Malware Analysis Report

2025-01-02 04:44

Sample ID 240428-w32qwsdh27
Target 951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787
SHA256 951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787
Tags
amadey glupteba lumma redline smokeloader stealc xworm zgrat @cloudytteam test1234 backdoor dropper evasion infostealer loader rat stealer themida trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787

Threat Level: Known bad

The file 951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787 was found to be: Known bad.

Malicious Activity Summary

amadey glupteba lumma redline smokeloader stealc xworm zgrat @cloudytteam test1234 backdoor dropper evasion infostealer loader rat stealer themida trojan

RedLine

Glupteba

Detect Xworm Payload

Stealc

Detect ZGRat V1

Xworm

RedLine payload

SmokeLoader

Glupteba payload

Amadey

ZGRat

Lumma Stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Downloads MZ/PE file

Checks computer location settings

Checks BIOS information in registry

Identifies Wine through registry keys

Themida packer

Executes dropped EXE

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of FindShellTrayWindow

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-28 18:27

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-28 18:27

Reported

2024-04-28 18:30

Platform

win10v2004-20240226-en

Max time kernel

157s

Max time network

165s

Command Line

"C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe"

Signatures

Amadey

trojan amadey

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer

stealer lumma

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Stealc

stealer stealc

Xworm

trojan rat xworm

ZGRat

rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A

Downloads MZ/PE file

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A

Themida packer

themida
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A api.myip.com N/A N/A
N/A api.myip.com N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\chrosha.job C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5188 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
PID 5188 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
PID 5188 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
PID 1972 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1972 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1972 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1972 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1972 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1972 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1972 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1972 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1972 wrote to memory of 5796 N/A C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
PID 5188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
PID 5188 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
PID 2376 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2376 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2376 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2376 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2376 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2376 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2376 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2376 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 5188 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
PID 5188 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
PID 5188 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
PID 4144 wrote to memory of 5164 N/A C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4144 wrote to memory of 5164 N/A C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4144 wrote to memory of 5164 N/A C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe

"C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe

"C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe

"C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2376 -ip 2376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1972 -ip 1972

C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe

"C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2376 -s 332

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4144 -ip 4144

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 356

C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"

C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

"C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

"C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"

C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe

"C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F

C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe

"C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"

C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe

"C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main

C:\Windows\system32\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main

C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe

"C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe"

C:\Windows\system32\netsh.exe

netsh wlan show profiles

C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe

"C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe"

C:\Users\Admin\AppData\Local\Temp\u44o.0.exe

"C:\Users\Admin\AppData\Local\Temp\u44o.0.exe"

C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe

"C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal

C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe

"C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"

C:\Users\Admin\AppData\Local\Temp\u44o.2\run.exe

"C:\Users\Admin\AppData\Local\Temp\u44o.2\run.exe"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Users\Admin\AppData\Local\Temp\u44o.3.exe

"C:\Users\Admin\AppData\Local\Temp\u44o.3.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5352 -ip 5352

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5352 -s 1552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe'

C:\Users\Admin\Pictures\utl5SGcJQXeLlQhdRdOW3yKc.exe

"C:\Users\Admin\Pictures\utl5SGcJQXeLlQhdRdOW3yKc.exe"

C:\Users\Admin\Pictures\bTm0qR0uyjbpTVC3AuEkzNZl.exe

"C:\Users\Admin\Pictures\bTm0qR0uyjbpTVC3AuEkzNZl.exe"

C:\Users\Admin\Pictures\fwR9Od4wGbyLYnJHYdxA0AAn.exe

"C:\Users\Admin\Pictures\fwR9Od4wGbyLYnJHYdxA0AAn.exe"

C:\Users\Admin\AppData\Local\Temp\u3ew.0.exe

"C:\Users\Admin\AppData\Local\Temp\u3ew.0.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mstc.exe'

C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe

"C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe" --silent --allusers=0

C:\Users\Admin\Pictures\MqVgsdrvydxEqnV91JhcXMrK.exe

"C:\Users\Admin\Pictures\MqVgsdrvydxEqnV91JhcXMrK.exe"

C:\Users\Admin\AppData\Local\Temp\u3ew.2\run.exe

"C:\Users\Admin\AppData\Local\Temp\u3ew.2\run.exe"

