amadey | b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a

Analysis

max time kernel
300s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22/04/2024, 05:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
Size 2.9MB
Sample240422-ghvdragf4t
SHA256 b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a
MD5 3c4127b40346e1bfcc2df12b027d120a
SHA1 0f9a40b9aa9035c09153a9a47135425ea1250bd4
SHA512 92d22cf914b9c5c8c5448bb5df97bec499d028d051ce3018f81181ac624a2311c29531d446d40a2ae846294c0b5aab8a3d956bcf7354dd1c30d201d83aa00209
SSDEEP 49152:dj7FAVCDcnMoUZtuDRTqVp9mN3W5B/bs7qLuL:d1AVCDcnMoUZtuDqkiB/CL
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

install_dir
4d0ab15804
install_file
chrosha.exe
strings_key
1a9519d7b465e1f4880fa09a6162d768
url_paths
/enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

@OLEH_PSP

185.172.128.33:8970

Extracted

Family

redline

Botnet

LiveTraffic

4.184.225.183:30592

Extracted

Family

stealc

http://52.143.157.84

Attributes

url_path
/c73eed764cc59dcb.php

Extracted

Family

lumma

https://affordcharmcropwo.shop/api
https://cleartotalfisherwo.shop/api
https://worryfillvolcawoi.shop/api
https://enthusiasimtitleow.shop/api
https://dismissalcylinderhostw.shop/api
https://diskretainvigorousiw.shop/api
https://communicationgenerwo.shop/api
https://pillowbrocccolipe.shop/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001ac3e-433.dat	family_zgrat_v1

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	AppGate2103v01_16.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/files/0x000700000001ac4b-460.dat	family_redline
behavioral2/files/0x000700000001ac4a-462.dat	family_redline
behavioral2/memory/4432-529-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral2/files/0x000700000001ac5a-593.dat	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Uni400uni.exe

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4767d2e713f2021e8fe856e3ea638b58.exe = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	4767d2e713f2021e8fe856e3ea638b58.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 12 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	83495a94e8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	AppGate2103v01_16.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe

Blocklisted process makes network request 6 IoCs

flow	pid	Process
40	5084	rundll32.exe
45	5936	rundll32.exe
133	2304	rundll32.exe
145	4232	rundll32.exe
45	5936	rundll32.exe
145	4232	rundll32.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
6308	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	83495a94e8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	83495a94e8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	AppGate2103v01_16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	AppGate2103v01_16.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe

Executes dropped EXE 40 IoCs

pid	Process
716	explorha.exe
1976	1854307fae.exe
60	83495a94e8.exe
3412	explorha.exe
2856	explorha.exe
5288	amert.exe
5580	explorha.exe
2212	chrosha.exe
5412	swiiiii.exe
5928	alexxxxxxxx.exe
6136	Traffic.exe
6108	propro.exe
5460	gold.exe
5356	NewB.exe
6016	ISetup8.exe
1468	jok.exe
3632	swiiii.exe
5564	toolspub1.exe
5864	file300un.exe
236	u4n4.0.exe
1448	Qg_Appv5.exe
4224	4767d2e713f2021e8fe856e3ea638b58.exe
3872	u4n4.1.exe
5148	FirstZ.exe
5872	ptInst.exe
3084	Uni400uni.exe
4928	ptInst.exe
5836	AppGate2103v01_16.exe
6360	4767d2e713f2021e8fe856e3ea638b58.exe
3476	reakuqnanrkn.exe
6016	csrss.exe
7008	explorha.exe
7124	NewB.exe
640	injector.exe
1824	windefender.exe
6256	windefender.exe
6516	explorha.exe
3068	NewB.exe
6964	explorha.exe
6868	NewB.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	83495a94e8.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	chrosha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Wine	explorha.exe

Loads dropped DLL 14 IoCs

pid	Process
4544	rundll32.exe
5084	rundll32.exe
5936	rundll32.exe
5448	rundll32.exe
2304	rundll32.exe
2028	RegAsm.exe
5872	ptInst.exe
5872	ptInst.exe
5872	ptInst.exe
2028	RegAsm.exe
4928	ptInst.exe
4928	ptInst.exe
4928	ptInst.exe
4232	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000700000001aca0-1011.dat	themida

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4767d2e713f2021e8fe856e3ea638b58.exe = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	4767d2e713f2021e8fe856e3ea638b58.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\1854307fae.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000055001\\1854307fae.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\83495a94e8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000056001\\83495a94e8.exe"	explorha.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Uni400uni.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Uni400uni.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AppGate2103v01_16.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
144	pastebin.com
177	pastebin.com
178	pastebin.com
128	pastebin.com
130	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
154	api.myip.com
155	ipinfo.io
156	ipinfo.io
153	api.myip.com

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000001ac15-34.dat	autoit_exe

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	AppGate2103v01_16.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	FirstZ.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	AppGate2103v01_16.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	AppGate2103v01_16.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	AppGate2103v01_16.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	reakuqnanrkn.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
2520	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
716	explorha.exe
60	83495a94e8.exe
3412	explorha.exe
2856	explorha.exe
5288	amert.exe
5580	explorha.exe
2212	chrosha.exe
5836	AppGate2103v01_16.exe
7008	explorha.exe
6516	explorha.exe
6964	explorha.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 716 set thread context of 2856	716	explorha.exe	95
PID 5412 set thread context of 3768	5412	swiiiii.exe	110
PID 5928 set thread context of 2156	5928	alexxxxxxxx.exe	116
PID 5460 set thread context of 4432	5460	gold.exe	123
PID 3632 set thread context of 2028	3632	swiiii.exe	132
PID 5864 set thread context of 5100	5864	file300un.exe	142
PID 3084 set thread context of 3176	3084	Uni400uni.exe	158
PID 4928 set thread context of 2056	4928	ptInst.exe	152
PID 2056 set thread context of 4220	2056	cmd.exe	177
PID 3476 set thread context of 2228	3476	reakuqnanrkn.exe	240
PID 3476 set thread context of 7044	3476	reakuqnanrkn.exe	245

