Analysis Overview
SHA256
0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2
Threat Level: Known bad
The file 0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2 was found to be: Known bad.
Malicious Activity Summary
Glupteba
Stealc
Lumma Stealer
ZGRat
Amadey
Glupteba payload
UAC bypass
Detect ZGRat V1
Windows security bypass
RedLine
RedLine payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Downloads MZ/PE file
Stops running service(s)
Modifies Windows Firewall
Blocklisted process makes network request
Identifies Wine through registry keys
Executes dropped EXE
Windows security modification
Checks BIOS information in registry
Themida packer
Reads WinSCP keys stored on the system
Reads user/profile data of web browsers
Loads dropped DLL
Checks computer location settings
Reads local data of messenger clients
Looks up external IP address via web service
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Checks whether UAC is enabled
Checks installed software on the system
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Launches sc.exe
Drops file in Program Files directory
Drops file in Windows directory
Unsigned PE
Enumerates physical storage devices
Program crash
Checks processor information in registry
Modifies system certificate store
Suspicious use of AdjustPrivilegeToken
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
System policy modification
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2024-04-25 13:25
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-25 13:25
Reported
2024-04-25 13:27
Platform
win10v2004-20240412-en
Max time kernel
94s
Max time network
151s
Command Line
Signatures
Amadey
Detect ZGRat V1
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Lumma Stealer
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Stealc
UAC bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
ZGRat
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Downloads MZ/PE file
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
Stops running service(s)
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\Pictures\STBeMVgZBxA2Bj1b60uBfcaz.exe | N/A |
Executes dropped EXE
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\Temp\361055.exe | N/A |
Reads WinSCP keys stored on the system
Reads local data of messenger clients
Reads user/profile data of web browsers
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.myip.com | N/A | N/A |
| N/A | api.myip.com | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2368 set thread context of 3572 | N/A | C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 4888 set thread context of 4496 | N/A | C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 2396 set thread context of 2392 | N/A | C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 3932 set thread context of 1920 | N/A | C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 4648 set thread context of 1172 | N/A | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\GameServerClient\GameServerClient.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\GameServerClientC.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameServerClient\GameServerClientC.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameServerClient\installc.bat | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\installg.bat | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameServerClient\installg.bat | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\GameServerClient.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\installc.bat | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\GameService.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameServerClient\GameService.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\chrosha.job | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 | C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 | C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe
"C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe"
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2368 -ip 2368
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 868
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\177723727746_Desktop.zip' -CompressionLevel Optimal
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4888 -ip 4888
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 368
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2396 -ip 2396
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 368
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
"C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "
C:\Users\Admin\Pictures\STBeMVgZBxA2Bj1b60uBfcaz.exe
"C:\Users\Admin\Pictures\STBeMVgZBxA2Bj1b60uBfcaz.exe"
C:\Windows\SysWOW64\sc.exe
Sc delete GameServerClient
C:\Users\Admin\Pictures\cdiThIq1FIpLI4vC0bJnl92o.exe
"C:\Users\Admin\Pictures\cdiThIq1FIpLI4vC0bJnl92o.exe"
C:\Users\Admin\Pictures\IZJ9qmfLVwQHArgB2QV0WzLH.exe
"C:\Users\Admin\Pictures\IZJ9qmfLVwQHArgB2QV0WzLH.exe"
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService remove GameServerClient confirm
C:\Users\Admin\AppData\Local\Temp\u3f4.0.exe
"C:\Users\Admin\AppData\Local\Temp\u3f4.0.exe"
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService start GameServerClient
C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
C:\Program Files (x86)\GameServerClient\GameServerClient.exe
"C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
C:\Windows\Temp\361055.exe
"C:\Windows\Temp\361055.exe" --list-devices
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
C:\Windows\SysWOW64\sc.exe
Sc delete GameServerClientC
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService remove GameServerClientC confirm
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService start GameServerClientC
C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
"C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
C:\Users\Admin\Pictures\cdiThIq1FIpLI4vC0bJnl92o.exe
"C:\Users\Admin\Pictures\cdiThIq1FIpLI4vC0bJnl92o.exe"
C:\Windows\Temp\280740.exe
"C:\Windows\Temp\280740.exe" --coin BTC -m ADDRESSES -t 0 --range 380c0552340000000:380c0552380000000 -o xxx0.txt -i C:\Windows\Temp\curjob.bin
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2256 -ip 2256
C:\Users\Admin\Pictures\IZJ9qmfLVwQHArgB2QV0WzLH.exe
"C:\Users\Admin\Pictures\IZJ9qmfLVwQHArgB2QV0WzLH.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 636
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2256 -ip 2256
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 836
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2256 -ip 2256
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 768
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
C:\Users\Admin\AppData\Local\Temp\u3f4.2\run.exe
"C:\Users\Admin\AppData\Local\Temp\u3f4.2\run.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\Pictures\eXczqZBOAwwCnquuwXDxnNBj.exe
"C:\Users\Admin\Pictures\eXczqZBOAwwCnquuwXDxnNBj.exe" --silent --allusers=0
C:\Users\Admin\Pictures\eXczqZBOAwwCnquuwXDxnNBj.exe
C:\Users\Admin\Pictures\eXczqZBOAwwCnquuwXDxnNBj.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x6b60e1d0,0x6b60e1dc,0x6b60e1e8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2640 -ip 2640
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eXczqZBOAwwCnquuwXDxnNBj.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eXczqZBOAwwCnquuwXDxnNBj.exe" --version
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 1016
C:\Users\Admin\Pictures\eXczqZBOAwwCnquuwXDxnNBj.exe
"C:\Users\Admin\Pictures\eXczqZBOAwwCnquuwXDxnNBj.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5144 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240425132704" --session-guid=d686c2c1-80ed-4b52-8e7d-f19d242f59db --server-tracking-blob="ODdlZTU0ZDZjM2UwMDY4MGE5ZjhmZWZlZTQ1NzI2NTQwNDhjNTZlMjY1OGFlODllMDc2ODQ3YzlmOGQ5YzBlMjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MDUxNTkzLjI0MjgiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMWM5ZjgxYTMtOGZjOS00OTA2LWEwMTgtNjNhMzliZDgwNzJhIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=1804000000000000
C:\Users\Admin\Pictures\eXczqZBOAwwCnquuwXDxnNBj.exe
C:\Users\Admin\Pictures\eXczqZBOAwwCnquuwXDxnNBj.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2a4,0x2a8,0x2ac,0x274,0x2b0,0x6ef9e1d0,0x6ef9e1dc,0x6ef9e1e8
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
C:\Users\Admin\AppData\Local\Temp\u3f4.3.exe
"C:\Users\Admin\AppData\Local\Temp\u3f4.3.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4432 -ip 4432
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 1448
C:\Users\Admin\Pictures\uOxNr1gliEyAOOdlgJvGRc9D.exe
"C:\Users\Admin\Pictures\uOxNr1gliEyAOOdlgJvGRc9D.exe"
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
C:\Users\Admin\Pictures\jQum0P5VUkSaOJsw5krz4q3u.exe
"C:\Users\Admin\Pictures\jQum0P5VUkSaOJsw5krz4q3u.exe"
C:\Users\Admin\AppData\Local\Temp\7zS4A5.tmp\Install.exe
.\Install.exe /RvdidblCuX "385118" /S
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 13:28:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\ZkvkjcG.exe\" em /jAsite_idZUz 385118 /S" /V1 /F
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327041\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327041\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327041\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327041\assistant\assistant_installer.exe" --version
