Analysis Overview
SHA256
951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787
Threat Level: Known bad
The file 951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787 was found to be: Known bad.
Malicious Activity Summary
RedLine
Glupteba
Detect Xworm Payload
Stealc
Detect ZGRat V1
Xworm
RedLine payload
SmokeLoader
Glupteba payload
Amadey
ZGRat
Lumma Stealer
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Downloads MZ/PE file
Checks computer location settings
Checks BIOS information in registry
Identifies Wine through registry keys
Themida packer
Executes dropped EXE
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Drops file in Windows directory
Program crash
Enumerates physical storage devices
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-28 18:27
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-28 18:27
Reported
2024-04-28 18:30
Platform
win10v2004-20240226-en
Max time kernel
157s
Max time network
165s
Command Line
Signatures
Amadey
Detect Xworm Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detect ZGRat V1
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Lumma Stealer
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
SmokeLoader
Stealc
Xworm
ZGRat
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Downloads MZ/PE file
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Themida packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | ip-api.com | N/A | N/A |
| N/A | api.myip.com | N/A | N/A |
| N/A | api.myip.com | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
| N/A | ipinfo.io | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1972 set thread context of 5796 | N/A | C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 2376 set thread context of 4188 | N/A | C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\chrosha.job | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
Enumerates physical storage devices
Program crash
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe
"C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2376 -ip 2376
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1972 -ip 1972
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 332
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 868
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4144 -ip 4144
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 356
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe
"C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
C:\Windows\system32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe
"C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe"
C:\Windows\system32\netsh.exe
netsh wlan show profiles
C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe
"C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe"
C:\Users\Admin\AppData\Local\Temp\u44o.0.exe
"C:\Users\Admin\AppData\Local\Temp\u44o.0.exe"
C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe
"C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe
"C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
C:\Users\Admin\AppData\Local\Temp\u44o.2\run.exe
"C:\Users\Admin\AppData\Local\Temp\u44o.2\run.exe"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Users\Admin\AppData\Local\Temp\u44o.3.exe
"C:\Users\Admin\AppData\Local\Temp\u44o.3.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5352 -ip 5352
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 1552
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe'
C:\Users\Admin\Pictures\utl5SGcJQXeLlQhdRdOW3yKc.exe
"C:\Users\Admin\Pictures\utl5SGcJQXeLlQhdRdOW3yKc.exe"
C:\Users\Admin\Pictures\bTm0qR0uyjbpTVC3AuEkzNZl.exe
"C:\Users\Admin\Pictures\bTm0qR0uyjbpTVC3AuEkzNZl.exe"
C:\Users\Admin\Pictures\fwR9Od4wGbyLYnJHYdxA0AAn.exe
"C:\Users\Admin\Pictures\fwR9Od4wGbyLYnJHYdxA0AAn.exe"
C:\Users\Admin\AppData\Local\Temp\u3ew.0.exe
"C:\Users\Admin\AppData\Local\Temp\u3ew.0.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mstc.exe'
C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe
"C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe" --silent --allusers=0
C:\Users\Admin\Pictures\MqVgsdrvydxEqnV91JhcXMrK.exe
"C:\Users\Admin\Pictures\MqVgsdrvydxEqnV91JhcXMrK.exe"
C:\Users\Admin\AppData\Local\Temp\u3ew.2\run.exe
"C:\Users\Admin\AppData\Local\Temp\u3ew.2\run.exe"
C:\Users\Admin\Pictures\TYq0mRPbrgiK04KheSKfqOuC.exe
"C:\Users\Admin\Pictures\TYq0mRPbrgiK04KheSKfqOuC.exe"
C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe
C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b43e1d0,0x6b43e1dc,0x6b43e1e8
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eX4X2LwZyW6G8seCoyRNE6va.exe
"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eX4X2LwZyW6G8seCoyRNE6va.exe" --version
C:\Users\Admin\AppData\Local\Temp\7zSF301.tmp\Install.exe
.\Install.exe /WkfdidVYT "385118" /S
C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe
