Analysis
- max time kernel
97s - max time network
305s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
01/04/2024, 05:03
General
- Target a337325ce0a5b9b9fd7ea72db131fb17f7e2b18989369e95132e5fd1812bbc99.exe
- Size 1.8MB
- Sample240401-fpre1aef48
- SHA256 a337325ce0a5b9b9fd7ea72db131fb17f7e2b18989369e95132e5fd1812bbc99
Malware Config
Extracted
-
amadey
-
4.18
-
http://193.233.132.56
-
install_dir
09fd851a4f
-
install_file
explorha.exe
-
strings_key
443351145ece4966ded809641c77cfa8
-
url_paths
/Pneh2sXQk0/index.php
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
@OLEH_PSP
-
185.172.128.33:8970
Extracted
-
lumma
-
https://affordcharmcropwo.shop/api
-
https://enthusiasimtitleow.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 3 IoCs
- Detected google phishing page
- Djvu Ransomware
Ransomware which is a variant of the STOP family.
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 4 IoCs
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
- Blocklisted process makes network request 4 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 4 IoCs
- Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 29 IoCs
- Identifies Wine through registry keys 2 TTPs 9 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 8 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Drops file in Windows directory 11 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 16 IoCs
- Suspicious use of AdjustPrivilegeToken 63 IoCs
- Suspicious use of FindShellTrayWindow 18 IoCs
- Suspicious use of SendNotifyMessage 17 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a337325ce0a5b9b9fd7ea72db131fb17f7e2b18989369e95132e5fd1812bbc99.exe"C:\Users\Admin\AppData\Local\Temp\a337325ce0a5b9b9fd7ea72db131fb17f7e2b18989369e95132e5fd1812bbc99.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000042001\b5d4799470.exe"C:\Users\Admin\AppData\Local\Temp\1000042001\b5d4799470.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
-
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
-
-
C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles5⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\855258223215_Desktop.zip' -CompressionLevel Optimal5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
-
-
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"C:\Users\Admin\AppData\Local\Temp\1001031001\amadka.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\855258223215_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe"C:\Users\Admin\AppData\Local\Temp\1000180001\ISetup8.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u5as.0.exe"C:\Users\Admin\AppData\Local\Temp\u5as.0.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\KEHDHIDAEH.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\KEHDHIDAEH.exe"C:\Users\Admin\AppData\Local\Temp\KEHDHIDAEH.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\KEHDHIDAEH.exe7⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30008⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\u5as.1.exe"C:\Users\Admin\AppData\Local\Temp\u5as.1.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD15⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\toolspub1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"C:\Users\Admin\AppData\Local\Temp\1000182001\4767d2e713f2021e8fe856e3ea638b58.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe"C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\aaIfVEjHMx6fBVG1v7niDeXP.exe"C:\Users\Admin\Pictures\aaIfVEjHMx6fBVG1v7niDeXP.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u438.0.exe"C:\Users\Admin\AppData\Local\Temp\u438.0.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\u438.1.exe"C:\Users\Admin\AppData\Local\Temp\u438.1.exe"6⤵
-
-
-
C:\Users\Admin\Pictures\5h5F7M1aSzNMtwWupIZwrbaZ.exe"C:\Users\Admin\Pictures\5h5F7M1aSzNMtwWupIZwrbaZ.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\5h5F7M1aSzNMtwWupIZwrbaZ.exe"C:\Users\Admin\Pictures\5h5F7M1aSzNMtwWupIZwrbaZ.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"7⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes8⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
-
-