C:\Users\Admin\Pictures\TYq0mRPbrgiK04KheSKfqOuC.exe

"C:\Users\Admin\Pictures\TYq0mRPbrgiK04KheSKfqOuC.exe"

C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe

C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x6b43e1d0,0x6b43e1dc,0x6b43e1e8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\SysWOW64\cmd.exe

C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eX4X2LwZyW6G8seCoyRNE6va.exe

"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\eX4X2LwZyW6G8seCoyRNE6va.exe" --version

C:\Users\Admin\AppData\Local\Temp\7zSF301.tmp\Install.exe

.\Install.exe /WkfdidVYT "385118" /S

C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe

"C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2308 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240428182954" --session-guid=42bf30bf-b94e-41f9-92b1-acd4584c9541 --server-tracking-blob="M2I3OWI3YWRiMDNlZTk0YzYzMzNiMzU5YTZiZGU4MDlkMjczNzFjMTk4YzAyMWVkZDhkNDQwNzg5YjgxNGEyNTp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTAiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0MzI4OTc0LjcxMzUiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiMjFkNjA2ZmUtMTgyOS00OGIyLWI3MGQtNmE0NTI0YjRmZjVkIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3405000000000000

C:\Users\Admin\AppData\Local\Temp\u3ew.3.exe

"C:\Users\Admin\AppData\Local\Temp\u3ew.3.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4424 -ip 4424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 1584

C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe

C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x298,0x2a8,0x2ac,0x274,0x2b0,0x6a91e1d0,0x6a91e1dc,0x6a91e1e8

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 18:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSF301.tmp\Install.exe\" Wt /LOwdidUswJ 385118 /S" /V1 /F

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'

C:\Windows\SysWOW64\forfiles.exe

forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"