"C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2308 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240428182954" --session-guid=42bf30bf-b94e-41f9-92b1-acd4584c9541 --server-tracking-blob="M2I3OWI3YWRiMDNlZTk0YzYzMzNiMzU5YTZiZGU4MDlkMjczNzFjMTk4YzAyMWVkZDhkNDQwNzg5YjgxNGEyNTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MzI4OTc0LjcxMzUiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMjFkNjA2ZmUtMTgyOS00OGIyLWI3MGQtNmE0NTI0YjRmZjVkIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3405000000000000
C:\Users\Admin\AppData\Local\Temp\u3ew.3.exe
"C:\Users\Admin\AppData\Local\Temp\u3ew.3.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4424 -ip 4424
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 1584
C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe
C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x298,0x2a8,0x2ac,0x274,0x2b0,0x6a91e1d0,0x6a91e1dc,0x6a91e1e8
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 18:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSF301.tmp\Install.exe\" Wt /LOwdidUswJ 385118 /S" /V1 /F
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'
C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
C:\Windows\SysWOW64\cmd.exe
/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
\??\c:\windows\SysWOW64\reg.exe
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| GB | 142.250.187.202:443 | tcp | |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.90.14.23.in-addr.arpa | udp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 8.8.8.8:53 | 167.132.233.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | affordcharmcropwo.shop | udp |
| US | 172.67.181.34:443 | affordcharmcropwo.shop | tcp |
| US | 8.8.8.8:53 | cleartotalfisherwo.shop | udp |
| US | 172.67.185.32:443 | cleartotalfisherwo.shop | tcp |
| US | 8.8.8.8:53 | worryfillvolcawoi.shop | udp |
| US | 104.21.44.125:443 | worryfillvolcawoi.shop | tcp |
| US | 8.8.8.8:53 | 34.181.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 32.185.67.172.in-addr.arpa | udp |
| DE | 185.172.128.19:80 | 185.172.128.19 | tcp |
| US | 8.8.8.8:53 | enthusiasimtitleow.shop | udp |
| US | 8.8.8.8:53 | productivelookewr.shop | udp |
| US | 104.21.11.250:443 | productivelookewr.shop | tcp |
| US | 104.21.18.233:443 | enthusiasimtitleow.shop | tcp |
| US | 8.8.8.8:53 | 125.44.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 250.11.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 233.18.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | dismissalcylinderhostw.shop | udp |
| US | 104.21.22.160:443 | dismissalcylinderhostw.shop | tcp |
| US | 8.8.8.8:53 | tolerateilusidjukl.shop | udp |
| US | 172.67.147.41:443 | tolerateilusidjukl.shop | tcp |
| US | 8.8.8.8:53 | shatterbreathepsw.shop | udp |
| US | 104.21.95.19:443 | shatterbreathepsw.shop | tcp |
| US | 8.8.8.8:53 | 160.22.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 41.147.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | diskretainvigorousiw.shop | udp |
| US | 104.21.23.143:443 | diskretainvigorousiw.shop | tcp |
| US | 8.8.8.8:53 | shortsvelventysjo.shop | udp |
| US | 104.21.16.225:443 | shortsvelventysjo.shop | tcp |
| US | 8.8.8.8:53 | communicationgenerwo.shop | udp |
| US | 104.21.83.19:443 | communicationgenerwo.shop | tcp |
| US | 8.8.8.8:53 | incredibleextedwj.shop | udp |
| US | 172.67.218.63:443 | incredibleextedwj.shop | tcp |
| US | 8.8.8.8:53 | 19.95.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 143.23.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.16.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.83.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pillowbrocccolipe.shop | udp |
| DE | 185.172.128.19:80 | 185.172.128.19 | tcp |
| US | 104.21.47.56:443 | pillowbrocccolipe.shop | tcp |
| US | 8.8.8.8:53 | alcojoldwograpciw.shop | udp |
| US | 172.67.157.23:443 | alcojoldwograpciw.shop | tcp |
| DE | 185.172.128.59:80 | 185.172.128.59 | tcp |
| US | 8.8.8.8:53 | 63.218.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.47.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 23.157.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | liabilitynighstjsko.shop | udp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 104.21.44.3:443 | liabilitynighstjsko.shop | tcp |
| RU | 193.233.132.234:80 | 193.233.132.234 | tcp |
| US | 8.8.8.8:53 | demonstationfukewko.shop | udp |
| US | 104.21.33.174:443 | demonstationfukewko.shop | tcp |
| US | 8.8.8.8:53 | 3.44.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 234.132.233.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | file-host-host0.com | udp |
| DE | 185.172.128.90:80 | 185.172.128.90 | tcp |
| RU | 194.87.210.219:80 | file-host-host0.com | tcp |
| US | 8.8.8.8:53 | file-drop.cc | udp |
| US | 8.8.8.8:53 | 174.33.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 90.128.172.185.in-addr.arpa | udp |
| US | 104.21.95.172:443 | file-drop.cc | tcp |
| FR | 52.143.157.84:80 | tcp | |
| DE | 185.172.128.228:80 | 185.172.128.228 | tcp |
| US | 8.8.8.8:53 | 219.210.87.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.95.21.104.in-addr.arpa | udp |