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	4767d2e713f2021e8fe856e3ea638b58.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File created	C:\Windows\Tasks\explorha.job	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
File created	C:\Windows\Tasks\chrosha.job	amert.exe
File opened for modification	C:\Windows\rss	4767d2e713f2021e8fe856e3ea638b58.exe
File created	C:\Windows\rss\csrss.exe	4767d2e713f2021e8fe856e3ea638b58.exe

Launches sc.exe 15 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2980	sc.exe
6856	sc.exe
6064	sc.exe
2664	sc.exe
6308	sc.exe
7036	sc.exe
6900	sc.exe
6964	sc.exe
5036	sc.exe
7028	sc.exe
5080	sc.exe
6260	sc.exe
1044	sc.exe
6852	sc.exe
5896	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5848	5412	WerFault.exe	108
5560	5564	WerFault.exe	133

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u4n4.1.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u4n4.1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	u4n4.1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1628	schtasks.exe
1452	schtasks.exe
1308	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time"	windefender.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	4767d2e713f2021e8fe856e3ea638b58.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time"	windefender.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	propro.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	propro.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2520	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
2520	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
716	explorha.exe
716	explorha.exe
1636	chrome.exe
1636	chrome.exe
60	83495a94e8.exe
60	83495a94e8.exe
3412	explorha.exe
3412	explorha.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
5084	rundll32.exe
2860	powershell.exe
2860	powershell.exe
2856	explorha.exe
2856	explorha.exe
2860	powershell.exe
5288	amert.exe
5288	amert.exe
2860	powershell.exe
1636	chrome.exe
1636	chrome.exe
5580	explorha.exe
5580	explorha.exe
2212	chrosha.exe
2212	chrosha.exe
2028	RegAsm.exe
2028	RegAsm.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
2304	rundll32.exe
1448	Qg_Appv5.exe
1448	Qg_Appv5.exe
1468	jok.exe
1468	jok.exe
1448	Qg_Appv5.exe
6136	Traffic.exe
6136	Traffic.exe
4432	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe
4432	RegAsm.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4928	ptInst.exe
2056	cmd.exe
2056	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe
Token: SeCreatePagefilePrivilege	1636	chrome.exe
Token: SeShutdownPrivilege	1636	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1976	1854307fae.exe
1976	1854307fae.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1976	1854307fae.exe
1976	1854307fae.exe
1636	chrome.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
3872	u4n4.1.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1976	1854307fae.exe
1976	1854307fae.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1636	chrome.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
1976	1854307fae.exe
3872	u4n4.1.exe
3872	u4n4.1.exe
3872	u4n4.1.exe
3872	u4n4.1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 716	2520	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe	73
PID 2520 wrote to memory of 716	2520	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe	73
PID 2520 wrote to memory of 716	2520	b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe	73
PID 716 wrote to memory of 1976	716	explorha.exe	74
PID 716 wrote to memory of 1976	716	explorha.exe	74
PID 716 wrote to memory of 1976	716	explorha.exe	74
PID 1976 wrote to memory of 1636	1976	1854307fae.exe	75
PID 1976 wrote to memory of 1636	1976	1854307fae.exe	75
PID 1636 wrote to memory of 2260	1636	chrome.exe	77
PID 1636 wrote to memory of 2260	1636	chrome.exe	77
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 2164	1636	chrome.exe	79
PID 1636 wrote to memory of 3068	1636	chrome.exe	80
PID 1636 wrote to memory of 3068	1636	chrome.exe	80
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81
PID 1636 wrote to memory of 4168	1636	chrome.exe	81

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Uni400uni.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe
"C:\Users\Admin\AppData\Local\Temp\b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Users\Admin\AppData\Local\Temp\1000055001\1854307fae.exe
    "C:\Users\Admin\AppData\Local\Temp\1000055001\1854307fae.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fff12d89758,0x7fff12d89768,0x7fff12d89778
        5⤵
        
        PID:2260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1360 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:2
        5⤵
        
        PID:2164
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1816 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:8
        5⤵
        
        PID:3068
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2084 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:8
        5⤵
        
        PID:4168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:1
        5⤵
        
        PID:1000
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:1
        5⤵
        
        PID:3808
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4404 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:1
        5⤵
        
        PID:4676
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3276 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:1
        5⤵
        
        PID:2364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4636 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:8
        5⤵
        
        PID:4688
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:8
        5⤵
        
        PID:2536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:8
        5⤵
        
        PID:2584
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:8
        5⤵
        
        PID:2212
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5260 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:8
        5⤵
        
        PID:4392
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:8
        5⤵
        
        PID:6096
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1868,i,5845572995340213799,12204783848993598240,131072 /prefetch:8
        5⤵
        
        PID:6104
- - C:\Users\Admin\AppData\Local\Temp\1000056001\83495a94e8.exe
    "C:\Users\Admin\AppData\Local\Temp\1000056001\83495a94e8.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:60
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:2856
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    PID:4544
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:5084
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:1452
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\968772205171_Desktop.zip' -CompressionLevel Optimal
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
- - C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:5288
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:5936

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1220

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3412

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5580

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2212
- C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5412
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 828
    3⤵
    - Program crash
    PID:5848
- C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5928
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2952
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      PID:6108
  - - C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6136
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:6964
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:7028
- C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
  "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5460
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4432
- C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
  2⤵
  - Executes dropped EXE
  PID:5356
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe
    "C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe"
    3⤵
    - Executes dropped EXE
    PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\u4n4.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u4n4.0.exe"
      4⤵
      Executes dropped EXE
      PID:236
  - - C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe
      "C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1448
    - - C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe
        
        C:\Users\Admin\AppData\Local\Temp\Uninstallcheck_alpha\ptInst.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5872
      - C:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exe
        
        C:\Users\Admin\AppData\Roaming\Uninstallcheck_alpha\ptInst.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:4928
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        7⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        
        PID:2056
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        8⤵
        
        PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\u4n4.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u4n4.1.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        5⤵
        