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5648 -ip 5648
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327041\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327041\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0xb86038,0xb86044,0xb86050
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 920
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5648 -ip 5648
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 888
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5648 -ip 5648
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5648 -s 948
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.32.209.4.in-addr.arpa | udp |
| NL | 23.62.61.113:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 21.114.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 113.61.62.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 217.106.137.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| US | 20.189.173.4:443 | tcp | |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.139.73.23.in-addr.arpa | udp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 8.8.8.8:53 | 167.132.233.193.in-addr.arpa | udp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 8.8.8.8:53 | affordcharmcropwo.shop | udp |
| US | 172.67.181.34:443 | affordcharmcropwo.shop | tcp |
| US | 8.8.8.8:53 | 34.181.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | cleartotalfisherwo.shop | udp |
| US | 104.21.72.132:443 | cleartotalfisherwo.shop | tcp |
| US | 8.8.8.8:53 | worryfillvolcawoi.shop | udp |
| US | 172.67.199.191:443 | worryfillvolcawoi.shop | tcp |
| US | 8.8.8.8:53 | 132.72.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 191.199.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | enthusiasimtitleow.shop | udp |
| US | 104.21.18.233:443 | enthusiasimtitleow.shop | tcp |
| US | 8.8.8.8:53 | dismissalcylinderhostw.shop | udp |
| US | 104.21.22.160:443 | dismissalcylinderhostw.shop | tcp |
| US | 8.8.8.8:53 | 233.18.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.22.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | diskretainvigorousiw.shop | udp |
| US | 104.21.23.143:443 | diskretainvigorousiw.shop | tcp |
| US | 8.8.8.8:53 | communicationgenerwo.shop | udp |
| US | 104.21.83.19:443 | communicationgenerwo.shop | tcp |
| US | 8.8.8.8:53 | pillowbrocccolipe.shop | udp |
| US | 8.8.8.8:53 | 48.251.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.23.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.83.21.104.in-addr.arpa | udp |
| US | 104.21.47.56:443 | pillowbrocccolipe.shop | tcp |
| US | 8.8.8.8:53 | 56.47.21.104.in-addr.arpa | udp |
| DE | 185.172.128.19:80 | 185.172.128.19 | tcp |
| US | 8.8.8.8:53 | 19.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | productivelookewr.shop | udp |
| US | 104.21.11.250:443 | productivelookewr.shop | tcp |
| DE | 185.172.128.33:8970 | tcp | |
| US | 8.8.8.8:53 | tolerateilusidjukl.shop | udp |
| US | 172.67.147.41:443 | tolerateilusidjukl.shop | tcp |
| US | 8.8.8.8:53 | 250.11.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.147.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | shatterbreathepsw.shop | udp |
| US | 172.67.169.43:443 | shatterbreathepsw.shop | tcp |
| DE | 185.172.128.19:80 | 185.172.128.19 | tcp |
| US | 8.8.8.8:53 | shortsvelventysjo.shop | udp |
| US | 188.114.96.2:443 | shortsvelventysjo.shop | tcp |
| US | 8.8.8.8:53 | 43.169.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 33.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.96.114.188.in-addr.arpa | udp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 8.8.8.8:53 | incredibleextedwj.shop | udp |
| US | 172.67.218.63:443 | incredibleextedwj.shop | tcp |
| RU | 185.215.113.67:26260 | tcp | |
| US | 8.8.8.8:53 | alcojoldwograpciw.shop | udp |
| US | 104.21.48.243:443 | alcojoldwograpciw.shop | tcp |
| US | 8.8.8.8:53 | 63.218.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.113.215.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 243.48.21.104.in-addr.arpa | udp |
| RU | 5.42.65.67:48396 | tcp | |
| US | 8.8.8.8:53 | liabilitynighstjsko.shop | udp |
| RU | 193.233.132.234:80 | 193.233.132.234 | tcp |
| US | 172.67.192.138:443 | liabilitynighstjsko.shop | tcp |
| US | 8.8.8.8:53 | 67.65.42.5.in-addr.arpa | udp |
| FR | 52.143.157.84:80 | 52.143.157.84 | tcp |
| US | 8.8.8.8:53 | demonstationfukewko.shop | udp |
| US | 104.21.33.174:443 | demonstationfukewko.shop | tcp |
| US | 8.8.8.8:53 | 138.192.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.132.233.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 84.157.143.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 174.33.21.104.in-addr.arpa | udp |
| RU | 77.221.151.47:80 | 77.221.151.47 | tcp |
| US | 8.8.8.8:53 | 47.151.221.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | yip.su | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.21.79.77:443 | yip.su | tcp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| DE | 185.172.128.59:80 | 185.172.128.59 | tcp |
| RU | 193.233.132.234:80 | 193.233.132.234 | tcp |
| RU | 193.233.132.175:80 | 193.233.132.175 | tcp |
| US | 8.8.8.8:53 | iplogger.com | udp |
| US | 104.21.76.57:443 | iplogger.com | tcp |
| US | 8.8.8.8:53 | skategirls.org | udp |
| RU | 193.233.132.234:80 | 193.233.132.234 | tcp |
| US | 8.8.8.8:53 | realdeepai.org | udp |
| US | 104.21.90.14:443 | realdeepai.org | tcp |
| US | 104.21.90.14:443 | realdeepai.org | tcp |
| US | 8.8.8.8:53 | net.geo.opera.com | udp |
| NL | 185.26.182.112:80 | net.geo.opera.com | tcp |
| US | 8.8.8.8:53 | 24.19.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.79.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.132.233.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.76.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.90.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | jonathantwo.com | udp |
| NL | 185.26.182.112:443 | net.geo.opera.com | tcp |
| US | 104.21.31.124:443 | jonathantwo.com | tcp |
| US | 104.21.31.124:443 | jonathantwo.com | tcp |
| US | 8.8.8.8:53 | 112.182.26.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 124.31.21.104.in-addr.arpa | udp |
| DE | 185.172.128.90:80 | 185.172.128.90 | tcp |
| US | 8.8.8.8:53 | 90.128.172.185.in-addr.arpa | udp |
| DE | 185.172.128.228:80 | 185.172.128.228 | tcp |
| DE | 185.172.128.59:80 | 185.172.128.59 | tcp |
| US | 8.8.8.8:53 | 228.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | note.padd.cn.com | udp |
| RO | 176.97.76.106:80 | note.padd.cn.com | tcp |
| US | 8.8.8.8:53 | 106.76.97.176.in-addr.arpa | udp |
| RU | 77.221.151.47:8080 | tcp | |
| DE | 185.172.128.228:80 | 185.172.128.228 | tcp |
| DE | 185.172.128.76:80 | 185.172.128.76 | tcp |
| US | 8.8.8.8:53 | 76.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | autoupdate.geo.opera.com | udp |
| US | 8.8.8.8:53 | desktop-netinstaller-sub.osp.opera.software | udp |
| NL | 82.145.217.121:443 | desktop-netinstaller-sub.osp.opera.software | tcp |
| NL | 82.145.216.20:443 | autoupdate.geo.opera.com | tcp |
| NL | 82.145.216.20:443 | autoupdate.geo.opera.com | tcp |
| US | 8.8.8.8:53 | 20.216.145.82.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.217.145.82.in-addr.arpa | udp |
| US | 8.8.8.8:53 | svc.iolo.com | udp |
| US | 20.157.87.45:80 | svc.iolo.com | tcp |
| US | 8.8.8.8:53 | 45.87.157.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | features.opera-api2.com | udp |
| US | 8.8.8.8:53 | download.opera.com | udp |
| NL | 185.26.182.94:443 | features.opera-api2.com | tcp |
| NL | 82.145.216.23:443 | download.opera.com | tcp |
| RU | 5.42.66.10:80 | 5.42.66.10 | tcp |
| US | 8.8.8.8:53 | api.myip.com | udp |
| US | 104.26.9.59:443 | api.myip.com | tcp |
| US | 8.8.8.8:53 | download5.operacdn.com | udp |
| US | 104.18.11.89:443 | download5.operacdn.com | tcp |
| US | 8.8.8.8:53 | 94.182.26.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.216.145.82.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.66.42.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.9.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ipinfo.io | udp |
| US | 34.117.186.192:443 | ipinfo.io | tcp |
| US | 8.8.8.8:53 | 192.186.117.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 89.11.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | download.iolo.net | udp |
| FR | 185.93.2.248:443 | download.iolo.net | tcp |
| US | 8.8.8.8:53 | 248.2.93.185.in-addr.arpa | udp |
| N/A | 224.0.0.251:5353 | udp | |
| NL | 82.145.217.121:443 | desktop-netinstaller-sub.osp.opera.software | tcp |
| RU | 91.215.85.66:15647 | tcp | |
| US | 8.8.8.8:53 | svc.iolo.com | udp |
| US | 20.157.87.45:80 | svc.iolo.com | tcp |
| US | 8.8.8.8:53 | 66.85.215.91.in-addr.arpa | udp |
Files
memory/4428-0-0x00000000004D0000-0x00000000009AE000-memory.dmp
memory/4428-1-0x00000000773C4000-0x00000000773C6000-memory.dmp
memory/4428-2-0x00000000004D0000-0x00000000009AE000-memory.dmp
memory/4428-4-0x0000000004E90000-0x0000000004E91000-memory.dmp
memory/4428-5-0x0000000004E70000-0x0000000004E71000-memory.dmp
memory/4428-3-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/4428-6-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