| DE | 185.172.128.59:80 | 185.172.128.59 | tcp |
| US | 8.8.8.8:53 | parrotflight.com | udp |
| US | 172.67.187.204:443 | parrotflight.com | tcp |
| US | 8.8.8.8:53 | 228.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 204.187.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | junglethomas.com | udp |
| US | 172.67.197.33:443 | junglethomas.com | tcp |
| US | 8.8.8.8:53 | 33.197.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | note.padd.cn.com | udp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| RO | 176.97.76.106:80 | note.padd.cn.com | tcp |
| US | 8.8.8.8:53 | 106.76.97.176.in-addr.arpa | udp |
| DE | 185.172.128.33:8970 | tcp | |
| RU | 185.215.113.67:26260 | tcp | |
| US | 8.8.8.8:53 | 33.128.172.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.113.215.185.in-addr.arpa | udp |
| DE | 185.172.128.228:80 | 185.172.128.228 | tcp |
| RU | 5.42.65.67:48396 | tcp | |
| US | 8.8.8.8:53 | yip.su | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 8.8.8.8:53 | 67.65.42.5.in-addr.arpa | udp |
| RU | 193.233.132.167:80 | 193.233.132.167 | tcp |
| US | 8.8.8.8:53 | ip-api.com | udp |
| US | 208.95.112.1:80 | ip-api.com | tcp |
| US | 104.21.79.77:443 | yip.su | tcp |
| US | 172.67.19.24:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 1.112.95.208.in-addr.arpa | udp |
| DE | 185.172.128.59:80 | 185.172.128.59 | tcp |
| RU | 193.233.132.234:80 | 193.233.132.234 | tcp |
| RU | 193.233.132.175:80 | 193.233.132.175 | tcp |
| RU | 193.233.132.234:80 | 193.233.132.234 | tcp |
| US | 8.8.8.8:53 | skategirls.org | udp |
| US | 8.8.8.8:53 | 77.79.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.19.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.132.233.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | realdeepai.org | udp |
| US | 172.67.193.79:443 | realdeepai.org | tcp |
| US | 8.8.8.8:53 | jonathantwo.com | udp |
| US | 172.67.176.131:443 | jonathantwo.com | tcp |
| US | 172.67.176.131:443 | jonathantwo.com | tcp |
| US | 8.8.8.8:53 | net.geo.opera.com | udp |
| NL | 185.26.182.112:80 | net.geo.opera.com | tcp |
| US | 8.8.8.8:53 | 79.193.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 131.176.67.172.in-addr.arpa | udp |
| NL | 185.26.182.112:443 | net.geo.opera.com | tcp |
| DE | 185.172.128.90:80 | 185.172.128.90 | tcp |
| US | 8.8.8.8:53 | 112.182.26.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | svc.iolo.com | udp |
| US | 20.157.87.45:80 | svc.iolo.com | tcp |
| DE | 185.172.128.228:80 | 185.172.128.228 | tcp |
| US | 8.8.8.8:53 | 45.87.157.20.in-addr.arpa | udp |
| DE | 185.172.128.59:80 | 185.172.128.59 | tcp |
| RO | 176.97.76.106:80 | note.padd.cn.com | tcp |
| FR | 52.143.157.84:80 | tcp | |
| DE | 185.172.128.228:80 | 185.172.128.228 | tcp |
| US | 8.8.8.8:53 | desktop-netinstaller-sub.osp.opera.software | udp |
| US | 8.8.8.8:53 | autoupdate.geo.opera.com | udp |
| NL | 82.145.217.121:443 | desktop-netinstaller-sub.osp.opera.software | tcp |
| NL | 82.145.216.20:443 | autoupdate.geo.opera.com | tcp |
| NL | 82.145.216.20:443 | autoupdate.geo.opera.com | tcp |
| US | 8.8.8.8:53 | 121.217.145.82.in-addr.arpa | udp |
| RU | 5.42.66.10:80 | 5.42.66.10 | tcp |
| US | 8.8.8.8:53 | api.myip.com | udp |
| US | 104.26.8.59:443 | api.myip.com | tcp |
| US | 8.8.8.8:53 | ipinfo.io | udp |
| US | 34.117.186.192:443 | ipinfo.io | tcp |
| US | 8.8.8.8:53 | download.opera.com | udp |
| US | 8.8.8.8:53 | features.opera-api2.com | udp |
| NL | 185.26.182.117:443 | download.opera.com | tcp |
| NL | 82.145.216.16:443 | features.opera-api2.com | tcp |
| US | 8.8.8.8:53 | download5.operacdn.com | udp |
| US | 104.18.10.89:443 | download5.operacdn.com | tcp |
| US | 8.8.8.8:53 | 20.216.145.82.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.66.42.5.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.8.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 192.186.117.34.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 117.182.26.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 16.216.145.82.in-addr.arpa | udp |
| FR | 52.143.157.84:80 | tcp | |
| US | 8.8.8.8:53 | 89.10.18.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 175.117.168.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | download.iolo.net | udp |
| FR | 185.93.2.246:443 | download.iolo.net | tcp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 246.2.93.185.in-addr.arpa | udp |
Files
memory/3812-0-0x0000000000E80000-0x0000000001344000-memory.dmp
memory/3812-1-0x0000000077814000-0x0000000077816000-memory.dmp
memory/3812-2-0x0000000000E80000-0x0000000001344000-memory.dmp
memory/3812-9-0x0000000005990000-0x0000000005991000-memory.dmp
memory/3812-8-0x0000000005940000-0x0000000005941000-memory.dmp
memory/3812-7-0x0000000005930000-0x0000000005931000-memory.dmp
memory/3812-6-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/3812-5-0x0000000005950000-0x0000000005951000-memory.dmp
memory/3812-4-0x0000000005970000-0x0000000005971000-memory.dmp