        PID:788
- - C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:5564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 496
      4⤵
      Program crash
      PID:5560
- - C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe
    "C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"
    3⤵
    - Executes dropped EXE
    PID:4224
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe
      "C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      PID:6360
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:3820
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4736
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:6308
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:6220
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5284
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        
        PID:6016
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:7012
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1452
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:4672
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5864
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        
        PID:640
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:1308
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        Executes dropped EXE
        
        PID:1824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:2664
- - C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe
    "C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:5148
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      PID:5232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:6280
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2380
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:6308
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:1044
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:5036
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:2980
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:5896
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      PID:6600
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      PID:6620
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      PID:7032
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      PID:7036
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "WSNKISKT"
      4⤵
      Launches sc.exe
      PID:7028
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "WSNKISKT" binpath= "C:\ProgramData\wikombernizc\reakuqnanrkn.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:5080
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:6852
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "WSNKISKT"
      4⤵
      Launches sc.exe
      PID:6856
- - C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe
    "C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe"
    3⤵
    - UAC bypass
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - System policy modification
    PID:3084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe" -Force
      4⤵
      PID:5380
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:3968
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:3176
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
      4⤵
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe
    "C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe"
    3⤵
    - Modifies firewall policy service
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:5836
- C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
  "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1468
- C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3632
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2028
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:5448
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2304
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:6028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\968772205171_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:5464
- C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5864
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
    3⤵
    PID:5100
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:4232

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:6488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:6496

C:\ProgramData\wikombernizc\reakuqnanrkn.exe
C:\ProgramData\wikombernizc\reakuqnanrkn.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
PID:3476
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:6132
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5404
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:6260
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:6964
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:7036
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:6900
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:6064
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  PID:5244
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  PID:6120
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  PID:6108
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  PID:6188
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:2228
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:7044

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:7008

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
- Executes dropped EXE
PID:7124

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6256

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6516

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
- Executes dropped EXE
PID:3068

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6964

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
- Executes dropped EXE
PID:6868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 d9654bf89b758a00056798e4f44c9877c26bf3322c122221b63378ddce186307
MD5 7f92b1350791dfc6545fe1c827337d69
SHA1 bb2dbd4073a52646f8662da1a772b71aada60278
SHA512 e9f8072fcdd75fa3ec5730a19a4076f2e27c1570169fb5925fd859e8e9f3df94be515425de782d94d783459af861d7bf28b30043d247ad8d981cfc3e1a0b95db
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Size 20KB
SHA256 8678aa057f9a6fbc36532229bf2f53cfa3237003978cbc389fefa46ce1021e83
MD5 9bb9fe4abc19d0a952f845107ea7263f
SHA1 968eac93e76bbd40b4e20a6414e3de8236519848
SHA512 abe44315f3dfbf423c48f5984dae041b39451118be532a96f635b916b6c119b70f90b011930aa4d84a4606ac2f72a7f08f6b714d35b4a1126b0f3981bcd2c085
SSDEEP 48:TeJFawNLopFgU10XJB+1Oh4VRo0gVmN6xw6P8KvxZ46ysF1+RoAlGkT0GI:Exe8+QhEi0smYPxkdm+iAlHTvI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bc29b015dee606b3e1a2262db7d1510ff7f3a8afaf51121905dee63acceff87c
MD5 3ea5e9ef58bd7edafec950c75cac8647
SHA1 7deda1742ee0bab535caa2f9ccde2a9fa653bd06
SHA512 e665e6ceb839614ae1c475c3b36d274c34ce27ad2c0dde8ec879914ae6b493e07b4bec98d9ede24da7bc797511c8d6f39a403e44a8254c7fdc4f9599392b597e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 537B
SHA256 5f90d9fdc9d78bf92dd174a1b8e6d98418997a9b0ffbf9d149d0adc4c74967f5
MD5 3f338424eab4fd5f73f4e14652bf35dc
SHA1 b4ddb8d495f7e3b0c30fe7f17b24532fb0281aa1
SHA512 6c1b6c188296918a1cb1d4451a06f99f27facdb09539036b0cc396f4d511b81fa18c96eb4e8c82fa1fa20d7a8c50d7d1a63e06c83abb396d98699fb1146c98ac
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 537B
SHA256 d3621ae86383b9fdb85f1be16e756ac6690674f56a7e81492a7a52319fda872c
MD5 c9c01581b8160117d0217e26306eb8bf
SHA1 1b50950a18ac050d31ca4eb5e6018cdb7d9d8455
SHA512 6ef2504a4e2241aebddaf9fe914aad6dda795f4498ec29d5336247bd4a32b0c121d704676602d4c8f8405a90a05a45d64d1976afd3ee85c54876199af0c244af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 537B
SHA256 2c5da67e10f0b5ed064a8b1e0ab39a3dc52572763664127fba71be152cf019a4
MD5 ea9aff6d67335f912f209bd7af3ea624
SHA1 0e4b8ee8aecc1dd4419c1c9ba242f9e2417d41c1
SHA512 b52ab9a92caa004f5a4213800405839cfbeb544c014d492353dcf976963d2e6c6cb357d9a5490359b368522f79000c9c31083479fcfca4e53cbdb79835129222
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 6KB
SHA256 6f9e8b87545d26417870e6498b999e26de98e0a75586299e249cdd4ca04ed899
MD5 5959bf3f55fb91308b129564568a6d93
SHA1 9df101839426dbbef4e5a797d9aba72953e3b5a2
SHA512 723d49c6a58a9827f34c4cf584c9ee671d8cb163e7fd2532075e572319c4e6a290ed262522db5da308e880e42396069b2a02bf9e1c3c9c47e40be52c9d0fd9de
SSDEEP 96:ohR8XIbUwCKI0K8iZ9oT+y7Di+6Msmdehk51FIOzcqpjVhYtjEsXt0/cg2Vup:o/8Yb8f8s6+yy+Fsk5GKotjEsXtScPS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 15KB
SHA256 e55e3b33a92966f1d38ebbc818650c20a0e8e39c8a5358dec3ab2800a0174c14
MD5 ad924d787de0b67420f76be5d09ffa73
SHA1 8fe0cc53932b9b97a54c984f1bdc0c90a47aa717
SHA512 cd2b031c97cdb5c686210a0862e2dac8a3cfbb0b8b3ae37cee7f808c9aebe652860243135cdccafbc346608714bcaf68eac149441e4323ccef8fbb5d93353ac9
SSDEEP 384:+kLPLevXA1kXqKf/pUZNCgVLH2HfkrrU0HGtO92+x:JLPLkA1kXqKf/pUZNCgVLH2Hf4rU4Gte
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 137KB
SHA256 99086e161ecec47bf258309256ae3072912a46274ab58adcb8b1f1cc596c0322
MD5 3ec975217a7b0c88ffcb2d5cba618717
SHA1 1be4f9fe0b473de3b8346e378e7e401ee1e29eda
SHA512 49eca3878810e546423316820245f8b01327e4aeda136c3a54de63a41f1fabe2461bc57f9e95004a5b2c3becbd9cdae3a7ea6b69c4f878e59db5a96435be51e0
SSDEEP 3072:yjHQ1gH0C1nkGXmeWSyXHklNcGiiRn2a8Es5:wHJ52My3klNli6nlu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 274KB
SHA256 d1a36ae17c019668177a17bb446dddc751e8b8ba4403ac18e75283c1394ff3e5
MD5 6aabba673f368f50f4a086342b5ff774
SHA1 c6124d7fd5f2ea62613e213f87c12f59293a328a
SHA512 733bca2a5489f1cb1d04646f6854449075f048a22c31fd82b3a9006f434201a4256a8913cb38aeeaddf68f79b06d2ce18e3e1ef66f9ea8de3179e72a345fac54
SSDEEP 6144:AHHoJOhsrgXPK6e9Gu39xdesrD2Nus6HJ52My3klNli6nl/:sIOSgXP2v39xjrD2csKLbi6l/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 310KB
SHA256 92550bfa051e2b04454626e2f6f1699244d7245973b06c2e02f6e0b16e670db7
MD5 2630a8d8352a812890ab39ed2a0b7ace
SHA1 8a94de63e56186305f480d05ab0fb704e7cf2e65
SHA512 6cf0de7f2f77fe7ef57be780641232edde308b62767a8951dffe96a28a91cf0fd74d29527c84256f9cf53bfbaca4c5f0fa804cab759ae91e465b8efdfcb3e9c6
SSDEEP 6144:snIQ523Kw6XKpcvdIHoJOhsrgXPK6e9Gu39xdesrD2Nus6HJ52My3klNli6nl/:snC6TXKpcKIOSgXP2v39xjrD2csKLbiC
MD5 SHA1 SHA512 SSDEEP