memory/4428-7-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/4428-8-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/4428-9-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
memory/4428-10-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/4428-15-0x00000000004D0000-0x00000000009AE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
| MD5 | d29e40c77247d5eea4c4029b804aa549 |
| SHA1 | 9031e95e7c03ebe7b7c1e828bf18325a76972168 |
| SHA256 | 0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2 |
| SHA512 | 3a50c63887f677aae90fb976b5c8677f913447cb6700eeb83bcc261e60d2d394f8876350b10e6c6b4e1906a7f05777eb6379346dbf0d618f1e3e35febbf5a4cf |
memory/2412-18-0x0000000000850000-0x0000000000D2E000-memory.dmp
memory/2412-19-0x0000000000850000-0x0000000000D2E000-memory.dmp
memory/2412-21-0x0000000005250000-0x0000000005251000-memory.dmp
memory/2412-22-0x0000000005230000-0x0000000005231000-memory.dmp
memory/2412-20-0x0000000005240000-0x0000000005241000-memory.dmp
memory/2412-23-0x0000000005280000-0x0000000005281000-memory.dmp
memory/2412-24-0x0000000005210000-0x0000000005211000-memory.dmp
memory/2412-25-0x0000000005220000-0x0000000005221000-memory.dmp
memory/2412-26-0x0000000005270000-0x0000000005271000-memory.dmp
memory/2412-27-0x00000000052A0000-0x00000000052A1000-memory.dmp
memory/2412-28-0x0000000005290000-0x0000000005291000-memory.dmp
memory/2412-29-0x0000000000850000-0x0000000000D2E000-memory.dmp
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
| MD5 | f35b671fda2603ec30ace10946f11a90 |
| SHA1 | 059ad6b06559d4db581b1879e709f32f80850872 |
| SHA256 | 83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7 |
| SHA512 | b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705 |
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
| MD5 | 1c7d0f34bb1d85b5d2c01367cc8f62ef |
| SHA1 | 33aedadb5361f1646cffd68791d72ba5f1424114 |
| SHA256 | e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c |
| SHA512 | 53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d |
memory/2412-61-0x0000000000850000-0x0000000000D2E000-memory.dmp
memory/2368-62-0x0000000000070000-0x00000000000C2000-memory.dmp
memory/2368-63-0x0000000072C90000-0x0000000073440000-memory.dmp
memory/3572-66-0x0000000000400000-0x000000000044C000-memory.dmp
memory/3572-69-0x0000000000400000-0x000000000044C000-memory.dmp
memory/2368-70-0x00000000025C0000-0x00000000045C0000-memory.dmp
memory/3572-72-0x0000000002AA0000-0x0000000002AD2000-memory.dmp
memory/3572-71-0x0000000002C20000-0x0000000002C60000-memory.dmp
memory/3572-73-0x0000000002AA0000-0x0000000002AD2000-memory.dmp
memory/3572-74-0x0000000002AA0000-0x0000000002AD2000-memory.dmp
memory/3572-75-0x0000000000400000-0x000000000044C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxjyb1c2.kdb.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4564-85-0x000002097A2D0000-0x000002097A2F2000-memory.dmp
memory/4564-86-0x00007FFE8DB50000-0x00007FFE8E611000-memory.dmp
memory/4564-87-0x0000020978120000-0x0000020978130000-memory.dmp
memory/4564-88-0x0000020978120000-0x0000020978130000-memory.dmp
memory/2368-89-0x0000000072C90000-0x0000000073440000-memory.dmp
memory/4564-90-0x0000020978120000-0x0000020978130000-memory.dmp
memory/4564-91-0x000002097A680000-0x000002097A692000-memory.dmp
memory/4564-92-0x000002097A2B0000-0x000002097A2BA000-memory.dmp
memory/4564-98-0x00007FFE8DB50000-0x00007FFE8E611000-memory.dmp
memory/2412-99-0x0000000000850000-0x0000000000D2E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
| MD5 | 31841361be1f3dc6c2ce7756b490bf0f |
| SHA1 | ff2506641a401ac999f5870769f50b7326f7e4eb |
| SHA256 | 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee |
| SHA512 | 53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019 |
memory/4888-117-0x0000000000FB0000-0x0000000001268000-memory.dmp
memory/4496-116-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4496-118-0x0000000071EA0000-0x0000000072650000-memory.dmp
memory/4496-121-0x0000000005310000-0x0000000005320000-memory.dmp
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
| MD5 | 0c582da789c91878ab2f1b12d7461496 |
| SHA1 | 238bd2408f484dd13113889792d6e46d6b41c5ba |
| SHA256 | a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67 |
| SHA512 | a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a |
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
| MD5 | 20ae0bb07ba77cb3748aa63b6eb51afb |
| SHA1 | 87c468dc8f3d90a63833d36e4c900fa88d505c6d |
| SHA256 | daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d |
| SHA512 | db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2 |
memory/4420-141-0x0000000071EA0000-0x0000000072650000-memory.dmp
memory/4420-142-0x0000000000280000-0x00000000002D2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
| MD5 | b22521fb370921bb5d69bf8deecce59e |
| SHA1 | 3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea |
| SHA256 | b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158 |
| SHA512 | 1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c |
memory/4420-152-0x0000000005090000-0x0000000005634000-memory.dmp
memory/4420-153-0x0000000004B90000-0x0000000004C22000-memory.dmp
memory/4420-154-0x0000000004D50000-0x0000000004D60000-memory.dmp
memory/4420-160-0x0000000004D60000-0x0000000004D6A000-memory.dmp
memory/4548-161-0x00007FFE8DC70000-0x00007FFE8E731000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Tmp5152.tmp
| MD5 | 1420d30f964eac2c85b2ccfe968eebce |
| SHA1 | bdf9a6876578a3e38079c4f8cf5d6c79687ad750 |
| SHA256 | f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9 |
| SHA512 | 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8 |
memory/4548-163-0x0000000000730000-0x00000000007F0000-memory.dmp
memory/4420-183-0x00000000057C0000-0x0000000005836000-memory.dmp
memory/2392-185-0x0000000000400000-0x000000000044E000-memory.dmp
memory/2396-184-0x00000000009B0000-0x0000000000A24000-memory.dmp
memory/4548-182-0x000000001B5A0000-0x000000001B5B0000-memory.dmp
memory/2392-188-0x0000000000400000-0x000000000044E000-memory.dmp
memory/4420-187-0x0000000005FE0000-0x0000000005FFE000-memory.dmp
memory/2392-191-0x0000000000400000-0x000000000044E000-memory.dmp
memory/4420-192-0x0000000006860000-0x0000000006E78000-memory.dmp
memory/4420-193-0x00000000063B0000-0x00000000064BA000-memory.dmp
memory/4420-194-0x00000000062F0000-0x0000000006302000-memory.dmp
memory/4420-195-0x0000000006350000-0x000000000638C000-memory.dmp
memory/4420-196-0x00000000064C0000-0x000000000650C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
| MD5 | 0099a99f5ffb3c3ae78af0084136fab3 |
| SHA1 | 0205a065728a9ec1133e8a372b1e3864df776e8c |
| SHA256 | 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226 |
| SHA512 | 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6 |
memory/2396-213-0x00000000009B0000-0x0000000000A24000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
| MD5 | 8510bcf5bc264c70180abe78298e4d5b |
| SHA1 | 2c3a2a85d129b0d750ed146d1d4e4d6274623e28 |
| SHA256 | 096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6 |
| SHA512 | 5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d |
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
| MD5 | 154c3f1334dd435f562672f2664fea6b |
| SHA1 | 51dd25e2ba98b8546de163b8f26e2972a90c2c79 |
| SHA256 | 5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f |
| SHA512 | 1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841 |
memory/404-244-0x0000000071EA0000-0x0000000072650000-memory.dmp
memory/404-245-0x0000000000D00000-0x0000000000D52000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2177723727-746291240-1644359950-1000\76b53b3ec448f7ccdda2063b15d2bfc3_83f067b2-4236-4e0d-83e4-ef79b7da67b0
| MD5 | 6983285f9309351f1a9142b6243e72d9 |
| SHA1 | f456d514a76944bc71161b776f80e425644f01a0 |
| SHA256 | 63107d6564449ff4a03c6e4546ef0343042eff398178b41c742533c6d66bf67e |
| SHA512 | 24ecf79d8698fe0bc16baa9cb410cbd0415164437353ce92ccc14ea8e47e40c1e3d5be2bbf615d6e1c00cfc99077e43740653a55ac90bcb0dd8f9bf84b05bae0 |
C:\Users\Admin\Desktop\Microsoft Edge.lnk
| MD5 | 363fc9bd9d798306dfe9c636628c4c72 |
| SHA1 | 7a8122bd6fc4c0fdd47c1f201f225043e4ce5d05 |
| SHA256 | 4f65bcd0914660041c5ab69b1c440e70887582509c10a481be7c4a3ca819a1f3 |
| SHA512 | 4de90b5ff9a0cfeba0ec5493866cb5eb0ebfb9e118589199ba84dd59cab5cd27806a6ee8c8497a26c4141ec3bc9487d3e3af25373279e250e856069f2aad8447 |
C:\Users\Public\Desktop\Google Chrome.lnk
| MD5 | c28b676b14efb4c26c559063e20f96c9 |
| SHA1 | a5254a724369c8bc65e51205023d9043aabbf74b |
| SHA256 | acf94e15c0d1babdaf46348239df74d1f653da668db06a9eb85c58587c1c82fa |
| SHA512 | efe61c496abd180cf09916ab3af144359818b62b5346fd739135a9c573aff7b47c575871ec1021f5ddfc2cc6b088d8e984f25b49b0f609a2370f64b28196da7c |
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
| MD5 | 586f7fecacd49adab650fae36e2db994 |
| SHA1 | 35d9fb512a8161ce867812633f0a43b042f9a5e6 |
| SHA256 | cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e |
| SHA512 | a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772 |
memory/1920-297-0x0000000000400000-0x000000000063B000-memory.dmp
memory/1920-301-0x0000000000400000-0x000000000063B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
| MD5 | 7fabf15848c951f6665ec449c8c77098 |
| SHA1 | f9ef6114a8e2d3838d0cadd4a71d6baf95e133cf |
| SHA256 | a440e88b2c1d1746b82ffaadaef0571a14f3d76dbabba87b0c3de6ac5eff2f35 |