memory/3812-3-0x0000000005960000-0x0000000005961000-memory.dmp
memory/3812-10-0x0000000000E80000-0x0000000001344000-memory.dmp
memory/3812-12-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/3812-11-0x00000000059C0000-0x00000000059C1000-memory.dmp
memory/3812-17-0x0000000000E80000-0x0000000001344000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
| MD5 | 93338c2f6145798dfafcee30c199e20f |
| SHA1 | 5b7d99b4c1d83ff9ee31bc4c548c32b80f976597 |
| SHA256 | 951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787 |
| SHA512 | b9596186abd820f85c2e72a6354bea9ab323ed75f4bfd7a815e8afebc5e25611e246948d7ed22bac934a114c9a309defeff149747751195ca98db24846e735cf |
memory/5188-20-0x0000000000B30000-0x0000000000FF4000-memory.dmp
memory/5188-21-0x0000000000B30000-0x0000000000FF4000-memory.dmp
memory/5188-28-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/5188-27-0x00000000049F0000-0x00000000049F1000-memory.dmp
memory/5188-26-0x0000000004A00000-0x0000000004A01000-memory.dmp
memory/5188-25-0x00000000049E0000-0x00000000049E1000-memory.dmp
memory/5188-24-0x0000000004A50000-0x0000000004A51000-memory.dmp
memory/5188-23-0x0000000004A20000-0x0000000004A21000-memory.dmp
memory/5188-22-0x0000000004A10000-0x0000000004A11000-memory.dmp
memory/5188-30-0x0000000004A60000-0x0000000004A61000-memory.dmp
memory/5188-29-0x0000000004A70000-0x0000000004A71000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
| MD5 | 1c7d0f34bb1d85b5d2c01367cc8f62ef |
| SHA1 | 33aedadb5361f1646cffd68791d72ba5f1424114 |
| SHA256 | e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c |
| SHA512 | 53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d |
memory/1972-50-0x0000000073420000-0x0000000073BD0000-memory.dmp
memory/1972-51-0x0000000000C50000-0x0000000000CA2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
| MD5 | 31841361be1f3dc6c2ce7756b490bf0f |
| SHA1 | ff2506641a401ac999f5870769f50b7326f7e4eb |
| SHA256 | 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee |
| SHA512 | 53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019 |
memory/5796-63-0x0000000000400000-0x000000000044C000-memory.dmp
memory/1972-73-0x0000000003160000-0x0000000005160000-memory.dmp
memory/5796-75-0x0000000000400000-0x000000000044C000-memory.dmp
memory/5796-72-0x0000000000400000-0x000000000044C000-memory.dmp
memory/4188-76-0x0000000000400000-0x0000000000592000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
| MD5 | b22521fb370921bb5d69bf8deecce59e |
| SHA1 | 3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea |
| SHA256 | b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158 |
| SHA512 | 1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c |
memory/5164-95-0x0000000000400000-0x000000000044E000-memory.dmp
memory/5164-96-0x0000000000400000-0x000000000044E000-memory.dmp
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
| MD5 | 20ae0bb07ba77cb3748aa63b6eb51afb |
| SHA1 | 87c468dc8f3d90a63833d36e4c900fa88d505c6d |
| SHA256 | daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d |
| SHA512 | db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2 |
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
| MD5 | 0c582da789c91878ab2f1b12d7461496 |
| SHA1 | 238bd2408f484dd13113889792d6e46d6b41c5ba |
| SHA256 | a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67 |
| SHA512 | a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a |
memory/5312-127-0x0000000000EF0000-0x0000000000F42000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
| MD5 | 0099a99f5ffb3c3ae78af0084136fab3 |
| SHA1 | 0205a065728a9ec1133e8a372b1e3864df776e8c |
| SHA256 | 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226 |
| SHA512 | 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6 |
memory/5312-133-0x0000000005DF0000-0x0000000006394000-memory.dmp
memory/4092-135-0x0000000000910000-0x00000000009D0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
| MD5 | 8510bcf5bc264c70180abe78298e4d5b |
| SHA1 | 2c3a2a85d129b0d750ed146d1d4e4d6274623e28 |
| SHA256 | 096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6 |
| SHA512 | 5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d |
memory/5312-147-0x0000000005840000-0x00000000058D2000-memory.dmp
memory/2812-156-0x00000000001B0000-0x0000000000202000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
| MD5 | 586f7fecacd49adab650fae36e2db994 |
| SHA1 | 35d9fb512a8161ce867812633f0a43b042f9a5e6 |
| SHA256 | cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e |
| SHA512 | a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772 |
memory/1972-166-0x0000000073420000-0x0000000073BD0000-memory.dmp
memory/5312-167-0x0000000005810000-0x000000000581A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe
| MD5 | c58df82b7146e046d56980fed1a9f4be |
| SHA1 | a9c2a18f46a39dd6dcb7d61106ffedd4861f10b1 |
| SHA256 | 47134c68fce464e80209ddaffc71e17ac4852fd4ec6f26ffcf75e461ab6adc29 |
| SHA512 | 21c9dbec7cfe63076b4c279574ade07c0ecfac6670edeae79bedf6a1b1cf2d4f396b3fef64233cc1b6cb14864930ab063081c398db0aba19f66b54778460b3af |