Submit Download

persisted_first_party_sets.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

explorha.exe

Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Size 2.9MB
SHA256 b3913ee6a28e6ca1f3d226ff1f7d2c68028bb9f7c16b82105475e7155224668a
MD5 3c4127b40346e1bfcc2df12b027d120a
SHA1 0f9a40b9aa9035c09153a9a47135425ea1250bd4
SHA512 92d22cf914b9c5c8c5448bb5df97bec499d028d051ce3018f81181ac624a2311c29531d446d40a2ae846294c0b5aab8a3d956bcf7354dd1c30d201d83aa00209
SSDEEP 49152:dj7FAVCDcnMoUZtuDRTqVp9mN3W5B/bs7qLuL:d1AVCDcnMoUZtuDqkiB/CL
MD5 SHA1 SHA512 SSDEEP

Submit Download

1854307fae.exe

Path C:\Users\Admin\AppData\Local\Temp\1000055001\1854307fae.exe
Size 1.1MB
SHA256 b9c8b39afb1f568ad99abb273693af4aa053c3ff36c785a08007b26018d70818
MD5 09120962fea94b32a79b8090513783a7
SHA1 679c68326a9aee2d95d36b90dd192fc808651cc0
SHA512 0b5bb68cd7c784918ea04ded213ac3dc67ecdf2650aba96fc08ceaba2010e694a3d9132e0cfd503acb5c0e93ba42209f4e1d0d7e64c5f2e537c6eba63c5c05f8
SSDEEP 24576:cqDEvCTbMWu7rQYlBQcBiT6rprG8aua2+b+HdiJUX:cTvC/MTQYxsWR7aua2+b+HoJU
MD5 SHA1 SHA512 SSDEEP

Submit Download

83495a94e8.exe

Path C:\Users\Admin\AppData\Local\Temp\1000056001\83495a94e8.exe
Size 2.3MB
SHA256 7cac339733c031b7c81290794a2e56f1894ff81d7db3f920d43e9da76ffb042b
MD5 69eea6da5a972f99322787e2e1ddcee6
SHA1 8e8e9a999e06b2def82dae7437bc05a23db8fe94
SHA512 f41e06a426bff8f0756916546533f80af5b439fc13bd711411ed21715fd7d0cdaf2708c1bc55f20c962cd8919bd829588c672cb955b3191b7aef2a2c2d7c3123
SSDEEP 49152:/u5nhf8IKN3rmbrFl5USR4WaeXQsJ5mcBgz7GQ+C0mNzEB:2vs0l5Uo4xeXQbc+zn+C0mxEB
MD5 SHA1 SHA512 SSDEEP

Submit Download

amert.exe

Path C:\Users\Admin\AppData\Local\Temp\1000059001\amert.exe
Size 1.9MB
SHA256 e5fb190cb34afa45533f59258b8415cd2788042a5e7b83b2c1560c0189b3a521
MD5 42ad64483405b6ce53c4966870c902ec
SHA1 c21642320252e799c8fdb2b88acf177254dccacf
SHA512 62624070f30d2095ff53c0dee499c77f00e45c1c251a64cf18f7b885742ea0c5a0f4b931a01ecdbb10303be4763f6e7eb7d315ce13e2b8947df2d7ccbc0c2db0
SSDEEP 49152:JzJDEdJKf9YW60mnIZ8dBbFwSJ9jtFVSu1oU09z8:JzJDGIf9YJ0oI6BBwSRxc
MD5 SHA1 SHA512 SSDEEP