| SHA512 | 4e8b84b13bf04befb12d2f1b2f36a1a7285be640315c1a8eb61137f77ca2202b62892d95fee02debaa75ca3b5d782a5d0a7a08a010206929187504a91e9ddb0a |
memory/1172-336-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2412-340-0x0000000000850000-0x0000000000D2E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
| MD5 | 6184676075afacb9103ae8cbf542c1ed |
| SHA1 | bc757642ad2fcfd6d1da79c0754323cdc823a937 |
| SHA256 | a0b0b39b69005a2d39a8b8271a3518aa0a55148b794d2b4995b3c87ed183b23b |
| SHA512 | 861ac361b585a069f2274b577b30f2a13baf72a60acd4f22da41885aee92c3975445150822f1072590d7b574ff54eb3abde6a6c4f800988ab9ff4344884f41fa |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | fe3aab3ae544a134b68e881b82b70169 |
| SHA1 | 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6 |
| SHA256 | bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b |
| SHA512 | 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280 |
C:\Users\Admin\Pictures\TTH4GAei4iGWecgTBqyAhtqI.exe
| MD5 | 5b423612b36cde7f2745455c5dd82577 |
| SHA1 | 0187c7c80743b44e9e0c193e993294e3b969cc3d |
| SHA256 | e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09 |
| SHA512 | c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c |
C:\Users\Admin\Pictures\STBeMVgZBxA2Bj1b60uBfcaz.exe
| MD5 | dcc50ec1cc74d2f605b455885e781f40 |
| SHA1 | 594447e41168142a701dff4ce16182f50921a064 |
| SHA256 | bc67a67c9441eb9220a42bda0af159fa9ae2eefcfb83370d28157bed5436dea4 |
| SHA512 | 23422811b4c3ba39b9f4a44654e9547e6e42e8bbac857f02ce086686572860d9964674fc67d8a4020c4794f6bcf98311be51fd0f3dfc6b910bd4f118975886b5 |
memory/1920-413-0x0000000061E00000-0x0000000061EF3000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 7f5130f8643f9c281b6384704d27b900 |
| SHA1 | c384737918a1e492e8742800a251d31de1842de2 |
| SHA256 | e5a21b6e080bd51ab39ae0aa91aa0573951a52aafd2f021263141d0755e1cf8f |
| SHA512 | ff471d00db8f4ec88cd0d52894e4f1a91ad32473cb173b7a5d431def9717cbe106c2ae431869651a3a9fc1801f9997a9d35d22a85cdb605ed98731e6dc129161 |
C:\Program Files (x86)\GameServerClient\installg.bat
| MD5 | b6b57c523f3733580d973f0f79d5c609 |
| SHA1 | 2cc30cfd66817274c84f71d46f60d9e578b7bf95 |
| SHA256 | d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570 |
| SHA512 | d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7 |
C:\Users\Admin\Pictures\cdiThIq1FIpLI4vC0bJnl92o.exe
| MD5 | 1675ad3eadb63a45bd70ef2832a9e961 |
| SHA1 | 3e8dee32889f96950b380c8bbdc2ec1d60b20aa6 |
| SHA256 | dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248 |
| SHA512 | 00ef6585174b73f3b8b73541a289a797b6aa71b5f3aaff1a5eb376f9c83655fc599bd3e4c541bd0c6bbd0de222d2684bc6fc77c28335f6874acd42180901f2bd |
C:\Program Files (x86)\GameServerClient\GameService.exe
| MD5 | d9ec6f3a3b2ac7cd5eef07bd86e3efbc |
| SHA1 | e1908caab6f938404af85a7df0f80f877a4d9ee6 |
| SHA256 | 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c |
| SHA512 | 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4 |
C:\Users\Admin\AppData\Local\Temp\u3f4.0.exe
| MD5 | ce973cd51fa98b694da3eff7cc2f18a4 |
| SHA1 | 8288ebe7f7d07075208160212d240aee5cdc1ad3 |
| SHA256 | 543281e6bc99b7e20ce3719d1fb2d3a8d34d62fd5153d233022c42ee1cc48ed7 |
| SHA512 | 16ec39ed84b8edfaec9fdfb362686ab8008bbf0d6dbaf03dd16d8b9d59faae76a757758c0edf3264e3adeae791c199db15eebcc4c09848923c2e738661befb2d |
C:\Users\Admin\Desktop\Microsoft Edge.lnk
| MD5 | e7ef578c10cbc3d4db9654d85c326d46 |
| SHA1 | a899cdd86af5bfe45d8bc18d3dca626de254c7b6 |
| SHA256 | 03a1027a2cdeb02119708bcc6142381da404e5132fb961609de83703ce3d8ebe |
| SHA512 | c70b3375f234a6e6d99c8b68473f3ff2204b962631194d09d3822fa7ad0061a1de9079031ed8265d8bb2f3cca17e458ec73994df35bd0d8560e4d6fc58a15ff2 |
C:\Users\Public\Desktop\Google Chrome.lnk
| MD5 | 9724b8458f3c40e3cf915fff3957d3a8 |
| SHA1 | 6d3334647cfda73af57118d49c58670b11afcd05 |
| SHA256 | e156545dcab263948c9d337d960ffa6dbba88ad99dc830142c6c3b7a7cdff4eb |
| SHA512 | 97cd3a4bde2cf15ad2aba7f9470f7397f1fd9d60289d8ac53078d184a1682385ce65835dcc22fedfd8707c6051a5532b38940226d3c26582b357feccdad80cde |
C:\Program Files (x86)\GameServerClient\GameServerClient.exe
| MD5 | bf4360d76b38ed71a8ec2391f1985a5f |
| SHA1 | 57d28dc8fd4ac052d0ae32ca22143e7b57733003 |
| SHA256 | 4ebec636d15203378e15cc11967d00cbd17e040db1fca85cf3c10bbf7451adaf |
| SHA512 | 7b46bc87dc384d8227adf5b538861165fa9efa18e28f2de5c1a1bb1a3a9f6bef29b449706c4d8e637ae9805bb51c8548cb761facf82d1c273d3e3699ae727acd |
C:\Windows\Temp\361055.exe
| MD5 | 5c9e996ee95437c15b8d312932e72529 |
| SHA1 | eb174c76a8759f4b85765fa24d751846f4a2d2ef |
| SHA256 | 0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55 |
| SHA512 | 935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b |
C:\Windows\Temp\cudart64_101.dll
| MD5 | 1d7955354884a9058e89bb8ea34415c9 |
| SHA1 | 62c046984afd51877ecadad1eca209fda74c8cb1 |
| SHA256 | 111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e |
| SHA512 | 7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2 |
C:\Program Files (x86)\GameServerClient\installc.bat
| MD5 | a3d3d85bc0b7945908dd1a5eaf6e6266 |
| SHA1 | 8979e79895226f2d05f8af1e10b99e8496348131 |
| SHA256 | 3aad1c9feb23c9383ee7e5c8cb966afd262142b2e0124b8e9cda010ea53f24c6 |
| SHA512 | 9184b09bdc10fb3ec981624f286ab4228917f8b1f5cbec7ee875d468c38461395d970d860e3ff99cb184e8839ed6c3ca85a9eaffdd24f15c74b311623c48f618 |
memory/2412-554-0x0000000000850000-0x0000000000D2E000-memory.dmp
memory/4432-555-0x0000000000400000-0x0000000002C4D000-memory.dmp
memory/2256-557-0x0000000000400000-0x000000000300B000-memory.dmp
memory/1864-558-0x0000000000400000-0x000000000300B000-memory.dmp
C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
| MD5 | 9c3cfd2a7e37af3ed81598469fcbe08a |
| SHA1 | 059bb3b9bb547feedc2bf07c89c9a604aaf04f3d |
| SHA256 | 6991a5928be7bfbb9a18f20bf00121371b4127f8295e5673303bfe044da8f715 |
| SHA512 | 1b48d43d665cbe8588f984a588439d16aac12fc3a9c70cfbf223350221db0e60dedb1ad3b4b83d5b2e7352c3ee402884390647da3189af8e26c307eb5c679edf |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |
C:\Windows\Temp\280740.exe
| MD5 | bfe6b13011bbba05c28109cf6730f8a1 |
| SHA1 | 28da37544341c3587c11c1f1f294505516434d40 |
| SHA256 | 93fc509fc9fad8d0191ceb7fe43ae7be1ed176862eacf0f905120257b15ecbdd |
| SHA512 | d717859dd8b04832588e9ada5f83a8e2953c6214364a189b1b731212a5d4cdd1ac441646339efc9484b38a49d518d70f09624028e0a12921d7f2778fd9982660 |
memory/1864-650-0x0000000000400000-0x000000000300B000-memory.dmp
memory/2256-653-0x0000000000400000-0x000000000300B000-memory.dmp
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
memory/2412-675-0x0000000000850000-0x0000000000D2E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\u3f4.1.zip
| MD5 | 78d3ca6355c93c72b494bb6a498bf639 |
| SHA1 | 2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e |
| SHA256 | a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001 |
| SHA512 | 1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea |
C:\Users\Admin\AppData\Local\Temp\u3f4.2\run.exe
| MD5 | 9fb4770ced09aae3b437c1c6eb6d7334 |
| SHA1 | fe54b31b0db8665aa5b22bed147e8295afc88a03 |
| SHA256 | a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3 |
| SHA512 | 140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256 |
memory/5312-760-0x000000006B850000-0x000000006B9CB000-memory.dmp
memory/5312-761-0x00007FFEAD390000-0x00007FFEAD585000-memory.dmp
C:\Users\Admin\Pictures\eXczqZBOAwwCnquuwXDxnNBj.exe
| MD5 | fe7dfed8bff40b370cfc0193606b48fb |
| SHA1 | 81d5eee5fdedc585ed7b9054911ff2c02ba81814 |
| SHA256 | c34841b1806dfe02a37a2779c4806e88743c3c9bae4009a335099f5afb94eae8 |
| SHA512 | 5524ac8a7f32a27f9a1b1efc4f5be2732f5bfdd364ea8e09bd60d53677b34e4d4b363d29af7ab55066b503bddc515b5e1afd9d3c304ef0bcd3051e4e3580b41f |
memory/5312-782-0x000000006B850000-0x000000006B9CB000-memory.dmp
memory/2412-786-0x0000000000850000-0x0000000000D2E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404251327045293940.dll
| MD5 | 45fe60d943ad11601067bc2840cc01be |
| SHA1 | 911d70a6aad7c10b52789c0312c5528556a2d609 |
| SHA256 | 0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add |
| SHA512 | 30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba |
memory/4432-790-0x0000000000400000-0x0000000002C4D000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\u3f4.3.exe
| MD5 | 397926927bca55be4a77839b1c44de6e |
| SHA1 | e10f3434ef3021c399dbba047832f02b3c898dbd |
| SHA256 | 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7 |
| SHA512 | cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954 |
C:\Users\Admin\Pictures\uOxNr1gliEyAOOdlgJvGRc9D.exe
| MD5 | 69f6614893028c60394f744c7ebc1551 |
| SHA1 | ccd4a9f86876ddbfe2bc86a2b17a4cbc1857b1dd |
| SHA256 | b96a4de2d4f97380388b6b515e8cdef28a92f358a7d487be3463828303d8661d |
| SHA512 | 4a40bcf25303accf93bb15e281a53ee0cda93c1f7c1ede741338b8080daa0a61c6751c5d11ed8ceeec520782913f748298b5016565a31f47c980d8e868461855 |
memory/2640-830-0x0000000000400000-0x0000000002C28000-memory.dmp
C:\Windows\System32\GroupPolicy\gpt.ini
| MD5 | 8ef9853d1881c5fe4d681bfb31282a01 |
| SHA1 | a05609065520e4b4e553784c566430ad9736f19f |
| SHA256 | 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2 |
| SHA512 | 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005 |
memory/4432-853-0x0000000000400000-0x0000000002C4D000-memory.dmp
memory/5360-863-0x00007FFEAD390000-0x00007FFEAD585000-memory.dmp