memory/872-194-0x0000000000A80000-0x0000000000AAE000-memory.dmp
memory/2512-210-0x0000000000400000-0x000000000063B000-memory.dmp
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll
| MD5 | f35b671fda2603ec30ace10946f11a90 |
| SHA1 | 059ad6b06559d4db581b1879e709f32f80850872 |
| SHA256 | 83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7 |
| SHA512 | b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705 |
C:\Users\Admin\AppData\Local\Temp\Tmp6A88.tmp
| MD5 | 1420d30f964eac2c85b2ccfe968eebce |
| SHA1 | bdf9a6876578a3e38079c4f8cf5d6c79687ad750 |
| SHA256 | f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9 |
| SHA512 | 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8 |
C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe
| MD5 | 0c4043a9a9efff20810530fd0cad91d7 |
| SHA1 | ca3adc7e4f1a027a2969749ccd5e2c1b06b88162 |
| SHA256 | 1153b99ea7a217692d63ef2c95b61f9b781862793ed5cdff3f53f0b43d9c8ccc |
| SHA512 | e5cb239c051ad141a56ca464be8068cebdc58029e39bc2d31495b27a5267604748f590397c2269d01b42f07af5a8840c8d3b339f4f042db165bd9c023a332d17 |
memory/2512-208-0x0000000000400000-0x000000000063B000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2397ee06-28fe-4eaa-8777-f7014368c353
| MD5 | eb637d66c34aa57fd3cb7cbc686b3767 |
| SHA1 | 4b3a1d127199e763ce145e3ad67cdd727d5f2beb |
| SHA256 | 72a6773436cf9f37cbb520a16584d8dd4cdf9266a63faa2d316abe19411bfa81 |
| SHA512 | 535671fdcb4a299d7c3c1fc3b894fa0a4b4670cba85f7c26b38421ac2f9de35855bbdd8b2beada3ad6b7178383c78b583f15a617e4a0c83684d6f9b1fd04c376 |
memory/5312-267-0x00000000064A0000-0x0000000006516000-memory.dmp
memory/4892-270-0x0000028EEA0C0000-0x0000028EEA0CA000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe
| MD5 | cf3c1c8bf8cb2a7c77f976c30bb1db06 |
| SHA1 | 96660806f005a84bdac81a649a3118ac0f9605fc |
| SHA256 | beb0d0b717d39474cdc522eea925e437dc02c260626b43db1d235640a5d568e0 |
| SHA512 | 2fd14931d640159ffadc236482e8d36b5b16663b935d7bef273c149ddfd008fb9a5c280a2992a1b2f5c294ed4ce3e15101d7b7a9e05a5095b1362920033819a4 |
memory/5312-288-0x0000000006D50000-0x0000000006D6E000-memory.dmp
C:\Users\Admin\Desktop\Microsoft Edge.lnk
| MD5 | 3db38f0159a109798b7b715ccd4cf126 |
| SHA1 | 466c60a7778f56a0552f8f677d05187994552857 |
| SHA256 | 02b4aaa94a664303f66543b89d7f5c1dd78946a4d2bbdf696917165db8030690 |
| SHA512 | b74516e722a2073aa38f77d7117b0baa813073b89015c72bb59d1e10603a7f1fb8a9eabc8970fc7d2eb33582335ccb8f7f7bb1b0b71db3833264944fdd025292 |
memory/5312-298-0x00000000074D0000-0x0000000007AE8000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | f6eba5b4da2a6729ce49739376f04e87 |
| SHA1 | 564f12037877a6b7cf73c4b130882f27375d6e2c |
| SHA256 | b5d2109699d2e485bf989aa7595ab2877b6d59fa781364b9b2a6b64652a3a2e1 |
| SHA512 | a9327f2592d15eae2703bfe202c3c85d3353aeef6a0863571e9a15b7d73854bd8ee83c2e6e0f190d40ee3b471c43f98068f6f4bda2283b8d33b62e7cb29ec9a5 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
| MD5 | de8c64f6de430a91824ea4c81a8f6626 |
| SHA1 | 6770a37b4303b2d2283d717252124ae952c8680f |
| SHA256 | bef0bec14016c178fda6f5fb360b84513f8151a41273f78332e456a7aae2a14e |
| SHA512 | 5395b6082ea5f9c6383b80e4c02c4454697eef35b99ece7ca4dbf7993e491ebe4a5838b81af09f93bcd50af294f8e5dbead3239d2eba8655225d14d969ccf2ec |
memory/5312-304-0x0000000007020000-0x000000000712A000-memory.dmp
memory/5312-305-0x0000000006F60000-0x0000000006F72000-memory.dmp
memory/5312-307-0x0000000006FC0000-0x0000000006FFC000-memory.dmp
memory/5188-306-0x0000000000B30000-0x0000000000FF4000-memory.dmp
memory/5312-311-0x0000000007130000-0x000000000717C000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
| MD5 | 8202a1cd02e7d69597995cabbe881a12 |
| SHA1 | 8858d9d934b7aa9330ee73de6c476acf19929ff6 |
| SHA256 | 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5 |
| SHA512 | 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
| MD5 | 8377d7254b54a60a3a0bd0190a7d79ce |
| SHA1 | b6fb14e921eb60f0f8bbaac0fc2931dd8e3937b0 |
| SHA256 | 6583bb1661fe9d5c8691eec3e59d06db0f73be85adb2b3144bef26b09b9658f1 |
| SHA512 | 7be324dbd1d06c5dfd4af28f1cfcc9866456487ae5db4ca82a9c3a642205d65387bf6f16a9474b670670773e7ad58293cc329604aaa5440a75f6fa7d0135a0b6 |
C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe
| MD5 | 17eefbaaa30123fa3091add80026aed4 |
| SHA1 | 8e43d736ea03bd33de5434bda5e20aae121cd218 |
| SHA256 | b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5 |
| SHA512 | e82fbbbfef61773fae1ed3e0767efa225ede0327ca5654de25e86359f4366942f85cf5542e67a52b24bb129d7fccf09fc68c64a73cf9269a75040d888005fa09 |
C:\Users\Admin\AppData\Local\Temp\u44o.0.exe
| MD5 | 4c1211ca6acf41a9a2282c3291384bc5 |
| SHA1 | 0d405a8e2c8df1621a10adf984c836e29f0a51c5 |
| SHA256 | 52aa0c072e5c7fef19391a933cb34b085bf34d258d3fd7603a99907b262d547d |
| SHA512 | 1a7b194c8dba9f99ebb419a5ff2b0918f8ef6b44ee72f00953fd422e0028d9797181c7644e671013743fccea89abeb5e3306f32e94a0ecb4d5e90184cefbef2b |
memory/6124-344-0x0000000000B40000-0x0000000000B52000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe
| MD5 | 526a80021b8cf879a2da407a03fc250b |