Submit Download

swiiiii.exe

Path C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
Size 321KB
SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
MD5 1c7d0f34bb1d85b5d2c01367cc8f62ef
SHA1 33aedadb5361f1646cffd68791d72ba5f1424114
SHA512 53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
SSDEEP 6144:DFZcMaQk5oqtag00+wX3bSJxuI2Hc8PlsLNuPhRF1Ym:DFZg5Ztj00+03mJxmc8PfPwm
MD5 SHA1 SHA512 SSDEEP

Submit Download

alexxxxxxxx.exe

Path C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
Size 1.7MB
SHA256 3a2006bc835a8ffe91b9ee9206f630b3172f42e090f4e8d90be620e540f5ef6b
MD5 85a15f080b09acace350ab30460c8996
SHA1 3fc515e60e4cfa5b3321f04a96c7fb463e4b9d02
SHA512 ade5e3531dfa1a01e6c2a69deb2962cbf619e766da3d6e8e3453f70ff55ccbcbe21381c7b97a53d67e1ca88975f4409b1a42a759e18f806171d29e4c3f250e9f
SSDEEP 49152:L/eYUVc8uWw3Sg6s8Zep6UXIEgf7WD4GTF:L/eYUW8bwUaPXVgzWMG
MD5 SHA1 SHA512 SSDEEP

Submit Download

gold.exe

Path C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
Size 488KB
SHA256 30468f8b767772214c60a701ecfee11c634516c3e2de146cd07638ea00dd0b6e
MD5 82053649cadec1a338509e46ba776fbd
SHA1 6d8e479a6dc76d54109bb2e602b8087d55537510
SHA512 e4b2b219483477a73fec5a207012f77c7167bf7b7f9adcb80ee92f87ddfe592a0d520f2afee531d1cce926ef56da2b065b13630a1cc171f48db8f7987e10897a
SSDEEP 12288:QDJ6PRDB7ZUl9F4SWieS/KSvMjnfyiDD+9CBqeE:QV6hpZU/7b/KSkjbDTH
MD5 SHA1 SHA512 SSDEEP

Submit Download

NewB.exe

Path C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
Size 418KB
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
SSDEEP 12288:5noAx+FnmuQhimtPURimLqevmipum+K4Y:5+FnmuGtpMLnLYY
MD5 SHA1 SHA512 SSDEEP

Submit Download

jok.exe

Path C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
Size 304KB
SHA256 096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
MD5 8510bcf5bc264c70180abe78298e4d5b
SHA1 2c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA512 5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
SSDEEP 3072:uq6EgY6i4rUjhYMLwPcologL/ejZWTACtAti0lcZqf7D34leqiOLibBOp:VqY6inwPDpKZWTA+AplcZqf7DIvL
MD5 SHA1 SHA512 SSDEEP

Submit Download

swiiii.exe

Path C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
Size 158KB
SHA256 cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
MD5 586f7fecacd49adab650fae36e2db994
SHA1 35d9fb512a8161ce867812633f0a43b042f9a5e6
SHA512 a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
SSDEEP 3072:I1lmOH349skOxH49PsH+8KqnuHV7A/5S+c6wABA47PN/6wHFHJ:I1iekOxYlI+EuH2cvAe4BywlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

file300un.exe

Path C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
Size 3.3MB
SHA256 4f47d84b03f5cfa3845d1b36df5e40df984756fc6ba2d98586eb39dced212628
MD5 b9882fe8bb7ab2a4d094f9ff5442df1c
SHA1 e17c146530a4371e0595c195c24863935a3dee8b
SHA512 bee33d43deb43854975e6c7a57f27ab8c6519ea3e6df51297ca670ac62831f29f6a18eff0bb0af14f9e985ebf9e2169ed97582fa64998cfb33b1d8b61ec72db4
SSDEEP 49152:zUIbNigeVE2MD7ZDAgUf0dgF8bEOlf84L:JI3bg3J
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISetup8.exe

Path C:\Users\Admin\AppData\Local\Temp\1000211001\ISetup8.exe
Size 414KB
SHA256 562bbfb4dcfdc559641f3a83f0de7323d60220e94bb46e85de889475fb643333
MD5 54a03236a463e61572b8098d37944f15
SHA1 6279b885b11630156b8554f5aac5b5720b5b6238
SHA512 bfc15816cb1ddc33c6525d0d94305871d4a1d51b225c49273289745ba7269881131c1df587703f0a96d79199a1424ce2fc90f36a57267fe3ca0fa07cfe540695
SSDEEP 6144:7NKAbOBdijPJ8QOY9w21a7A3Cjy1ojJTo3Ze3mk6ZKal:JaijPYirYL+1oNWHl
MD5 SHA1 SHA512 SSDEEP

Submit Download

toolspub1.exe

Path C:\Users\Admin\AppData\Local\Temp\1000212001\toolspub1.exe
Size 283KB
SHA256 1d5fe89aae579ea253d121deb90c9a61f94ddab13ff51f58f939a57f0edab73e
MD5 ace2b92a3208dec19577cbac84d543b2
SHA1 c40b8908ebbfa819c3581ec85bfca66bca77b605
SHA512 e7e6244087d993ae9beac2fba78452c3eb55f52cbcf515a5888e6078d87f235f1f54c12408eb4d0457102d22a8aa18d069dda0788cce72b0b456a74f7439459f
SSDEEP 3072:KiD09rKj/em+qxnnoVL0OA18WIyXpOx9E7sFW7CsZONbo0r5EK4kwgpG:YY6mM7A18B9NFW7CswRZr5E
MD5 SHA1 SHA512 SSDEEP