C:\Users\Admin\Pictures\jQum0P5VUkSaOJsw5krz4q3u.exe
| MD5 | d981fb3fc1f28bea729db051c75dae08 |
| SHA1 | d5eea12045a6d998da1a362f70748fc09874d0b4 |
| SHA256 | aa5689332012817778e4ef3602e918297c567c4d573b463f86e8d98fef2eb48f |
| SHA512 | a93576bc04ac5b1ba129913c3d4e5100cf7f0f8bd7a4c9a21ce3af645624890006e087eefa5d0cbd804b7b96ebc13cf32a722b8c1d66d409879f41d5bfa974cb |
memory/2412-891-0x0000000000850000-0x0000000000D2E000-memory.dmp
memory/2096-889-0x0000000010000000-0x0000000013BC3000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
| MD5 | 4a6f4cd875ee0b1671c067e68364ed4f |
| SHA1 | efe9991474a9649ba21f388b11d89808d60989d4 |
| SHA256 | 78f61e3135bfd3b69c0ddf2f3acc598c04e014c59f39b54e8355a4ecdc41755b |
| SHA512 | 68c47560d0bfde9c682acf10029631c2b5b1b4a7c7069587f59b91566fd7ba6cfca4d5cc67336fa12c654985c9d8334b9b86e11fbb764c1996f140912944f812 |
memory/2412-931-0x0000000000850000-0x0000000000D2E000-memory.dmp
memory/2432-932-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/2664-933-0x0000000140000000-0x0000000140712000-memory.dmp
memory/5360-940-0x000000006B850000-0x000000006B9CB000-memory.dmp
memory/2412-1004-0x0000000000850000-0x0000000000D2E000-memory.dmp
memory/5648-1005-0x0000000000400000-0x000000000300B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327041\opera_package
| MD5 | 71eefde22964718c287b0738a468cb12 |
| SHA1 | ac348892b2319d01b3f58e6fa990d5808621779d |
| SHA256 | cd04b77bad49240a1fcd919e1bb918b14df13dd42198ba2b5524cedcab12816b |
| SHA512 | 74b7c229b4c2abcd8d7002586ce4dc318b11926475a5783a11177f3c32d5c4a1cd71c9398c24159cc425095d50b468c4a9e0cfcbe16630b1c822672610d3ea12 |
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
| MD5 | a3a700455b2fd4bed5351ee46ae33f2a |
| SHA1 | 56220b3c80991dca57f812bc4f07e4d2e0a661a1 |
| SHA256 | edecc3eb6182ee9ec3fa858194ec51e59b4017fea39f95bb0067559c3353bd56 |
| SHA512 | d65552d1c34a32fbe65cbc730f11dbb1b4b67c3e20a7a609139e8f5627db1b05b86960c2b01525b9cbd5b82b740ad2ec273b4ee672f5c2a2ff52a28d442da1a5 |
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327041\additional_file0.tmp
| MD5 | 15d8c8f36cef095a67d156969ecdb896 |
| SHA1 | a1435deb5866cd341c09e56b65cdda33620fcc95 |
| SHA256 | 1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8 |
| SHA512 | d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a |
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-25 13:25
Reported
2024-04-25 13:27
Platform
win11-20240412-en
Max time kernel
106s
Max time network
150s
Command Line
Signatures
Amadey
Detect ZGRat V1
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Stealc
UAC bypass
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
Windows security bypass
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
ZGRat
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
Downloads MZ/PE file
Stops running service(s)
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Executes dropped EXE
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\system32\rundll32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\rundll32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\u2so.2\run.exe | N/A |
Reads WinSCP keys stored on the system
Reads local data of messenger clients
Reads user/profile data of web browsers
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.myip.com | N/A | N/A |
| N/A | api.myip.com | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 5080 set thread context of 1956 | N/A | C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 764 set thread context of 4504 | N/A | C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 2820 set thread context of 2040 | N/A | C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 1032 set thread context of 3872 | N/A | C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 1656 set thread context of 412 | N/A | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files (x86)\GameServerClient\GameServerClient.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\GameServerClientC.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameServerClient\GameService.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\GameServerClient.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameServerClient\GameServerClientC.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\installc.bat | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameServerClient\installc.bat | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\installg.bat | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File opened for modification | C:\Program Files (x86)\GameServerClient\installg.bat | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
| File created | C:\Program Files (x86)\GameServerClient\GameService.exe | C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\chrosha.job | C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
Enumerates physical storage devices
Program crash
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 | C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 | C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\u2so.2\run.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\u2so.2\run.exe | N/A |
Suspicious use of WriteProcessMemory
System policy modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" | C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe
"C:\Users\Admin\AppData\Local\Temp\0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2.exe"
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5080 -ip 5080
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 892
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\017659663955_Desktop.zip' -CompressionLevel Optimal
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 764 -ip 764
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 364
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2820 -ip 2820
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 400
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
C:\Users\Admin\Pictures\QAnThTTn5ip1prAOqfZqGjPo.exe
"C:\Users\Admin\Pictures\QAnThTTn5ip1prAOqfZqGjPo.exe"
C:\Users\Admin\Pictures\PM3qPQqrmNGC83o9hlpGNsNF.exe
"C:\Users\Admin\Pictures\PM3qPQqrmNGC83o9hlpGNsNF.exe"
C:\Users\Admin\Pictures\JKy7xadChbfaL3AsyJRDmIeB.exe
"C:\Users\Admin\Pictures\JKy7xadChbfaL3AsyJRDmIeB.exe"
C:\Users\Admin\AppData\Local\Temp\u2so.0.exe
"C:\Users\Admin\AppData\Local\Temp\u2so.0.exe"
C:\Users\Admin\AppData\Local\Temp\u2so.2\run.exe
"C:\Users\Admin\AppData\Local\Temp\u2so.2\run.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
"C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "
C:\Windows\SysWOW64\sc.exe
Sc delete GameServerClient
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService remove GameServerClient confirm
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService start GameServerClient
C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
C:\Program Files (x86)\GameServerClient\GameServerClient.exe
"C:\Program Files (x86)\GameServerClient\GameServerClient.exe"
C:\Windows\Temp\924548.exe
"C:\Windows\Temp\924548.exe" --list-devices
C:\Users\Admin\AppData\Local\Temp\u2so.3.exe
"C:\Users\Admin\AppData\Local\Temp\u2so.3.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3624 -ip 3624
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 1216
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "
C:\Windows\SysWOW64\sc.exe
Sc delete GameServerClientC
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService remove GameServerClientC confirm
C:\Users\Admin\Pictures\attqW5QZ2pQwcjc6CnDbctZQ.exe
"C:\Users\Admin\Pictures\attqW5QZ2pQwcjc6CnDbctZQ.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3064 -ip 3064
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 1096
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
C:\Program Files (x86)\GameServerClient\GameService.exe
GameService start GameServerClientC
C:\Program Files (x86)\GameServerClient\GameService.exe
"C:\Program Files (x86)\GameServerClient\GameService.exe"
C:\Users\Admin\Pictures\QAnThTTn5ip1prAOqfZqGjPo.exe
"C:\Users\Admin\Pictures\QAnThTTn5ip1prAOqfZqGjPo.exe"
C:\Users\Admin\Pictures\PM3qPQqrmNGC83o9hlpGNsNF.exe
"C:\Users\Admin\Pictures\PM3qPQqrmNGC83o9hlpGNsNF.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4288 -ip 4288
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 460 -ip 460
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 1000
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 848
C:\Users\Admin\Pictures\8T4Cl6dXMcTwUuqCf6C1NBhE.exe
"C:\Users\Admin\Pictures\8T4Cl6dXMcTwUuqCf6C1NBhE.exe" --silent --allusers=0
C:\Users\Admin\Pictures\8T4Cl6dXMcTwUuqCf6C1NBhE.exe
C:\Users\Admin\Pictures\8T4Cl6dXMcTwUuqCf6C1NBhE.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6f12e1d0,0x6f12e1dc,0x6f12e1e8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 460 -ip 460
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\8T4Cl6dXMcTwUuqCf6C1NBhE.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\8T4Cl6dXMcTwUuqCf6C1NBhE.exe" --version
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4288 -ip 4288
C:\Users\Admin\Pictures\8T4Cl6dXMcTwUuqCf6C1NBhE.exe