C:\Windows\SysWOW64\cmd.exe

/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

C:\Windows\SysWOW64\cmd.exe

/C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True

\??\c:\windows\SysWOW64\reg.exe

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
GB 142.250.187.202:443 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
RU 193.233.132.167:80 193.233.132.167 tcp
US 8.8.8.8:53 167.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 affordcharmcropwo.shop udp
US 172.67.181.34:443 affordcharmcropwo.shop tcp
US 8.8.8.8:53 cleartotalfisherwo.shop udp
US 172.67.185.32:443 cleartotalfisherwo.shop tcp
US 8.8.8.8:53 worryfillvolcawoi.shop udp
US 104.21.44.125:443 worryfillvolcawoi.shop tcp
US 8.8.8.8:53 34.181.67.172.in-addr.arpa udp
US 8.8.8.8:53 32.185.67.172.in-addr.arpa udp
DE 185.172.128.19:80 185.172.128.19 tcp
US 8.8.8.8:53 enthusiasimtitleow.shop udp
US 8.8.8.8:53 productivelookewr.shop udp
US 104.21.11.250:443 productivelookewr.shop tcp
US 104.21.18.233:443 enthusiasimtitleow.shop tcp
US 8.8.8.8:53 125.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 19.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 250.11.21.104.in-addr.arpa udp
US 8.8.8.8:53 233.18.21.104.in-addr.arpa udp
US 8.8.8.8:53 dismissalcylinderhostw.shop udp
US 104.21.22.160:443 dismissalcylinderhostw.shop tcp
US 8.8.8.8:53 tolerateilusidjukl.shop udp
US 172.67.147.41:443 tolerateilusidjukl.shop tcp
US 8.8.8.8:53 shatterbreathepsw.shop udp
US 104.21.95.19:443 shatterbreathepsw.shop tcp
US 8.8.8.8:53 160.22.21.104.in-addr.arpa udp
US 8.8.8.8:53 41.147.67.172.in-addr.arpa udp
US 8.8.8.8:53 diskretainvigorousiw.shop udp
US 104.21.23.143:443 diskretainvigorousiw.shop tcp
US 8.8.8.8:53 shortsvelventysjo.shop udp
US 104.21.16.225:443 shortsvelventysjo.shop tcp
US 8.8.8.8:53 communicationgenerwo.shop udp
US 104.21.83.19:443 communicationgenerwo.shop tcp
US 8.8.8.8:53 incredibleextedwj.shop udp
US 172.67.218.63:443 incredibleextedwj.shop tcp
US 8.8.8.8:53 19.95.21.104.in-addr.arpa udp
US 8.8.8.8:53 143.23.21.104.in-addr.arpa udp
US 8.8.8.8:53 225.16.21.104.in-addr.arpa udp
US 8.8.8.8:53 19.83.21.104.in-addr.arpa udp
US 8.8.8.8:53 pillowbrocccolipe.shop udp
DE 185.172.128.19:80 185.172.128.19 tcp
US 104.21.47.56:443 pillowbrocccolipe.shop tcp
US 8.8.8.8:53 alcojoldwograpciw.shop udp
US 172.67.157.23:443 alcojoldwograpciw.shop tcp
DE 185.172.128.59:80 185.172.128.59 tcp
US 8.8.8.8:53 63.218.67.172.in-addr.arpa udp
US 8.8.8.8:53 56.47.21.104.in-addr.arpa udp
US 8.8.8.8:53 23.157.67.172.in-addr.arpa udp
US 8.8.8.8:53 59.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 liabilitynighstjsko.shop udp
RU 193.233.132.167:80 193.233.132.167 tcp
US 104.21.44.3:443 liabilitynighstjsko.shop tcp
RU 193.233.132.234:80 193.233.132.234 tcp
US 8.8.8.8:53 demonstationfukewko.shop udp
US 104.21.33.174:443 demonstationfukewko.shop tcp
US 8.8.8.8:53 3.44.21.104.in-addr.arpa udp
US 8.8.8.8:53 234.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 file-host-host0.com udp
DE 185.172.128.90:80 185.172.128.90 tcp
RU 194.87.210.219:80 file-host-host0.com tcp
US 8.8.8.8:53 file-drop.cc udp
US 8.8.8.8:53 174.33.21.104.in-addr.arpa udp
US 8.8.8.8:53 90.128.172.185.in-addr.arpa udp
US 104.21.95.172:443 file-drop.cc tcp
FR 52.143.157.84:80 tcp
DE 185.172.128.228:80 185.172.128.228 tcp
US 8.8.8.8:53 219.210.87.194.in-addr.arpa udp
US 8.8.8.8:53 172.95.21.104.in-addr.arpa udp
DE 185.172.128.59:80 185.172.128.59 tcp
US 8.8.8.8:53 parrotflight.com udp
US 172.67.187.204:443 parrotflight.com tcp
US 8.8.8.8:53 228.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 204.187.67.172.in-addr.arpa udp
US 8.8.8.8:53 junglethomas.com udp
US 172.67.197.33:443 junglethomas.com tcp
US 8.8.8.8:53 33.197.67.172.in-addr.arpa udp
US 8.8.8.8:53 note.padd.cn.com udp
RU 193.233.132.167:80 193.233.132.167 tcp
RO 176.97.76.106:80 note.padd.cn.com tcp
US 8.8.8.8:53 106.76.97.176.in-addr.arpa udp
DE 185.172.128.33:8970 tcp
RU 185.215.113.67:26260 tcp
US 8.8.8.8:53 33.128.172.185.in-addr.arpa udp
US 8.8.8.8:53 67.113.215.185.in-addr.arpa udp
DE 185.172.128.228:80 185.172.128.228 tcp
RU 5.42.65.67:48396 tcp
US 8.8.8.8:53 yip.su udp
US 8.8.8.8:53 pastebin.com udp
US 8.8.8.8:53 67.65.42.5.in-addr.arpa udp
RU 193.233.132.167:80 193.233.132.167 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 104.21.79.77:443 yip.su tcp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
DE 185.172.128.59:80 185.172.128.59 tcp
RU 193.233.132.234:80 193.233.132.234 tcp
RU 193.233.132.175:80 193.233.132.175 tcp
RU 193.233.132.234:80 193.233.132.234 tcp
US 8.8.8.8:53 skategirls.org udp
US 8.8.8.8:53 77.79.21.104.in-addr.arpa udp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 175.132.233.193.in-addr.arpa udp
US 8.8.8.8:53 realdeepai.org udp
US 172.67.193.79:443 realdeepai.org tcp
US 8.8.8.8:53 jonathantwo.com udp
US 172.67.176.131:443 jonathantwo.com tcp
US 172.67.176.131:443 jonathantwo.com tcp
US 8.8.8.8:53 net.geo.opera.com udp
NL 185.26.182.112:80 net.geo.opera.com tcp
US 8.8.8.8:53 79.193.67.172.in-addr.arpa udp
US 8.8.8.8:53 131.176.67.172.in-addr.arpa udp
NL 185.26.182.112:443 net.geo.opera.com tcp
DE 185.172.128.90:80 185.172.128.90 tcp
US 8.8.8.8:53 112.182.26.185.in-addr.arpa udp
US 8.8.8.8:53 svc.iolo.com udp
US 20.157.87.45:80 svc.iolo.com tcp
DE 185.172.128.228:80 185.172.128.228 tcp
US 8.8.8.8:53 45.87.157.20.in-addr.arpa udp
DE 185.172.128.59:80 185.172.128.59 tcp
RO 176.97.76.106:80 note.padd.cn.com tcp
FR 52.143.157.84:80 tcp
DE 185.172.128.228:80 185.172.128.228 tcp
US 8.8.8.8:53 desktop-netinstaller-sub.osp.opera.software udp
US 8.8.8.8:53 autoupdate.geo.opera.com udp
NL 82.145.217.121:443 desktop-netinstaller-sub.osp.opera.software tcp
NL 82.145.216.20:443 autoupdate.geo.opera.com tcp
NL 82.145.216.20:443 autoupdate.geo.opera.com tcp
US 8.8.8.8:53 121.217.145.82.in-addr.arpa udp
RU 5.42.66.10:80 5.42.66.10 tcp
US 8.8.8.8:53 api.myip.com udp
US 104.26.8.59:443 api.myip.com tcp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 download.opera.com udp
US 8.8.8.8:53 features.opera-api2.com udp
NL 185.26.182.117:443 download.opera.com tcp
NL 82.145.216.16:443 features.opera-api2.com tcp
US 8.8.8.8:53 download5.operacdn.com udp
US 104.18.10.89:443 download5.operacdn.com tcp
US 8.8.8.8:53 20.216.145.82.in-addr.arpa udp
US 8.8.8.8:53 10.66.42.5.in-addr.arpa udp
US 8.8.8.8:53 59.8.26.104.in-addr.arpa udp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 117.182.26.185.in-addr.arpa udp
US 8.8.8.8:53 16.216.145.82.in-addr.arpa udp
FR 52.143.157.84:80 tcp
US 8.8.8.8:53 89.10.18.104.in-addr.arpa udp
US 8.8.8.8:53 175.117.168.52.in-addr.arpa udp
US 8.8.8.8:53 download.iolo.net udp
FR 185.93.2.246:443 download.iolo.net tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 246.2.93.185.in-addr.arpa udp