Submit Download

4767d2e713f2021e8fe856e3ea638b58.exe

Path C:\Users\Admin\AppData\Local\Temp\1000213001\4767d2e713f2021e8fe856e3ea638b58.exe
Size 4.2MB
SHA256 0f5ff3c62f03a74c17111cfd684520f46e09371ee861edcba67370fc92800d43
MD5 1c480386f3a4a56142b7a140590865de
SHA1 a2ac30674033c69e96fff4abe4a9693d1713ed75
SHA512 609fff5db8a0b565dc52a1828677848a4b7691ed51b9312f35171d36cd2342f75976ca4c991c3c3a46fb0402f848f86af12cda7dca1bac98400b6cd4983f34d4
SSDEEP 98304:vgne2SJZIUWtLmjHGRfKbrQf8QbBIewux3GqYQtroF:d2SJZIFmjmRferQf88ie1B7XtroF
MD5 SHA1 SHA512 SSDEEP

Submit Download

FirstZ.exe

Path C:\Users\Admin\AppData\Local\Temp\1000214001\FirstZ.exe
Size 2.5MB
SHA256 677f393462e24fb6dba1a47b39e674f485450f91deee6076ccbad9fd5e05bd12
MD5 ffada57f998ed6a72b6ba2f072d2690a
SHA1 6857b5f0c40a1cdb0411eb34aa9fe5029bcdb84f
SHA512 1de77f83a89935bb3fc3772d5190c3827d76a998785d451e2c0d11a0061cfd28f1b96eccb41b012c76ddda2021e3333a0a647489ae3c6dac10cfb8302abdf33f
SSDEEP 49152:UjBP3/qGrdNJ8VZFhY++Yk/4aLq8wH7mm6qJsSRRjyl:aBPvfrAZF28k/RLbwH7mvcRRjy
MD5 SHA1 SHA512 SSDEEP

Submit Download

Uni400uni.exe

Path C:\Users\Admin\AppData\Local\Temp\1000215001\Uni400uni.exe
Size 556KB
SHA256 b925abb193e7003f4a692064148ffe7840096022a44f4d5ae4c0abb59a287934
MD5 e1d8325b086f91769120381b78626e2e
SHA1 0eb6827878445d3e3e584b7f08067a7a4dc9e618
SHA512 c8c0b424c2ed7ee598997bdc0b0d2099b650a280903716891b0eaa340acf556c0642d921fcb7f654387a4a1f1ec4a32feaf8d872b51ca482a977f11e2974072c
SSDEEP 12288:vWcj324ri1mvJnrOj1fiTvwG/APkmUETuegWaR0j:vWcj/rxvJnCj1aTviPkmZLJaR0j
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppGate2103v01_16.exe

Path C:\Users\Admin\AppData\Local\Temp\1000217001\AppGate2103v01_16.exe
Size 5.4MB
SHA256 efc1ed06c96dfe3ed1a4c3944b02282c21a881b8227d1e4297eb56f716cd09b8
MD5 09567a19fa958357b14baf7841aa959c
SHA1 be50017f35f7a24e91dd3f9be7367939b3c6f681
SHA512 3e02e5ca0435b921ed4199f3314bb3ea1316aa58dc02bd6bb322c14d13157b504a71f6c746f28137de6ed5e504dc178dd2f999e2009b4b5725419cffd88e0019
SSDEEP 98304:eXgGVN00Vr5o6zDKNF0bvTww2se/QBIMw1:NGVNLFoabvTww2R4K1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tmp86A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp86A0.tmp
Size 2KB
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_jeohfvy4.cah.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jeohfvy4.cah.ps1
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

c3026c38

Path C:\Users\Admin\AppData\Local\Temp\c3026c38
Size 3.8MB
SHA256 a890935a36903669f35522c85c75e296404a4595453f060398cb64c5b0d6dfd0
MD5 13418f74a7ce25cdd6997c9fcb718a0e
SHA1 f4c880821fee72c37c882b1e8ebf100efcafe31c
SHA512 59017162877bbbdf823450a946e3e54e9130d8ebbf5baba24471c68a10d1fad3452be08c693cd7a78d0bf2fcfd6d3086edeec1a379f9b53fd66bb246c128d4c1
SSDEEP 49152:+FZ+XbU6nsnfUe2Yiy/Ib0JHpivuAqqtZE0U0mgmgg5XfL7ALm0fxakkg4zB5tLl:+0Uuise2YzbxpYdZCeOMLXKg4ft5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 2KB
SHA256 f32ab05dddd44ae98947ea0b81e7a5fa62274707211e1feac1ff5882e9c10ff6
MD5 f0da01044c03cbb9e6255bb131f95fe4
SHA1 9a41398be000836bdece14b0ba3a4f3046f56ffd
SHA512 b9c03b751d25abac9c1a812eaad382d55c751d022fa74c15cf88098e7703349fc342dc4db5633b64d2dfe163225e273b719997d84bd626c290c6b3a5c0d11dc7
MD5 SHA1 SHA512

Submit Download

ioloDMLog.txt

Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
Size 3KB
SHA256 fc46db12f822374b3a25c877fa6247aa544443c27b87d86a02f8fe7d0216d5da
MD5 7e8d43167d9e91e667ac1ab386b3f6b9
SHA1 78227b581c301d7a4f11e66150c78e40f1b39f8d
SHA512 e5f5e6896ee450607a748092eb2ed5470e066064e8d5b4181930728b0927264d38a006f7692027059b6f2d3e2ecea2cd1ff316166fa84b67b523cbc2cae7e741
MD5 SHA1 SHA512

Submit Download

tmpBE1D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpBE1D.tmp
Size 46KB
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
SSDEEP 96:9SXNKLyeymwHCn8MouOFlRGiZqYtFTCG:9SfHG7qqifTCG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpBE4E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpBE4E.tmp
Size 92KB
SHA256 6764736d2bd111036bea0eeb890cd75a5bb4114275abfffe615d9f79049f0ffc
MD5 f0764eecc2d52e7c433725edd7f6e17a
SHA1 2b6c1165e7ca5c433b29db548ac2624037c8cb38
SHA512 3cb2f0abc6925907488de7ecef46d60106efb98cec3c63e24e531bbf94dcd8c89ad57e0a88084eaa5083265f32134e6636f23808622db5cb3f5c83faaba96ef0
SSDEEP 192:dtxbavrNdl9bH9CxbGsTjOnaVh6is6PJVum3:/Ravrbl9D9pnaVh6lUJVum3
MD5 SHA1 SHA512 SSDEEP