"C:\Users\Admin\Pictures\8T4Cl6dXMcTwUuqCf6C1NBhE.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1052 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240425132705" --session-guid=c9baee20-7bcc-4e39-9356-26261f570b29 --server-tracking-blob="Y2JjMDc3OGJiZTJlYTBhNzY0OTU0MjQ2NTc5ODQ3ZDkxNjI2ZDE4NWRiYWYwNjlhMmJmMmM0MzMzOWVlMjNlZjp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MDUxNTk3Ljk4NzQiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiOGE5MjhiNzgtODdkNC00YWMzLTgyZGEtOWQzNDE5Yzg5ZDQyIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2804000000000000
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 636
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 916
C:\Users\Admin\Pictures\8T4Cl6dXMcTwUuqCf6C1NBhE.exe
C:\Users\Admin\Pictures\8T4Cl6dXMcTwUuqCf6C1NBhE.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2bc,0x2c0,0x2c4,0x28c,0x2c8,0x6e63e1d0,0x6e63e1dc,0x6e63e1e8
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4288 -ip 4288
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 460 -ip 460
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 724
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 916
C:\Program Files (x86)\GameServerClient\GameServerClientC.exe
"C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"
C:\Windows\Temp\364076.exe
"C:\Windows\Temp\364076.exe" --coin BTC -m ADDRESSES -t 0 --range 380c0552340000000:380c0552380000000 -o xxx0.txt -i C:\Windows\Temp\curjob.bin
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327051\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327051\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327051\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327051\assistant\assistant_installer.exe" --version
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327051\assistant\assistant_installer.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327051\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0xa96038,0xa96044,0xa96050
C:\Users\Admin\Pictures\1p2Llw556mvhOSUIMpHSQzl6.exe
"C:\Users\Admin\Pictures\1p2Llw556mvhOSUIMpHSQzl6.exe"
C:\Users\Admin\AppData\Local\Temp\7zSA2ED.tmp\Install.exe
.\Install.exe /RvdidblCuX "385118" /S
Network
| Country | Destination | Domain | Proto |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 8.8.8.8:53 | 167.132.233.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 104.21.67.211:443 | affordcharmcropwo.shop | tcp |
| US | 104.21.72.132:443 | cleartotalfisherwo.shop | tcp |
| US | 8.8.8.8:53 | 132.72.21.104.in-addr.arpa | udp |
| US | 104.21.44.125:443 | worryfillvolcawoi.shop | tcp |
| US | 188.114.96.2:443 | realdeepai.org | tcp |
| US | 8.8.8.8:53 | 125.44.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.96.114.188.in-addr.arpa | udp |
| US | 172.67.205.132:443 | dismissalcylinderhostw.shop | tcp |
| US | 104.21.23.143:443 | diskretainvigorousiw.shop | tcp |
| US | 172.67.166.251:443 | communicationgenerwo.shop | tcp |
| US | 104.21.47.56:443 | pillowbrocccolipe.shop | tcp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 104.21.11.250:443 | productivelookewr.shop | tcp |
| DE | 185.172.128.19:80 | 185.172.128.19 | tcp |
| DE | 185.172.128.33:8970 | tcp | |
| US | 172.67.147.41:443 | tolerateilusidjukl.shop | tcp |
| US | 172.67.169.43:443 | shatterbreathepsw.shop | tcp |
| US | 8.8.8.8:53 | 41.147.67.172.in-addr.arpa | udp |
| DE | 185.172.128.19:80 | 185.172.128.19 | tcp |
| US | 104.21.16.225:443 | shortsvelventysjo.shop | tcp |
| US | 104.21.86.106:443 | incredibleextedwj.shop | tcp |
| RU | 5.42.65.67:48396 | tcp | |
| US | 104.21.48.243:443 | alcojoldwograpciw.shop | tcp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 104.21.44.3:443 | liabilitynighstjsko.shop | tcp |
| US | 8.8.8.8:53 | demonstationfukewko.shop | udp |
| US | 104.21.33.174:443 | demonstationfukewko.shop | tcp |
| RU | 185.215.113.67:26260 | tcp | |
| RU | 193.233.132.234:80 | 193.233.132.234 | tcp |
| FR | 52.143.157.84:80 | 52.143.157.84 | tcp |
| RU | 77.221.151.47:80 | 77.221.151.47 | tcp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| US | 104.21.79.77:443 | yip.su | tcp |
| DE | 185.172.128.59:80 | 185.172.128.59 | tcp |
| RU | 193.233.132.234:80 | 193.233.132.234 | tcp |
| RU | 193.233.132.175:80 | 193.233.132.175 | tcp |
| RU | 193.233.132.234:80 | 193.233.132.234 | tcp |
| US | 8.8.8.8:53 | net.geo.opera.com | udp |
| NL | 185.26.182.111:80 | net.geo.opera.com | tcp |
| NL | 185.26.182.111:443 | net.geo.opera.com | tcp |
| US | 8.8.8.8:53 | 77.79.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 111.182.26.185.in-addr.arpa | udp |
| US | 172.67.188.178:443 | iplogger.com | tcp |
| US | 188.114.97.2:443 | realdeepai.org | tcp |
| US | 188.114.97.2:443 | realdeepai.org | tcp |
| US | 172.67.176.131:443 | jonathantwo.com | tcp |
| US | 172.67.176.131:443 | jonathantwo.com | tcp |
| DE | 185.172.128.90:80 | 185.172.128.90 | tcp |
| DE | 185.172.128.228:80 | 185.172.128.228 | tcp |
| DE | 185.172.128.59:80 | 185.172.128.59 | tcp |
| RO | 176.97.76.106:80 | note.padd.cn.com | tcp |
| DE | 185.172.128.228:80 | 185.172.128.228 | tcp |
| US | 20.157.87.45:80 | svc.iolo.com | tcp |
| DE | 185.172.128.76:80 | 185.172.128.76 | tcp |
| RU | 5.42.66.10:80 | 5.42.66.10 | tcp |
| US | 172.67.75.163:443 | api.myip.com | tcp |
| US | 8.8.8.8:53 | ipinfo.io | udp |
| NL | 82.145.216.20:443 | autoupdate.geo.opera.com | tcp |
| NL | 82.145.216.20:443 | autoupdate.geo.opera.com | tcp |
| US | 34.117.186.192:443 | ipinfo.io | tcp |
| NL | 82.145.217.121:443 | desktop-netinstaller-sub.osp.opera.software | tcp |
| US | 8.8.8.8:53 | 192.186.117.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 121.217.145.82.in-addr.arpa | udp |
| RU | 77.221.151.47:8080 | tcp | |
| NL | 82.145.216.15:443 | features.opera-api2.com | tcp |
| FR | 185.93.2.244:443 | download.iolo.net | tcp |
| NL | 82.145.217.121:443 | desktop-netinstaller-sub.osp.opera.software | tcp |
| NL | 185.26.182.122:443 | download.opera.com | tcp |
| US | 104.18.11.89:443 | download5.operacdn.com | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 20.157.87.45:80 | svc.iolo.com | tcp |
| NL | 82.145.217.121:443 | desktop-netinstaller-sub.osp.opera.software | tcp |
| RU | 91.215.85.66:15647 | tcp | |
| US | 2.16.106.162:443 | download3.operacdn.com | tcp |
Files
memory/5104-0-0x0000000000430000-0x000000000090E000-memory.dmp
memory/5104-1-0x0000000077516000-0x0000000077518000-memory.dmp
memory/5104-2-0x0000000000430000-0x000000000090E000-memory.dmp
memory/5104-4-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/5104-5-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/5104-3-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
memory/5104-6-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
memory/5104-7-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
memory/5104-8-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/5104-9-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/5104-14-0x0000000000430000-0x000000000090E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
| MD5 | d29e40c77247d5eea4c4029b804aa549 |
| SHA1 | 9031e95e7c03ebe7b7c1e828bf18325a76972168 |
| SHA256 | 0baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2 |
| SHA512 | 3a50c63887f677aae90fb976b5c8677f913447cb6700eeb83bcc261e60d2d394f8876350b10e6c6b4e1906a7f05777eb6379346dbf0d618f1e3e35febbf5a4cf |
memory/4908-17-0x0000000000D20000-0x00000000011FE000-memory.dmp
memory/4908-18-0x0000000000D20000-0x00000000011FE000-memory.dmp
memory/4908-19-0x0000000005580000-0x0000000005581000-memory.dmp
memory/4908-20-0x0000000005590000-0x0000000005591000-memory.dmp
memory/4908-21-0x0000000005570000-0x0000000005571000-memory.dmp
memory/4908-22-0x00000000055B0000-0x00000000055B1000-memory.dmp
memory/4908-23-0x0000000005550000-0x0000000005551000-memory.dmp
memory/4908-24-0x0000000005560000-0x0000000005561000-memory.dmp
memory/4908-25-0x00000000055D0000-0x00000000055D1000-memory.dmp
memory/4908-26-0x00000000055C0000-0x00000000055C1000-memory.dmp
memory/4908-27-0x0000000000D20000-0x00000000011FE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
| MD5 | 1c7d0f34bb1d85b5d2c01367cc8f62ef |
| SHA1 | 33aedadb5361f1646cffd68791d72ba5f1424114 |
| SHA256 | e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c |
| SHA512 | 53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d |
memory/5080-47-0x0000000000FF0000-0x0000000001042000-memory.dmp
memory/5080-48-0x0000000072ED0000-0x0000000073681000-memory.dmp
memory/1956-51-0x0000000000400000-0x000000000044C000-memory.dmp
memory/1956-54-0x0000000000400000-0x000000000044C000-memory.dmp
memory/5080-55-0x0000000003500000-0x0000000005500000-memory.dmp
memory/1956-56-0x0000000000B30000-0x0000000000B31000-memory.dmp
memory/4908-57-0x0000000000D20000-0x00000000011FE000-memory.dmp
memory/1956-58-0x0000000000400000-0x000000000044C000-memory.dmp
memory/5080-59-0x0000000072ED0000-0x0000000073681000-memory.dmp
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
| MD5 | f35b671fda2603ec30ace10946f11a90 |
| SHA1 | 059ad6b06559d4db581b1879e709f32f80850872 |
| SHA256 | 83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7 |
| SHA512 | b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705 |
memory/4908-72-0x0000000000D20000-0x00000000011FE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_le04qbdf.m55.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4276-83-0x00000224A3EB0000-0x00000224A3EC0000-memory.dmp
memory/4276-82-0x00007FFE31500000-0x00007FFE31FC2000-memory.dmp
