.dmp
                                                Download

                                                memory/5168-273-0x0000016A5E9D0000-0x0000016A5E9E0000-memory.dmp
                                                Download

                                                memory/5168-381-0x0000016A467F0000-0x0000016A467FA000-memory.dmp
                                                Download

                                                memory/5168-207-0x0000016A467A0000-0x0000016A467C2000-memory.dmp
                                                Download

                                                memory/5168-344-0x0000016A5E990000-0x0000016A5E9A2000-memory.dmp
                                                Download

                                                memory/5168-203-0x00007FF989660000-0x00007FF98A04C000-memory.dmp
                                                Download

                                                memory/5168-208-0x0000016A5E9D0000-0x0000016A5E9E0000-memory.dmp
                                                Download