Submit Download

u4n4.0.exe

Path C:\Users\Admin\AppData\Local\Temp\u4n4.0.exe
Size 270KB
SHA256 3200fac8ca4eb6abba8e97221ee8e74f68edc6385b02bb5d04adb57e32432b6b
MD5 51627ffc0192dd8143c0c0208392166d
SHA1 dba1a938466fd61f41198400e2a899fa43819d7e
SHA512 f92f5d1f598480a34f5bad1a58de59b7c11e9311ee64147c33fedc2889f9184f91e0e02237c2eff6a5efa02543a87d36c99c34ff2b361fca8bd5d8a3baa6025b
SSDEEP 3072:qeO7J1bUiy0X1bG73Dw1LBJtcbLoVWkbMLRqQ4Zc2tlkz:+74iyC1y73qBJtw8V1BQ4Zc2Hk
MD5 SHA1 SHA512 SSDEEP

Submit Download

76b53b3ec448f7ccdda2063b15d2bfc3_f4fe33a0-f73d-4d5c-8730-deeef20ef238

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3968772205-1713802336-1776639840-1000\76b53b3ec448f7ccdda2063b15d2bfc3_f4fe33a0-f73d-4d5c-8730-deeef20ef238
Size 2KB
SHA256 1d70eb60e908c033735ab5002e4a0dce708744241e80e9cc4ad55be6e19f97c9
MD5 e23f7826038ca8ad7997c51db56533eb
SHA1 4030911dc97fe67ce2d0a9fc6b5e901a166b2f60
SHA512 05fc2ef93b88e31b563f6340ee535f1a11bab199584a1988b81411957f27906157ca3f6caeee0d30f95af3ffe34db91f03d90ea6c8f7fa4e577c0f54daadf4c9
MD5 SHA1 SHA512

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Size 109KB
SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
MD5 726cd06231883a159ec1ce28dd538699
SHA1 404897e6a133d255ad5a9c26ac6414d7134285a2
SHA512 9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
SSDEEP 3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 1.2MB
SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
MD5 15a42d3e4579da615a384c717ab2109b
SHA1 22aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA512 1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
SSDEEP 24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
Size 109KB
SHA256 5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
MD5 154c3f1334dd435f562672f2664fea6b
SHA1 51dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA512 1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
SSDEEP 3072:D4uSD+ZwruS0bGYuZRtasSVh/QEIegRQod4l:kuTiabruZR8JSlD4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
Size 1.2MB
SHA256 83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
MD5 f35b671fda2603ec30ace10946f11a90
SHA1 059ad6b06559d4db581b1879e709f32f80850872
SHA512 b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
SSDEEP 24576:2vkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggv4+yC7:2sMPSYcS5wPi095PbgS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Traffic.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\Traffic.exe
Size 541KB
SHA256 f38c27ecbeed9721f0885d3b2f2f767d60a5d1c0a5c98433357f570987da3e50
MD5 1fc4b9014855e9238a361046cfbf6d66
SHA1 c17f18c8246026c9979ab595392a14fe65cc5e9f
SHA512 2af234cac24ec4a508693d9affa7f759d4b29bb3c9ddffd9e6350959fd4da26501553399d2b02a8eeae8dace6bfe9b2ce50462ce3c6547497f5b0ea6ed226b12
SSDEEP 12288:TAaw1dGg1Bz5TvcN3CNIb88WsNMP5F1k:TOzNW3CNIb88WsNMhF
MD5 SHA1 SHA512 SSDEEP

Submit Download

propro.exe

Path C:\Users\Admin\AppData\Roaming\configurationValue\propro.exe
Size 304KB
SHA256 bd73ee49a23901f9fb235f8a5b29adc72cc637ad4b62a9760c306900cb1678b7
MD5 cc90e3326d7b20a33f8037b9aab238e4
SHA1 236d173a6ac462d85de4e866439634db3b9eeba3
SHA512 b5d197a05a267bf66509b6d976924cd6f5963532a9f9f22d1763701d4fba3dfa971e0058388249409884bc29216fb33a51846562a5650f81d99ce14554861521
SSDEEP 3072:nq6EgY6iwrUjL849wPzoGrjLSTAytAS3alcZqf7D34teqiOLibBO7:qqY6i/wPHfLSTAuAzlcZqf7DIXL
MD5 SHA1 SHA512 SSDEEP

Submit Download

TW4BwDKaHhx2m73QyQK6RLzn.exe

Path C:\Users\Admin\Pictures\TW4BwDKaHhx2m73QyQK6RLzn.exe
Size 7KB
SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
MD5 5b423612b36cde7f2745455c5dd82577
SHA1 0187c7c80743b44e9e0c193e993294e3b969cc3d
SHA512 c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
SSDEEP 192:HLlX+suv13xV1cSHYu+zogDLIIUOb6z5p7KoxSR1yz:H5X+Dv13T1FH0fHIIP69xKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Google Chrome.lnk

Path C:\Users\Public\Desktop\Google Chrome.lnk
Size 2KB
SHA256 bde6e40a986984ed4dbfa69316c684b3ea2d5682ef6a66f34e9c0e0bfddfe3e5
MD5 5a9ee0498768cfcc5c61516fc5d780cd
SHA1 9ca59745b147d36da00237f6fed755738f5c759b
SHA512 275ee6966195d4ac0371a63de36e460936a706a1bbe80b815b6516eaa175227513a6158be0b72accddb3d1f303439d591e34776c3eda9b658d7e5fcbb5a9c6ed
MD5 SHA1 SHA512

Submit Download

gpt.ini

Path C:\Windows\System32\GroupPolicy\gpt.ini
Size 127B
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
MD5 SHA1 SHA512