memory/4276-81-0x00000224A3CC0000-0x00000224A3CE2000-memory.dmp
memory/4276-84-0x00000224A3EB0000-0x00000224A3EC0000-memory.dmp
memory/4276-85-0x00000224A3EB0000-0x00000224A3EC0000-memory.dmp
memory/4276-86-0x00000224A3D30000-0x00000224A3D42000-memory.dmp
memory/4276-87-0x00000224A3D20000-0x00000224A3D2A000-memory.dmp
memory/4276-93-0x00007FFE31500000-0x00007FFE31FC2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
| MD5 | 31841361be1f3dc6c2ce7756b490bf0f |
| SHA1 | ff2506641a401ac999f5870769f50b7326f7e4eb |
| SHA256 | 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee |
| SHA512 | 53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019 |
memory/4908-109-0x0000000000D20000-0x00000000011FE000-memory.dmp
memory/764-111-0x0000000000DA0000-0x0000000001058000-memory.dmp
memory/4504-112-0x0000000000400000-0x0000000000592000-memory.dmp
memory/4504-116-0x0000000002CB0000-0x0000000002CC0000-memory.dmp
memory/4504-113-0x0000000072C40000-0x00000000733F1000-memory.dmp
memory/764-117-0x0000000000DA0000-0x0000000001058000-memory.dmp
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
| MD5 | 0c582da789c91878ab2f1b12d7461496 |
| SHA1 | 238bd2408f484dd13113889792d6e46d6b41c5ba |
| SHA256 | a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67 |
| SHA512 | a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a |
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
| MD5 | 20ae0bb07ba77cb3748aa63b6eb51afb |
| SHA1 | 87c468dc8f3d90a63833d36e4c900fa88d505c6d |
| SHA256 | daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d |
| SHA512 | db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2 |
memory/4796-137-0x0000000072C40000-0x00000000733F1000-memory.dmp
memory/4796-138-0x0000000000010000-0x0000000000062000-memory.dmp
memory/4796-139-0x0000000004F30000-0x00000000054D6000-memory.dmp
memory/4796-140-0x0000000004A20000-0x0000000004AB2000-memory.dmp
memory/4796-142-0x0000000004B80000-0x0000000004B90000-memory.dmp
memory/4796-143-0x00000000049F0000-0x00000000049FA000-memory.dmp
memory/4532-145-0x00007FFE31500000-0x00007FFE31FC2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Tmp8316.tmp
| MD5 | 1420d30f964eac2c85b2ccfe968eebce |
| SHA1 | bdf9a6876578a3e38079c4f8cf5d6c79687ad750 |
| SHA256 | f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9 |
| SHA512 | 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8 |
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
| MD5 | b22521fb370921bb5d69bf8deecce59e |
| SHA1 | 3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea |
| SHA256 | b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158 |
| SHA512 | 1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c |
memory/4532-144-0x00000000005E0000-0x00000000006A0000-memory.dmp
memory/4532-169-0x000000001B490000-0x000000001B4A0000-memory.dmp
memory/4796-170-0x0000000005560000-0x00000000055D6000-memory.dmp
memory/2040-178-0x0000000000400000-0x000000000044E000-memory.dmp
memory/2820-179-0x00000000003B0000-0x0000000000424000-memory.dmp
memory/4796-181-0x0000000005D00000-0x0000000005D1E000-memory.dmp
memory/2040-182-0x0000000000400000-0x000000000044E000-memory.dmp
memory/2040-185-0x0000000000400000-0x000000000044E000-memory.dmp
memory/4796-186-0x0000000006580000-0x0000000006B98000-memory.dmp
memory/4796-187-0x00000000060D0000-0x00000000061DA000-memory.dmp
memory/4796-188-0x0000000006010000-0x0000000006022000-memory.dmp
memory/4796-189-0x0000000006070000-0x00000000060AC000-memory.dmp
memory/4796-190-0x00000000061E0000-0x000000000622C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
| MD5 | 0099a99f5ffb3c3ae78af0084136fab3 |
| SHA1 | 0205a065728a9ec1133e8a372b1e3864df776e8c |
| SHA256 | 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226 |
| SHA512 | 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6 |
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
| MD5 | 154c3f1334dd435f562672f2664fea6b |
| SHA1 | 51dd25e2ba98b8546de163b8f26e2972a90c2c79 |
| SHA256 | 5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f |
| SHA512 | 1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841 |
memory/4532-218-0x000000001B490000-0x000000001B4A0000-memory.dmp
memory/4532-219-0x000000001D940000-0x000000001DA4A000-memory.dmp
memory/4532-220-0x000000001C1F0000-0x000000001C202000-memory.dmp
memory/4532-221-0x000000001C440000-0x000000001C47C000-memory.dmp
memory/4504-222-0x0000000072C40000-0x00000000733F1000-memory.dmp
memory/4532-223-0x000000001B490000-0x000000001B4A0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
| MD5 | 8510bcf5bc264c70180abe78298e4d5b |
| SHA1 | 2c3a2a85d129b0d750ed146d1d4e4d6274623e28 |
| SHA256 | 096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6 |
| SHA512 | 5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-801765966-3955847401-2235691403-1000\76b53b3ec448f7ccdda2063b15d2bfc3_46facfa6-6cf2-4847-999f-1119d7ee97f4
| MD5 | 6299815cf50d229d5c99a1708db05bf0 |
| SHA1 | 54f4fbc6424d692572298760f9b054a08df0f708 |
| SHA256 | a48e061d1dc11aba0aad4b83f2b0b92a928ef2859538ce10a89bf19386daa492 |
| SHA512 | 2514ace9a555fa9bc751e60ec1ff5c2de24a62c41075324ff903ec9f482fc33f2b6b396e16cb55d582f9724adb70a7b0b33c4f02d96a0cc422b7d1e045346b6e |
C:\Users\Admin\Desktop\Microsoft Edge.lnk
| MD5 | e616e802c7c321c0f3b5af7c3f302fad |
| SHA1 | 6816a8b855036529e51b93b3b4f351ff035c5033 |
| SHA256 | 683458e127a2906bf57c930872539c719ff648242fb13fc917511984d6769806 |
| SHA512 | 440da6fb1b59e7e3a828144688086fcb1009f27410ec65a208a8a9cd084375f9a9e4533259addc80c524eb12227d4136f9c8c3cc50f35cdba13ea63641e709f3 |
C:\Users\Public\Desktop\Google Chrome.lnk
| MD5 | ded923608e0c1a64ee39b7a09b7f8629 |
| SHA1 | 9140fc51e1cfa580941accabb9586622c278dab3 |
| SHA256 | 15df7e8886dbb0f7e43f792416d5f8122e276a1b50a3f9ca4c5e326dc2eac62b |
| SHA512 | 06b4d11ba1a218f654679adb5fd0753b85213bb6b035b1ca3d57cd5735017b830c17a4858b9287bb28928ecddeb412c91952d148406679f10e06e1958d1788a5 |
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
| MD5 | 586f7fecacd49adab650fae36e2db994 |
| SHA1 | 35d9fb512a8161ce867812633f0a43b042f9a5e6 |
| SHA256 | cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e |
| SHA512 | a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772 |
memory/4908-289-0x0000000000D20000-0x00000000011FE000-memory.dmp
memory/3872-295-0x0000000000400000-0x000000000063B000-memory.dmp
memory/3872-301-0x0000000000400000-0x000000000063B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe
| MD5 | 7fabf15848c951f6665ec449c8c77098 |
| SHA1 | f9ef6114a8e2d3838d0cadd4a71d6baf95e133cf |
| SHA256 | a440e88b2c1d1746b82ffaadaef0571a14f3d76dbabba87b0c3de6ac5eff2f35 |
| SHA512 | 4e8b84b13bf04befb12d2f1b2f36a1a7285be640315c1a8eb61137f77ca2202b62892d95fee02debaa75ca3b5d782a5d0a7a08a010206929187504a91e9ddb0a |
memory/412-332-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | ae626d9a72417b14570daa8fcd5d34a4 |
| SHA1 | c103ebaf4d760df722d620df87e6f07c0486439f |
| SHA256 | 52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a |
| SHA512 | a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | b3a83d0196afc480a90a1e7444210036 |
| SHA1 | 6376ef283df20976769287b3bdc6bcd5d5ce371f |
| SHA256 | 3ac4190b1c447f3b5365b056150575ec779ffba10b82d940c93009e2f6809a07 |
| SHA512 | dfff8f23370ae8ab390b8a3dd675dd71ca6a8d0fac0f0c9a8b43453763ba5fa96a79a4b5a8891bcac86996471b912ca51dfc6b877d647391d14e355191d77370 |
C:\Users\Admin\Pictures\X8gs9XTl2E6EctyOhFx5NkbZ.exe
| MD5 | 5b423612b36cde7f2745455c5dd82577 |
| SHA1 | 0187c7c80743b44e9e0c193e993294e3b969cc3d |
| SHA256 | e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09 |
| SHA512 | c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c |
memory/3872-368-0x0000000061E00000-0x0000000061EF3000-memory.dmp
C:\Users\Public\Desktop\Google Chrome.lnk
| MD5 | 96e016990a25fcfe2314ecf7bb50dbd1 |
| SHA1 | 72ba4d8be223f339c908e65f6f1eb624fbf095a8 |
| SHA256 | 4adc2c882be16ff18f75e397301c783ce79bef5275ce011d78da339d619cefb4 |
| SHA512 | d3947c9806b440be263c95de545a9d9d085f3a07c6d83699a1d8c16fc3ef3e648bbe7f249869ae26fe375c9d85a1ff18a2deec7e82e5d11092b3d71526806ffb |
C:\Users\Admin\Desktop\Microsoft Edge.lnk
| MD5 | 170335c49da7aa1e445451877d982a63 |
| SHA1 | a0ea5732b5fccb8c3ca832e76ff035eee8ec7bd9 |
| SHA256 | 5c9961ad19beb980e2f8354f81a9400002671aa89596d0c5082feb7073fee5b1 |
| SHA512 | bbe8b3850d687ee292099e8b331ee9a54f12444bfca1d8e590d3386c2d786fd8f22f99ef4d77a3a887069418d5729c5b16643f6aae7ab79892b40a573246cf35 |
C:\Users\Admin\Pictures\QAnThTTn5ip1prAOqfZqGjPo.exe
| MD5 | 1675ad3eadb63a45bd70ef2832a9e961 |
| SHA1 | 3e8dee32889f96950b380c8bbdc2ec1d60b20aa6 |
| SHA256 | dc6ad8958e0b1b4f17911d19cb5bf4ac897383c575dfee9a3ab95d1c009c6248 |
| SHA512 | 00ef6585174b73f3b8b73541a289a797b6aa71b5f3aaff1a5eb376f9c83655fc599bd3e4c541bd0c6bbd0de222d2684bc6fc77c28335f6874acd42180901f2bd |
memory/4908-441-0x0000000000D20000-0x00000000011FE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe
| MD5 | 6184676075afacb9103ae8cbf542c1ed |
| SHA1 | bc757642ad2fcfd6d1da79c0754323cdc823a937 |
| SHA256 | a0b0b39b69005a2d39a8b8271a3518aa0a55148b794d2b4995b3c87ed183b23b |
| SHA512 | 861ac361b585a069f2274b577b30f2a13baf72a60acd4f22da41885aee92c3975445150822f1072590d7b574ff54eb3abde6a6c4f800988ab9ff4344884f41fa |
C:\Users\Admin\Pictures\JKy7xadChbfaL3AsyJRDmIeB.exe
| MD5 | dcc50ec1cc74d2f605b455885e781f40 |