C:\Users\Admin\Pictures\JitKIkbVkxqcsLQ4Fg4GDsth.exe"C:\Users\Admin\Pictures\JitKIkbVkxqcsLQ4Fg4GDsth.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\JitKIkbVkxqcsLQ4Fg4GDsth.exe"C:\Users\Admin\Pictures\JitKIkbVkxqcsLQ4Fg4GDsth.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"7⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes8⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F8⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f8⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile8⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll8⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F8⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)10⤵
- Launches sc.exe
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\LYB1CZt777zTtS2U5h0dF8O4.exe"C:\Users\Admin\Pictures\LYB1CZt777zTtS2U5h0dF8O4.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Users\Admin\Pictures\LYB1CZt777zTtS2U5h0dF8O4.exe"C:\Users\Admin\Pictures\LYB1CZt777zTtS2U5h0dF8O4.exe"6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"7⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes8⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
-
-
C:\Users\Admin\Pictures\Ja93i5iZ8E6IOcH8hz30aTEL.exe"C:\Users\Admin\Pictures\Ja93i5iZ8E6IOcH8hz30aTEL.exe"5⤵
-
-
C:\Users\Admin\Pictures\LpRGMxzQ1HgkoUs4tq67HlwX.exe"C:\Users\Admin\Pictures\LpRGMxzQ1HgkoUs4tq67HlwX.exe" --silent --allusers=05⤵
-
C:\Users\Admin\Pictures\LpRGMxzQ1HgkoUs4tq67HlwX.exeC:\Users\Admin\Pictures\LpRGMxzQ1HgkoUs4tq67HlwX.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6d5ce1d0,0x6d5ce1dc,0x6d5ce1e86⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\LpRGMxzQ1HgkoUs4tq67HlwX.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\LpRGMxzQ1HgkoUs4tq67HlwX.exe" --version6⤵
-
-
C:\Users\Admin\Pictures\LpRGMxzQ1HgkoUs4tq67HlwX.exe"C:\Users\Admin\Pictures\LpRGMxzQ1HgkoUs4tq67HlwX.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=7924 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240401050502" --session-guid=f2e872cf-539d-4552-b787-f1e8c6eb2165 --server-tracking-blob=ZDQ4NTNmOTE3YzIwMjYyMGZmMmZmYzVlMWQ3YmU0ZTQwZTk0OTI0MDEyZDM1MTIwZGYyNTZkYTI4N2UyZjNjNjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N18xMjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTE5NDc4ODAuMjQwMSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N18xMjMiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImQzZWIwMGNlLWViMzEtNDhkOS04NzVmLWFhNjFlOTE5OTA4NiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=48040000000000006⤵
-
C:\Users\Admin\Pictures\LpRGMxzQ1HgkoUs4tq67HlwX.exeC:\Users\Admin\Pictures\LpRGMxzQ1HgkoUs4tq67HlwX.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2ac,0x2b0,0x2b4,0x27c,0x2b8,0x6e26e1d0,0x6e26e1dc,0x6e26e1e87⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010505021\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010505021\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010505021\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010505021\assistant\assistant_installer.exe" --version6⤵
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010505021\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404010505021\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x24c,0x250,0x254,0x228,0xac,0x250040,0x25004c,0x2500587⤵
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6856 -s 8123⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5680 -s 7843⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D807.bat" "1⤵
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\F45A.exeC:\Users\Admin\AppData\Local\Temp\F45A.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F45A.exeC:\Users\Admin\AppData\Local\Temp\F45A.exe2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\033cc0e2-d327-4824-a46a-d7a2e8cbc395" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\F45A.exe"C:\Users\Admin\AppData\Local\Temp\F45A.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\F45A.exe"C:\Users\Admin\AppData\Local\Temp\F45A.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\b057325c-0721-4f58-b1b4-24fd6e7bdcdd\build2.exe"C:\Users\Admin\AppData\Local\b057325c-0721-4f58-b1b4-24fd6e7bdcdd\build2.exe"5⤵
-