Submit Download

memory/60-376-0x0000000000880000-0x0000000000E45000-memory.dmp

Download

memory/60-351-0x0000000000880000-0x0000000000E45000-memory.dmp

Download

memory/60-103-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Download

memory/60-104-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Download

memory/60-101-0x0000000004A60000-0x0000000004A61000-memory.dmp

Download

memory/60-102-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Download

memory/60-99-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Download

memory/60-108-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/60-364-0x0000000000880000-0x0000000000E45000-memory.dmp

Download

memory/60-362-0x0000000000880000-0x0000000000E45000-memory.dmp

Download

memory/60-154-0x0000000000880000-0x0000000000E45000-memory.dmp

Download

memory/60-105-0x0000000004B00000-0x0000000004B01000-memory.dmp

Download

memory/60-100-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/60-336-0x0000000000880000-0x0000000000E45000-memory.dmp

Download

memory/60-97-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Download

memory/60-98-0x0000000004A80000-0x0000000004A81000-memory.dmp

Download

memory/60-96-0x0000000000880000-0x0000000000E45000-memory.dmp

Download

memory/60-107-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Download

memory/60-246-0x0000000000880000-0x0000000000E45000-memory.dmp

Download

memory/60-612-0x0000000000880000-0x0000000000E45000-memory.dmp

Download

memory/60-106-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/60-110-0x0000000004B20000-0x0000000004B22000-memory.dmp

Download

memory/716-413-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-29-0x0000000005560000-0x0000000005561000-memory.dmp

Download

memory/716-20-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-21-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-23-0x0000000005520000-0x0000000005521000-memory.dmp

Download

memory/716-24-0x0000000005500000-0x0000000005501000-memory.dmp

Download

memory/716-22-0x0000000005510000-0x0000000005511000-memory.dmp

Download

memory/716-25-0x0000000005540000-0x0000000005541000-memory.dmp

Download

memory/716-678-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-26-0x00000000054E0000-0x00000000054E1000-memory.dmp

Download

memory/716-27-0x00000000054F0000-0x00000000054F1000-memory.dmp

Download

memory/716-28-0x0000000005570000-0x0000000005571000-memory.dmp

Download

memory/716-109-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-113-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-133-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-365-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-363-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-352-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-337-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/716-319-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/2028-723-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/2028-653-0x0000000000400000-0x000000000063B000-memory.dmp

Download

memory/2028-665-0x0000000000400000-0x000000000063B000-memory.dmp

Download

memory/2156-448-0x0000000000400000-0x0000000000592000-memory.dmp

Download

memory/2212-641-0x00000000003B0000-0x000000000088A000-memory.dmp

Download

memory/2520-3-0x0000000004800000-0x0000000004801000-memory.dmp

Download

memory/2520-6-0x00000000047C0000-0x00000000047C1000-memory.dmp

Download

memory/2520-7-0x00000000047D0000-0x00000000047D1000-memory.dmp

Download

memory/2520-8-0x00000000047F0000-0x00000000047F1000-memory.dmp

Download

memory/2520-10-0x0000000004850000-0x0000000004851000-memory.dmp

Download

memory/2520-11-0x0000000004840000-0x0000000004841000-memory.dmp

Download

memory/2520-18-0x0000000000A80000-0x0000000000DA5000-memory.dmp

Download

memory/2520-5-0x0000000004820000-0x0000000004821000-memory.dmp

Download

memory/2520-0-0x0000000000A80000-0x0000000000DA5000-memory.dmp

Download

memory/2520-4-0x00000000047E0000-0x00000000047E1000-memory.dmp

Download

memory/2520-2-0x0000000000A80000-0x0000000000DA5000-memory.dmp

Download

memory/2520-1-0x0000000076F94000-0x0000000076F95000-memory.dmp

Download

memory/2856-162-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-184-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-165-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-200-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-198-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-160-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-159-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-158-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-199-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-157-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-156-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-209-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-155-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-196-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-153-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-195-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-150-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-210-0x0000000005270000-0x0000000005271000-memory.dmp

Download

memory/2856-187-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-164-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-211-0x0000000005250000-0x0000000005251000-memory.dmp

Download

memory/2856-212-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/2856-215-0x0000000005290000-0x0000000005291000-memory.dmp

Download

memory/2856-163-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-213-0x0000000005230000-0x0000000005231000-memory.dmp

Download

memory/2856-220-0x0000000005280000-0x0000000005281000-memory.dmp

Download

memory/2856-221-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/2856-222-0x00000000052C0000-0x00000000052C1000-memory.dmp

Download

memory/2856-178-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-166-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-181-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-223-0x0000000005220000-0x0000000005221000-memory.dmp

Download

memory/2856-161-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-194-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-185-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-193-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-177-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-189-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-192-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-217-0x00000000052B0000-0x00000000052B1000-memory.dmp

Download

memory/2856-191-0x0000000000400000-0x00000000009D7000-memory.dmp

Download

memory/2856-226-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/2856-224-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/2860-188-0x000001AEE85D0000-0x000001AEE85E0000-memory.dmp

Download

memory/2860-190-0x000001AEE85D0000-0x000001AEE85E0000-memory.dmp

Download

memory/2860-197-0x000001AEE8710000-0x000001AEE8732000-memory.dmp

Download

memory/2860-183-0x00007FFF00C10000-0x00007FFF015FC000-memory.dmp

Download

memory/3412-116-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Download

memory/3412-121-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/3412-112-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/3412-120-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Download

memory/3412-117-0x0000000004AF0000-0x0000000004AF1000-memory.dmp

Download

memory/3412-115-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Download

memory/3412-114-0x0000000004AC0000-0x0000000004AC1000-memory.dmp

Download

memory/3412-119-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Download

memory/3412-132-0x00000000012E0000-0x0000000001605000-memory.dmp

Download

memory/3412-118-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/3768-418-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3768-421-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4432-529-0x0000000000400000-0x0000000000452000-memory.dmp

Download

memory/5288-311-0x0000000000CE0000-0x00000000011BA000-memory.dmp

Download

memory/5580-397-0x00000000012E0000-0x0000000001605000-memory.dmp

Download