| SHA1 | 33cfb8bae831bdb61e2062579a1df47d8057e522 |
| SHA256 | f4c2c862e6a7d85626a89defbfa1fbe1b392ab2361839d115817249cf597abaf |
| SHA512 | 9ba25ec0dd2455ee8ac22313b696f5fcd20aee8016d9be4f12c660d8583e08d4740328bb137575aaa5d402f89b19142eda8f3d2e1c6410967841aabee614fb61 |
memory/4892-361-0x0000028EEBC30000-0x0000028EEBC3A000-memory.dmp
memory/4892-362-0x0000028EEBCF0000-0x0000028EEBD4E000-memory.dmp
memory/5220-368-0x00000161EF880000-0x00000161EF8A2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjmynnei.t0o.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3196-382-0x0000000003260000-0x0000000003276000-memory.dmp
memory/3304-385-0x0000000000400000-0x0000000001A18000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\u44o.1.zip
| MD5 | 78d3ca6355c93c72b494bb6a498bf639 |
| SHA1 | 2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e |
| SHA256 | a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001 |
| SHA512 | 1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea |
memory/4092-401-0x000000001DDF0000-0x000000001DEFA000-memory.dmp
memory/4092-402-0x000000001B830000-0x000000001B842000-memory.dmp
memory/4092-403-0x000000001C4C0000-0x000000001C4FC000-memory.dmp
memory/1620-421-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\u44o.2\run.exe
| MD5 | 9fb4770ced09aae3b437c1c6eb6d7334 |
| SHA1 | fe54b31b0db8665aa5b22bed147e8295afc88a03 |
| SHA256 | a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3 |
| SHA512 | 140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256 |
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
| MD5 | 154c3f1334dd435f562672f2664fea6b |
| SHA1 | 51dd25e2ba98b8546de163b8f26e2972a90c2c79 |
| SHA256 | 5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f |
| SHA512 | 1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841 |
C:\Users\Admin\AppData\Local\Temp\u44o.2\relay.dll
| MD5 | 10d51becd0bbce0fab147ff9658c565e |
| SHA1 | 4689a18112ff876d3c066bc8c14a08fd6b7b7a4a |
| SHA256 | 7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed |
| SHA512 | 29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29 |
C:\Users\Admin\AppData\Local\Temp\u44o.2\whale.dbf
| MD5 | a723bf46048e0bfb15b8d77d7a648c3e |
| SHA1 | 8952d3c34e9341e4425571e10f22b782695bb915 |
| SHA256 | b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422 |
| SHA512 | ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273 |
C:\Users\Admin\AppData\Local\Temp\u44o.2\bunch.dat
| MD5 | 1e8237d3028ab52821d69099e0954f97 |
| SHA1 | 30a6ae353adda0c471c6ed5b7a2458b07185abf2 |
| SHA256 | 9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742 |
| SHA512 | a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3 |
memory/1644-486-0x000000006BD60000-0x000000006BEDB000-memory.dmp
memory/1644-487-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\u44o.2\UIxMarketPlugin.dll
| MD5 | d1ba9412e78bfc98074c5d724a1a87d6 |
| SHA1 | 0572f98d78fb0b366b5a086c2a74cc68b771d368 |
| SHA256 | cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15 |
| SHA512 | 8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f |
C:\Users\Admin\AppData\Local\Temp\u44o.3.exe
| MD5 | 397926927bca55be4a77839b1c44de6e |
| SHA1 | e10f3434ef3021c399dbba047832f02b3c898dbd |
| SHA256 | 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7 |
| SHA512 | cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954 |
memory/5188-504-0x0000000000B30000-0x0000000000FF4000-memory.dmp
memory/5352-505-0x0000000000400000-0x0000000001A3C000-memory.dmp
memory/5312-514-0x0000000007270000-0x00000000072D6000-memory.dmp
memory/4092-515-0x000000001E300000-0x000000001E376000-memory.dmp
C:\Users\Admin\Pictures\bBagzt3er9USMZej76KKEGAN.exe
| MD5 | 5b423612b36cde7f2745455c5dd82577 |
| SHA1 | 0187c7c80743b44e9e0c193e993294e3b969cc3d |
| SHA256 | e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09 |
| SHA512 | c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c |
C:\Users\Admin\Pictures\utl5SGcJQXeLlQhdRdOW3yKc.exe
| MD5 | 209baf341efd2d94d4a0158294c04d02 |
| SHA1 | 3cfc11e2fd0a262ffad1359f7b127b9e74efd90c |
| SHA256 | 04043ec3c8c32b4b61ded42edb10fde3953690570505346e8c355946b2219574 |
| SHA512 | a57aa8d108c553011b7afa105f109954e52381f4b7997a2e57e4b36a2fdbcbbf4b16026e58e1022d83c34c0e75daff36c4c19d9baf8daad025b199b89e8500b2 |
memory/4092-536-0x000000001C480000-0x000000001C49E000-memory.dmp
C:\Users\Admin\Pictures\bTm0qR0uyjbpTVC3AuEkzNZl.exe
| MD5 | cb2b161bbed4739c90366ddd0419a84e |
| SHA1 | 01cf657f15a61959de97d7477044bb3988c033a5 |
| SHA256 | e77265234679dcaa6987f921a87c9209773dd7f57181e0020bd147a7fde06e6c |
| SHA512 | 9cf64201b610f7c2032ecccc4919c7c0748c89b198751daff7ebfa1bd929041fa7a08adae5d9c7d917332da4aad179a23f99065eac67fc2fc7c220ebc251b5fb |
memory/1644-562-0x000000006BD60000-0x000000006BEDB000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\6a73b935
| MD5 | 9943c31a8e47a82fc38223b2dce2e136 |
| SHA1 | c03db738061b02ab8efa5a50695979b61eb3094f |
| SHA256 | 597b3419233a9a15c733aba182afa700fde292448494eb97196dafd240770660 |