C:\Users\Admin\AppData\Local\b057325c-0721-4f58-b1b4-24fd6e7bdcdd\build2.exe"C:\Users\Admin\AppData\Local\b057325c-0721-4f58-b1b4-24fd6e7bdcdd\build2.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\b057325c-0721-4f58-b1b4-24fd6e7bdcdd\build3.exe"C:\Users\Admin\AppData\Local\b057325c-0721-4f58-b1b4-24fd6e7bdcdd\build3.exe"5⤵
-
C:\Users\Admin\AppData\Local\b057325c-0721-4f58-b1b4-24fd6e7bdcdd\build3.exe"C:\Users\Admin\AppData\Local\b057325c-0721-4f58-b1b4-24fd6e7bdcdd\build3.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20240401-0506.dm1⤵
-
C:\Users\Admin\AppData\Local\Temp\E3DB.exeC:\Users\Admin\AppData\Local\Temp\E3DB.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\E880.bat" "1⤵
-
C:\Windows\system32\reg.exereg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\28B6.exeC:\Users\Admin\AppData\Local\Temp\28B6.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\28B6.exe"C:\Users\Admin\AppData\Local\Temp\28B6.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
6Credentials In Files
5Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
powershell.exe.log
edgecompatviewlist[1].xml
StartupProfileData-NonInteractive
4Kv5U5b1o3f[1].png
favicon[1].png
favicon[1].ico
suggestions[1].en-US
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
F07644E38ED7C9F37D11EEC6D4335E02_9E23C1D3BC042F285396F92A9773D1F3
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
F07644E38ED7C9F37D11EEC6D4335E02_9E23C1D3BC042F285396F92A9773D1F3
additional_file0.tmp
opera_package
explorha.exe
b5d4799470.exe
go.exe
amert.exe
ISetup8.exe
toolspub1.exe
4767d2e713f2021e8fe856e3ea638b58.exe
Uni400uni.exe
alex1234.exe
amadka.exe
redlinepanel.exe
32456.exe
goldprimeldlldf.exe
NewB.exe
swiiiii.exe
koooooo.exe
E880.bat
Opera_installer_2404010505020607080.dll
Tmp6F6E.tmp
__PSScriptPolicyTest_lvu3uvb5.fp2.ps1
ioloDMLog.txt
ioloDMLog.txt
tmp93F0.tmp
u5as.0.exe
u5as.1.exe
clip64.dll
cred64.dll
76b53b3ec448f7ccdda2063b15d2bfc3_79899b72-a055-47ba-802f-25b72175480c
mstsca.exe
clip64.dll
cred64.dll
Traffic.exe
propro.exe
9CtiMuwjnY6oNBEYFG8buKhq.exe
9jaQoYWijxRCSQ801ovsqlYO.exe
LpRGMxzQ1HgkoUs4tq67HlwX.exe
daaeY72UFfaSMqKLQaGkhlrd.exe
Google Chrome.lnk
gpt.ini
memory/340-185-0x000002427D4A0000-0x000002427D4B0000-memory.dmp
memory/340-232-0x000002427D4A0000-0x000002427D4B0000-memory.dmp
memory/340-180-0x00007FFF3A280000-0x00007FFF3AC6C000-memory.dmp
memory/340-192-0x000002427D730000-0x000002427D7A6000-memory.dmp
memory/340-188-0x000002427D430000-0x000002427D452000-memory.dmp
memory/340-262-0x000002427D6F0000-0x000002427D702000-memory.dmp
memory/340-183-0x000002427D4A0000-0x000002427D4B0000-memory.dmp
memory/340-280-0x000002427D490000-0x000002427D49A000-memory.dmp
memory/340-309-0x00007FFF3A280000-0x00007FFF3AC6C000-memory.dmp
memory/3712-97-0x000001F04EC20000-0x000001F04EC30000-memory.dmp
memory/3712-121-0x000001F04FE00000-0x000001F04FE10000-memory.dmp
memory/3860-170-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/3860-171-0x00000000055E0000-0x00000000055E1000-memory.dmp
memory/3860-130-0x0000000000D90000-0x0000000001255000-memory.dmp
memory/3860-176-0x0000000000D90000-0x0000000001255000-memory.dmp
memory/3860-159-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/3860-160-0x0000000005590000-0x0000000005591000-memory.dmp
memory/3860-161-0x00000000055C0000-0x00000000055C1000-memory.dmp
memory/3860-162-0x0000000005560000-0x0000000005561000-memory.dmp
memory/3860-158-0x0000000000D90000-0x0000000001255000-memory.dmp
memory/3860-163-0x0000000005580000-0x0000000005581000-memory.dmp
memory/3860-164-0x0000000005570000-0x0000000005571000-memory.dmp
memory/4104-0-0x0000000000DF0000-0x00000000012AE000-memory.dmp
memory/4104-7-0x0000000005130000-0x0000000005131000-memory.dmp
memory/4104-19-0x0000000000DF0000-0x00000000012AE000-memory.dmp
memory/4104-11-0x00000000051A0000-0x00000000051A1000-memory.dmp
memory/4104-10-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/4104-9-0x0000000005180000-0x0000000005181000-memory.dmp
memory/4104-2-0x0000000000DF0000-0x00000000012AE000-memory.dmp
memory/4104-3-0x0000000005160000-0x0000000005161000-memory.dmp
memory/4104-4-0x0000000005170000-0x0000000005171000-memory.dmp
memory/4104-5-0x0000000005150000-0x0000000005151000-memory.dmp