| SHA1 | 594447e41168142a701dff4ce16182f50921a064 |
| SHA256 | bc67a67c9441eb9220a42bda0af159fa9ae2eefcfb83370d28157bed5436dea4 |
| SHA512 | 23422811b4c3ba39b9f4a44654e9547e6e42e8bbac857f02ce086686572860d9964674fc67d8a4020c4794f6bcf98311be51fd0f3dfc6b910bd4f118975886b5 |
C:\Users\Admin\AppData\Local\Temp\u2so.0.exe
| MD5 | ce973cd51fa98b694da3eff7cc2f18a4 |
| SHA1 | 8288ebe7f7d07075208160212d240aee5cdc1ad3 |
| SHA256 | 543281e6bc99b7e20ce3719d1fb2d3a8d34d62fd5153d233022c42ee1cc48ed7 |
| SHA512 | 16ec39ed84b8edfaec9fdfb362686ab8008bbf0d6dbaf03dd16d8b9d59faae76a757758c0edf3264e3adeae791c199db15eebcc4c09848923c2e738661befb2d |
memory/4908-504-0x0000000000D20000-0x00000000011FE000-memory.dmp
memory/4288-505-0x0000000000400000-0x000000000300B000-memory.dmp
memory/460-507-0x0000000000400000-0x000000000300B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\u2so.1.zip
| MD5 | 78d3ca6355c93c72b494bb6a498bf639 |
| SHA1 | 2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e |
| SHA256 | a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001 |
| SHA512 | 1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea |
C:\Users\Admin\AppData\Local\Temp\u2so.2\run.exe
| MD5 | 9fb4770ced09aae3b437c1c6eb6d7334 |
| SHA1 | fe54b31b0db8665aa5b22bed147e8295afc88a03 |
| SHA256 | a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3 |
| SHA512 | 140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256 |
C:\Users\Admin\AppData\Local\Temp\u2so.2\whale.dbf
| MD5 | a723bf46048e0bfb15b8d77d7a648c3e |
| SHA1 | 8952d3c34e9341e4425571e10f22b782695bb915 |
| SHA256 | b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422 |
| SHA512 | ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273 |
C:\Users\Admin\AppData\Local\Temp\u2so.2\relay.dll
| MD5 | 10d51becd0bbce0fab147ff9658c565e |
| SHA1 | 4689a18112ff876d3c066bc8c14a08fd6b7b7a4a |
| SHA256 | 7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed |
| SHA512 | 29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29 |
memory/1096-599-0x000000006B370000-0x000000006B4ED000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\u2so.2\bunch.dat
| MD5 | 1e8237d3028ab52821d69099e0954f97 |
| SHA1 | 30a6ae353adda0c471c6ed5b7a2458b07185abf2 |
| SHA256 | 9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742 |
| SHA512 | a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3 |
memory/1096-600-0x00007FFE52440000-0x00007FFE52649000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\u2so.2\UIxMarketPlugin.dll
| MD5 | d1ba9412e78bfc98074c5d724a1a87d6 |
| SHA1 | 0572f98d78fb0b366b5a086c2a74cc68b771d368 |
| SHA256 | cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15 |
| SHA512 | 8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f |
memory/3624-606-0x0000000000400000-0x0000000002C4D000-memory.dmp
C:\Program Files (x86)\GameServerClient\installg.bat
| MD5 | b6b57c523f3733580d973f0f79d5c609 |
| SHA1 | 2cc30cfd66817274c84f71d46f60d9e578b7bf95 |
| SHA256 | d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570 |
| SHA512 | d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7 |
C:\Program Files (x86)\GameServerClient\GameService.exe
| MD5 | d9ec6f3a3b2ac7cd5eef07bd86e3efbc |
| SHA1 | e1908caab6f938404af85a7df0f80f877a4d9ee6 |
| SHA256 | 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c |
| SHA512 | 1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4 |
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
memory/1096-682-0x000000006B370000-0x000000006B4ED000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\e411c9cd
| MD5 | 8dfab69832bfd20551d48f14f86ad217 |
| SHA1 | 61cdbcf66f3321d31a177e5bc07866e7d4c749f4 |
| SHA256 | a978e0fd3b69c25c01fb1fc79e9533943e7459d69437189db1ff098c93127846 |
| SHA512 | 13721a1dfb81378c832b3b58c8760417584ceda50e0c5da04ca4205706c339caf9d01cfa0c793335a7e48a64b2cf5a601e1b279660ce0be9c5e821be6cf3ffb9 |
memory/4288-686-0x0000000000400000-0x000000000300B000-memory.dmp
C:\Program Files (x86)\GameServerClient\GameServerClient.exe
| MD5 | bf4360d76b38ed71a8ec2391f1985a5f |
| SHA1 | 57d28dc8fd4ac052d0ae32ca22143e7b57733003 |
| SHA256 | 4ebec636d15203378e15cc11967d00cbd17e040db1fca85cf3c10bbf7451adaf |
| SHA512 | 7b46bc87dc384d8227adf5b538861165fa9efa18e28f2de5c1a1bb1a3a9f6bef29b449706c4d8e637ae9805bb51c8548cb761facf82d1c273d3e3699ae727acd |
C:\Windows\Temp\924548.exe
| MD5 | 5c9e996ee95437c15b8d312932e72529 |
| SHA1 | eb174c76a8759f4b85765fa24d751846f4a2d2ef |
| SHA256 | 0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55 |
| SHA512 | 935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b |
C:\Windows\Temp\cudart64_101.dll
| MD5 | 1d7955354884a9058e89bb8ea34415c9 |
| SHA1 | 62c046984afd51877ecadad1eca209fda74c8cb1 |
| SHA256 | 111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e |
| SHA512 | 7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2 |
memory/4908-705-0x0000000000D20000-0x00000000011FE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\u2so.3.exe
| MD5 | 397926927bca55be4a77839b1c44de6e |
| SHA1 | e10f3434ef3021c399dbba047832f02b3c898dbd |
| SHA256 | 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7 |
| SHA512 | cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954 |
memory/460-742-0x0000000000400000-0x000000000300B000-memory.dmp
memory/3624-754-0x0000000000400000-0x0000000002C4D000-memory.dmp
memory/4708-764-0x00007FFE52440000-0x00007FFE52649000-memory.dmp
C:\Users\Admin\Pictures\attqW5QZ2pQwcjc6CnDbctZQ.exe
| MD5 | 69f6614893028c60394f744c7ebc1551 |
| SHA1 | ccd4a9f86876ddbfe2bc86a2b17a4cbc1857b1dd |
| SHA256 | b96a4de2d4f97380388b6b515e8cdef28a92f358a7d487be3463828303d8661d |
| SHA512 | 4a40bcf25303accf93bb15e281a53ee0cda93c1f7c1ede741338b8080daa0a61c6751c5d11ed8ceeec520782913f748298b5016565a31f47c980d8e868461855 |
C:\Windows\System32\GroupPolicy\gpt.ini
| MD5 | 8ef9853d1881c5fe4d681bfb31282a01 |
| SHA1 | a05609065520e4b4e553784c566430ad9736f19f |
| SHA256 | 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2 |
| SHA512 | 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005 |
C:\Users\Admin\Pictures\8T4Cl6dXMcTwUuqCf6C1NBhE.exe
| MD5 | 3f8f5920179ed4599dd289b51069c6eb |
| SHA1 | 605cdce8dfa405f64568f16f8f24d8e25dfb2cc9 |
| SHA256 | ca8e7ba9da8d190aad74e9e646f8cffd74fce1729b5146f11212f3d15d7bf6a7 |
| SHA512 | 870323211eeb769a0837df6815b162aec27950454e4ef37fee505885255e0f221490d05758085ee8b6a0e727f0f2e6a2cb09b7052e444b8e9d1b6061eed4526f |
C:\Users\Admin\AppData\Local\Temp\Opera_installer_240425132705815996.dll
| MD5 | 45fe60d943ad11601067bc2840cc01be |
| SHA1 | 911d70a6aad7c10b52789c0312c5528556a2d609 |
| SHA256 | 0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add |
| SHA512 | 30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba |
memory/4288-831-0x0000000000400000-0x000000000300B000-memory.dmp
memory/460-834-0x0000000000400000-0x000000000300B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
| MD5 | 92dcdc6da6651a64e789c685a7eed8f0 |
| SHA1 | 26a18a9ff07ae6845b991176578a54a43f1b3cfd |
| SHA256 | f3b9b6822a114b0211f1e0e66bdf44e4141c22e8f2fbd1cee72036a5186c2c6f |
| SHA512 | 944190dfd9d8596cb340a76ca01de0de24ee123cf081ed8b2712acad8cbb56e2c51b8779e3dc6be61b2314af97c7f2328dfb2bae45b18b038da03a8e437980c9 |
memory/4908-873-0x0000000000D20000-0x00000000011FE000-memory.dmp
memory/3976-874-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/1760-875-0x0000000140000000-0x0000000140712000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
| MD5 | cf9d3c84220568fc466dbda365c431c7 |
| SHA1 | 5011178d73e82374f2306a9d747c6c990eb5e1bc |
| SHA256 | 4a1c134fa226e9cbefbd72f0a43abbae4c674b4e3ab00d39db714495f1692929 |
| SHA512 | a37bef85e03b6b2134194507a1e9c1c59423269b41f4b768758e80d211ebafd5aedb1633d2d2515c2572a2a517ce85f2369e1dcc67d0caf63cba0704555bd0bd |
memory/4908-890-0x0000000000D20000-0x00000000011FE000-memory.dmp
memory/3976-891-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/4708-901-0x000000006B370000-0x000000006B4ED000-memory.dmp
memory/3792-905-0x0000000069E50000-0x000000006B167000-memory.dmp
memory/4908-915-0x0000000000D20000-0x00000000011FE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327051\opera_package
| MD5 | 62e7c3d3a4bde9556c8f6e6939e5ccdf |
| SHA1 | 843308a4a2e40f65c0618663fe3ea8fdefcc7e3e |
| SHA256 | 18df5daad15cf52bc1ceb0957acc2039d336ae954a8a607dba584b19d2f2e964 |
| SHA512 | 785858156a0316f4e33173e6ced475f1ee4f600de76cd42fabf193a93983134d9f8644407067184b8ea075dd89535925f4f714d12ad148576ee346472fd25b9d |
memory/3940-955-0x0000000000400000-0x000000000300B000-memory.dmp
memory/112-956-0x0000000000400000-0x000000000300B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251327051\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
| MD5 | 15d8c8f36cef095a67d156969ecdb896 |
| SHA1 | a1435deb5866cd341c09e56b65cdda33620fcc95 |
| SHA256 | 1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8 |
| SHA512 | d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a |
C:\Users\Admin\Pictures\1p2Llw556mvhOSUIMpHSQzl6.exe
| MD5 | 640762fda65bb54f1e273c5b8738ace4 |
| SHA1 | e010761ffeed0596bcfc7f9c235184a1f55db177 |
| SHA256 | 60150e159279494deaa552a75a249973e5dce1ef86267670edc3bfb83abd372e |
| SHA512 | 2aac1a24cec08277b1fb23963a851938623240cc62428d9f6d232da39416fc4061c59d0da2782ff4e7ccdca6568646a5aff684d250970f51f3580c61d7e8003e |