| SHA512 | 7bf57311506e9b8e22d82e3c004215c2f7519687c2b82c253e3483683183112cd9999fb535715bca15f8d33c3acf6f320c09198eb8153fb5f520546e29d2e257 |
memory/5428-595-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp
memory/5220-596-0x00000161F1C90000-0x00000161F1CA2000-memory.dmp
memory/5220-597-0x00000161F1C70000-0x00000161F1C7A000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\_Files_\SelectRedo.docx
| MD5 | 7047cd38d07594a482b95d3f13a61618 |
| SHA1 | 79f52e321e3d3db33cff86b6c4b840208b08d6a0 |
| SHA256 | ba02ba78047d1060c1ffc72c12c002a2b24560fa2a653c4db9b1adf68b2a6c9c |
| SHA512 | e9fb2bd85c620feec02cac04d07cf4b44f28e431648e96642cd14bd05cb50e3634c00702ec029524592fa9716f15ab6e8a111299fbdcaaca4a7fa9848211e4cf |
C:\Users\Admin\AppData\Local\Temp\_Files_\UninstallDismount.txt
| MD5 | 07b08481c0e6de4b12c30d644542cf91 |
| SHA1 | 24b98c115fe60b45d92d6533b66263ce1b42f7e9 |
| SHA256 | 6375bcb04f07f26243ac569fcdad9b29809ee7306e7f73b285804e99d84a9dda |
| SHA512 | 4229dc6cf40f0b726c0a97c526540feb25062f295f6eba66475078c16ab1b0091791590de9d0194144cd5704069e1edd06ee37ae31ebb1255b025116604b02f5 |
memory/4092-619-0x000000001EA80000-0x000000001EC42000-memory.dmp
memory/4092-620-0x000000001F180000-0x000000001F6A8000-memory.dmp
memory/5188-621-0x0000000000B30000-0x0000000000FF4000-memory.dmp
memory/4588-622-0x0000000000400000-0x0000000001A18000-memory.dmp
memory/5628-624-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/3236-623-0x0000000000400000-0x0000000001DFB000-memory.dmp
memory/4424-625-0x0000000000400000-0x0000000001A3C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmpD152.tmp
| MD5 | 02d2c46697e3714e49f46b680b9a6b83 |
| SHA1 | 84f98b56d49f01e9b6b76a4e21accf64fd319140 |
| SHA256 | 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9 |
| SHA512 | 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | d85ba6ff808d9e5444a4b369f5bc2730 |
| SHA1 | 31aa9d96590fff6981b315e0b391b575e4c0804a |
| SHA256 | 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f |
| SHA512 | 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 0161e4d30ea0c945f2d2a2185e8133a4 |
| SHA1 | 87b1b2b12534d7074de9e8ba84c177bbd67c7435 |
| SHA256 | 45d834d5bbfad1d69dce8ad1cd68152de37c767e1203967e07a2a589df00e2e3 |
| SHA512 | 89d6222d5b4add85ec76428b652e5dd831f399d447c1894167b4197c57ea0438d2cb154604105a2973898371e1c827a28156200ed1e0e88bb492b2a19af11b62 |
C:\Users\Admin\AppData\Local\Temp\tmpD6D6.tmp
| MD5 | d444c807029c83b8a892ac0c4971f955 |
| SHA1 | fa58ce7588513519dc8fed939b26b05dc25e53b5 |
| SHA256 | 8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259 |
| SHA512 | b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e |
C:\Users\Admin\AppData\Local\Temp\tmpD737.tmp
| MD5 | bf69aee53eb7e09784128e340390db21 |
| SHA1 | 865c14f705ff90740cfca41125503f7b09d3b02d |
| SHA256 | 2e278ecc4627497ad3f5cb82afe333e221e36f464a06b9d0926583add3f5c4b3 |
| SHA512 | d6ee39f91cae3960aa6f2a251649eb6f7bf213539aaee8ea9c7db511cd2e35de1c62dab75f6e94eb6c48c45c0825fad0e0073e26204f1f2868e4dfffa44cfcc0 |
C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe
| MD5 | 7ad0ae82b83b3a170044102d5a6232e5 |
| SHA1 | 35163a1fbca5002d796322a0abae7872a83e2d99 |
| SHA256 | 595cd83bdf4e6c74ca0c53121a902a667168dc236b865af3cb4b868e2d971455 |
| SHA512 | e31b328a59fc760e5d66d357fedc056a22596e38e72a0d596c17807711cdd789d6e59e866e3f510d7a5776638b0703cf55c015cfbbfec303c26ce523f052d309 |
C:\Users\Admin\Pictures\MqVgsdrvydxEqnV91JhcXMrK.exe
| MD5 | 40e24b56642185d3b45d17f44d3a256a |
| SHA1 | 0ef796ac02581ccfcd3c7ae44af693a200d8b12e |
| SHA256 | 22ff278aa3fe118f203d791f4a99b54dd5b9f09ccf2895528e90f199d470b435 |
| SHA512 | c54fbeb1bbc1f7b4a09172934d4a755de84cd55ab152e1b77f2af63a516651b0f2bf44b1a4125e52fb63973e08198c82b8e94965ac22902f06d07a7ade50c567 |
memory/5188-776-0x0000000000B30000-0x0000000000FF4000-memory.dmp
memory/3236-777-0x0000000000400000-0x0000000001DFB000-memory.dmp
C:\Users\Admin\Pictures\TYq0mRPbrgiK04KheSKfqOuC.exe
| MD5 | a63018cc078f57c640ac2ec8ed84dead |
| SHA1 | 1f5c17894a755114527e92304f4a74195c48031d |
| SHA256 | 41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558 |
| SHA512 | a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864 |
memory/2392-779-0x0000000000400000-0x0000000001DFB000-memory.dmp
memory/2720-804-0x000000006BD60000-0x000000006BEDB000-memory.dmp
memory/5384-802-0x0000000140000000-0x0000000140749000-memory.dmp
memory/1660-797-0x0000000000400000-0x0000000001A18000-memory.dmp
memory/2428-787-0x0000000000400000-0x0000000001DFB000-memory.dmp
memory/4424-803-0x0000000000400000-0x0000000001A3C000-memory.dmp
memory/2720-805-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp
C:\Windows\System32\GroupPolicy\gpt.ini
| MD5 | 8ef9853d1881c5fe4d681bfb31282a01 |
| SHA1 | a05609065520e4b4e553784c566430ad9736f19f |
| SHA256 | 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2 |
| SHA512 | 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005 |
memory/5188-842-0x0000000000B30000-0x0000000000FF4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404281829528034036.dll