memory/4104-8-0x0000000005140000-0x0000000005141000-memory.dmp
memory/4104-6-0x0000000005190000-0x0000000005191000-memory.dmp
memory/4104-1-0x00000000779D4000-0x00000000779D5000-memory.dmp
memory/4360-230-0x0000000001030000-0x00000000013E5000-memory.dmp
memory/4360-46-0x0000000001030000-0x00000000013E5000-memory.dmp
memory/4360-95-0x0000000001030000-0x00000000013E5000-memory.dmp
memory/4360-182-0x0000000001030000-0x00000000013E5000-memory.dmp
memory/4360-44-0x0000000001030000-0x00000000013E5000-memory.dmp
memory/4860-24-0x0000000004AB0000-0x0000000004AB1000-memory.dmp
memory/4860-21-0x0000000000A20000-0x0000000000EDE000-memory.dmp
memory/4860-22-0x0000000000A20000-0x0000000000EDE000-memory.dmp
memory/4860-23-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/4860-152-0x0000000000A20000-0x0000000000EDE000-memory.dmp
memory/4860-26-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
memory/4860-25-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/4860-27-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/4860-28-0x0000000004A80000-0x0000000004A81000-memory.dmp
memory/4860-29-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
memory/4860-30-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/4860-31-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/4860-94-0x0000000000A20000-0x0000000000EDE000-memory.dmp
memory/5108-88-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-81-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-96-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-93-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-92-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-90-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-73-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-71-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-70-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-69-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-68-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-67-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-61-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-57-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-56-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-55-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-54-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-53-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-52-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-51-0x0000000000A20000-0x0000000000EDE000-memory.dmp
memory/5108-50-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-47-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-91-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-89-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-87-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-86-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-85-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-84-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-662-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-658-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-77-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-80-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-78-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-75-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-83-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5108-82-0x0000000000400000-0x00000000007B5000-memory.dmp
memory/5156-684-0x0000000000A20000-0x0000000000EDE000-memory.dmp
memory/5156-689-0x0000000000A20000-0x0000000000EDE000-memory.dmp
memory/5156-690-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/5156-691-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/5156-692-0x0000000004B90000-0x0000000004B91000-memory.dmp
memory/5156-694-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/5156-693-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/5156-695-0x0000000004B80000-0x0000000004B81000-memory.dmp
memory/5156-696-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
memory/5184-697-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
memory/5184-685-0x0000000000140000-0x0000000000605000-memory.dmp