| MD5 | 45fe60d943ad11601067bc2840cc01be |
| SHA1 | 911d70a6aad7c10b52789c0312c5528556a2d609 |
| SHA256 | 0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add |
| SHA512 | 30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba |
memory/5188-848-0x0000000000B30000-0x0000000000FF4000-memory.dmp
memory/3236-843-0x0000000000400000-0x0000000001DFB000-memory.dmp
memory/2428-847-0x0000000000400000-0x0000000001DFB000-memory.dmp
memory/2392-844-0x0000000000400000-0x0000000001DFB000-memory.dmp
memory/1588-850-0x0000000000B40000-0x00000000011B4000-memory.dmp
memory/2812-864-0x0000000006700000-0x0000000006750000-memory.dmp
memory/2720-886-0x000000006BD60000-0x000000006BEDB000-memory.dmp
memory/5856-889-0x0000000000400000-0x00000000008AD000-memory.dmp
memory/5696-893-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp
memory/1588-894-0x0000000010000000-0x00000000105E1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
| MD5 | 7bb9636b237e4fd865d80e6f884d520e |
| SHA1 | b8bb957bc01c787a5681286e483b25f496bdc2db |
| SHA256 | 7b0c4039557c2e8491f7e2eaf9d2ef668aa3dc7dc63fe145658b02ad59851ab5 |
| SHA512 | ced808098ce51716c83b62517a9f19999ce0155d000c42a6fbe1eb10e0aa89d23dd70f3f2d2e0fc9179bf662798a0151dd4c9897c1bdc9826645a4204095df25 |
memory/4424-904-0x0000000000400000-0x0000000001A3C000-memory.dmp
memory/5428-907-0x000000006BD60000-0x000000006BEDB000-memory.dmp
memory/3120-910-0x0000000002490000-0x00000000024C6000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-28 18:27
Reported
2024-04-28 18:30
Platform
win11-20240419-en
Max time kernel
149s
Max time network
153s
Command Line
Signatures
Amadey
Identifies VirtualBox via ACPI registry values (likely anti-VM)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Checks BIOS information in registry
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Identifies Wine through registry keys
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\chrosha.job | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe
"C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe"
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
Network
| Country | Destination | Domain | Proto |
| RU | 193.233.132.167:80 | tcp | |
| RU | 193.233.132.167:80 | tcp | |
| RU | 193.233.132.167:80 | tcp | |
| RU | 193.233.132.167:80 | tcp | |
| RU | 193.233.132.167:80 | tcp | |
| RU | 193.233.132.167:80 | tcp | |
| RU | 193.233.132.167:80 | tcp |
Files
memory/4792-0-0x00000000004D0000-0x0000000000994000-memory.dmp
memory/4792-1-0x0000000077026000-0x0000000077028000-memory.dmp
memory/4792-2-0x00000000004D0000-0x0000000000994000-memory.dmp
memory/4792-8-0x0000000004F50000-0x0000000004F51000-memory.dmp
memory/4792-7-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/4792-6-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
memory/4792-5-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/4792-4-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/4792-3-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/4792-11-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
memory/4792-10-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/4792-15-0x00000000004D0000-0x0000000000994000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
| MD5 | 93338c2f6145798dfafcee30c199e20f |
| SHA1 | 5b7d99b4c1d83ff9ee31bc4c548c32b80f976597 |
| SHA256 | 951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787 |
| SHA512 | b9596186abd820f85c2e72a6354bea9ab323ed75f4bfd7a815e8afebc5e25611e246948d7ed22bac934a114c9a309defeff149747751195ca98db24846e735cf |
memory/1396-18-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-19-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-25-0x00000000053F0000-0x00000000053F1000-memory.dmp
memory/1396-24-0x00000000053E0000-0x00000000053E1000-memory.dmp
memory/1396-23-0x0000000005440000-0x0000000005441000-memory.dmp
memory/1396-22-0x0000000005400000-0x0000000005401000-memory.dmp
memory/1396-21-0x0000000005420000-0x0000000005421000-memory.dmp
memory/1396-20-0x0000000005410000-0x0000000005411000-memory.dmp
memory/1396-27-0x0000000005460000-0x0000000005461000-memory.dmp
memory/1396-26-0x0000000005470000-0x0000000005471000-memory.dmp
memory/1396-28-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-29-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-30-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-31-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-32-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-33-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-34-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-35-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-36-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-37-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-38-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-39-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-40-0x00000000001C0000-0x0000000000684000-memory.dmp
memory/1396-41-0x00000000001C0000-0x0000000000684000-memory.dmp