Files

memory/3812-0-0x0000000000E80000-0x0000000001344000-memory.dmp

memory/3812-1-0x0000000077814000-0x0000000077816000-memory.dmp

memory/3812-2-0x0000000000E80000-0x0000000001344000-memory.dmp

memory/3812-9-0x0000000005990000-0x0000000005991000-memory.dmp

memory/3812-8-0x0000000005940000-0x0000000005941000-memory.dmp

memory/3812-7-0x0000000005930000-0x0000000005931000-memory.dmp

memory/3812-6-0x00000000059A0000-0x00000000059A1000-memory.dmp

memory/3812-5-0x0000000005950000-0x0000000005951000-memory.dmp

memory/3812-4-0x0000000005970000-0x0000000005971000-memory.dmp

memory/3812-3-0x0000000005960000-0x0000000005961000-memory.dmp

memory/3812-10-0x0000000000E80000-0x0000000001344000-memory.dmp

memory/3812-12-0x00000000059B0000-0x00000000059B1000-memory.dmp

memory/3812-11-0x00000000059C0000-0x00000000059C1000-memory.dmp

memory/3812-17-0x0000000000E80000-0x0000000001344000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

MD5 93338c2f6145798dfafcee30c199e20f
SHA1 5b7d99b4c1d83ff9ee31bc4c548c32b80f976597
SHA256 951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787
SHA512 b9596186abd820f85c2e72a6354bea9ab323ed75f4bfd7a815e8afebc5e25611e246948d7ed22bac934a114c9a309defeff149747751195ca98db24846e735cf

memory/5188-20-0x0000000000B30000-0x0000000000FF4000-memory.dmp

memory/5188-21-0x0000000000B30000-0x0000000000FF4000-memory.dmp

memory/5188-28-0x0000000004A40000-0x0000000004A41000-memory.dmp

memory/5188-27-0x00000000049F0000-0x00000000049F1000-memory.dmp

memory/5188-26-0x0000000004A00000-0x0000000004A01000-memory.dmp

memory/5188-25-0x00000000049E0000-0x00000000049E1000-memory.dmp

memory/5188-24-0x0000000004A50000-0x0000000004A51000-memory.dmp

memory/5188-23-0x0000000004A20000-0x0000000004A21000-memory.dmp

memory/5188-22-0x0000000004A10000-0x0000000004A11000-memory.dmp

memory/5188-30-0x0000000004A60000-0x0000000004A61000-memory.dmp

memory/5188-29-0x0000000004A70000-0x0000000004A71000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe

MD5 1c7d0f34bb1d85b5d2c01367cc8f62ef
SHA1 33aedadb5361f1646cffd68791d72ba5f1424114
SHA256 e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c
SHA512 53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

memory/1972-50-0x0000000073420000-0x0000000073BD0000-memory.dmp

memory/1972-51-0x0000000000C50000-0x0000000000CA2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe

MD5 31841361be1f3dc6c2ce7756b490bf0f
SHA1 ff2506641a401ac999f5870769f50b7326f7e4eb
SHA256 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
SHA512 53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

memory/5796-63-0x0000000000400000-0x000000000044C000-memory.dmp

memory/1972-73-0x0000000003160000-0x0000000005160000-memory.dmp

memory/5796-75-0x0000000000400000-0x000000000044C000-memory.dmp

memory/5796-72-0x0000000000400000-0x000000000044C000-memory.dmp

memory/4188-76-0x0000000000400000-0x0000000000592000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe

MD5 b22521fb370921bb5d69bf8deecce59e
SHA1 3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea
SHA256 b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158
SHA512 1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c

memory/5164-95-0x0000000000400000-0x000000000044E000-memory.dmp

memory/5164-96-0x0000000000400000-0x000000000044E000-memory.dmp

C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

MD5 20ae0bb07ba77cb3748aa63b6eb51afb
SHA1 87c468dc8f3d90a63833d36e4c900fa88d505c6d
SHA256 daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
SHA512 db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

MD5 0c582da789c91878ab2f1b12d7461496
SHA1 238bd2408f484dd13113889792d6e46d6b41c5ba
SHA256 a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
SHA512 a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

memory/5312-127-0x0000000000EF0000-0x0000000000F42000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

MD5 0099a99f5ffb3c3ae78af0084136fab3
SHA1 0205a065728a9ec1133e8a372b1e3864df776e8c
SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA512 5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

memory/5312-133-0x0000000005DF0000-0x0000000006394000-memory.dmp

memory/4092-135-0x0000000000910000-0x00000000009D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe

MD5 8510bcf5bc264c70180abe78298e4d5b
SHA1 2c3a2a85d129b0d750ed146d1d4e4d6274623e28
SHA256 096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6
SHA512 5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

memory/5312-147-0x0000000005840000-0x00000000058D2000-memory.dmp

memory/2812-156-0x00000000001B0000-0x0000000000202000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe

MD5 586f7fecacd49adab650fae36e2db994
SHA1 35d9fb512a8161ce867812633f0a43b042f9a5e6
SHA256 cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e
SHA512 a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

memory/1972-166-0x0000000073420000-0x0000000073BD0000-memory.dmp

memory/5312-167-0x0000000005810000-0x000000000581A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000228001\ISetup8.exe

MD5 c58df82b7146e046d56980fed1a9f4be
SHA1 a9c2a18f46a39dd6dcb7d61106ffedd4861f10b1
SHA256 47134c68fce464e80209ddaffc71e17ac4852fd4ec6f26ffcf75e461ab6adc29
SHA512 21c9dbec7cfe63076b4c279574ade07c0ecfac6670edeae79bedf6a1b1cf2d4f396b3fef64233cc1b6cb14864930ab063081c398db0aba19f66b54778460b3af

memory/872-194-0x0000000000A80000-0x0000000000AAE000-memory.dmp

memory/2512-210-0x0000000000400000-0x000000000063B000-memory.dmp

C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

MD5 f35b671fda2603ec30ace10946f11a90
SHA1 059ad6b06559d4db581b1879e709f32f80850872
SHA256 83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7
SHA512 b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

C:\Users\Admin\AppData\Local\Temp\Tmp6A88.tmp

MD5 1420d30f964eac2c85b2ccfe968eebce
SHA1 bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA512 6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe

MD5 0c4043a9a9efff20810530fd0cad91d7
SHA1 ca3adc7e4f1a027a2969749ccd5e2c1b06b88162
SHA256 1153b99ea7a217692d63ef2c95b61f9b781862793ed5cdff3f53f0b43d9c8ccc
SHA512 e5cb239c051ad141a56ca464be8068cebdc58029e39bc2d31495b27a5267604748f590397c2269d01b42f07af5a8840c8d3b339f4f042db165bd9c023a332d17

memory/2512-208-0x0000000000400000-0x000000000063B000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3808065738-1666277613-1125846146-1000\76b53b3ec448f7ccdda2063b15d2bfc3_2397ee06-28fe-4eaa-8777-f7014368c353

MD5 eb637d66c34aa57fd3cb7cbc686b3767
SHA1 4b3a1d127199e763ce145e3ad67cdd727d5f2beb
SHA256 72a6773436cf9f37cbb520a16584d8dd4cdf9266a63faa2d316abe19411bfa81
SHA512 535671fdcb4a299d7c3c1fc3b894fa0a4b4670cba85f7c26b38421ac2f9de35855bbdd8b2beada3ad6b7178383c78b583f15a617e4a0c83684d6f9b1fd04c376

memory/5312-267-0x00000000064A0000-0x0000000006516000-memory.dmp

memory/4892-270-0x0000028EEA0C0000-0x0000028EEA0CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000229001\toolspub1.exe

MD5 cf3c1c8bf8cb2a7c77f976c30bb1db06
SHA1 96660806f005a84bdac81a649a3118ac0f9605fc
SHA256 beb0d0b717d39474cdc522eea925e437dc02c260626b43db1d235640a5d568e0
SHA512 2fd14931d640159ffadc236482e8d36b5b16663b935d7bef273c149ddfd008fb9a5c280a2992a1b2f5c294ed4ce3e15101d7b7a9e05a5095b1362920033819a4

memory/5312-288-0x0000000006D50000-0x0000000006D6E000-memory.dmp

C:\Users\Admin\Desktop\Microsoft Edge.lnk

MD5 3db38f0159a109798b7b715ccd4cf126
SHA1 466c60a7778f56a0552f8f677d05187994552857
SHA256 02b4aaa94a664303f66543b89d7f5c1dd78946a4d2bbdf696917165db8030690
SHA512 b74516e722a2073aa38f77d7117b0baa813073b89015c72bb59d1e10603a7f1fb8a9eabc8970fc7d2eb33582335ccb8f7f7bb1b0b71db3833264944fdd025292

memory/5312-298-0x00000000074D0000-0x0000000007AE8000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f6eba5b4da2a6729ce49739376f04e87
SHA1 564f12037877a6b7cf73c4b130882f27375d6e2c
SHA256 b5d2109699d2e485bf989aa7595ab2877b6d59fa781364b9b2a6b64652a3a2e1
SHA512 a9327f2592d15eae2703bfe202c3c85d3353aeef6a0863571e9a15b7d73854bd8ee83c2e6e0f190d40ee3b471c43f98068f6f4bda2283b8d33b62e7cb29ec9a5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 de8c64f6de430a91824ea4c81a8f6626
SHA1 6770a37b4303b2d2283d717252124ae952c8680f
SHA256 bef0bec14016c178fda6f5fb360b84513f8151a41273f78332e456a7aae2a14e
SHA512 5395b6082ea5f9c6383b80e4c02c4454697eef35b99ece7ca4dbf7993e491ebe4a5838b81af09f93bcd50af294f8e5dbead3239d2eba8655225d14d969ccf2ec

memory/5312-304-0x0000000007020000-0x000000000712A000-memory.dmp

memory/5312-305-0x0000000006F60000-0x0000000006F72000-memory.dmp

memory/5312-307-0x0000000006FC0000-0x0000000006FFC000-memory.dmp

memory/5188-306-0x0000000000B30000-0x0000000000FF4000-memory.dmp

memory/5312-311-0x0000000007130000-0x000000000717C000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8377d7254b54a60a3a0bd0190a7d79ce
SHA1 b6fb14e921eb60f0f8bbaac0fc2931dd8e3937b0
SHA256 6583bb1661fe9d5c8691eec3e59d06db0f73be85adb2b3144bef26b09b9658f1
SHA512 7be324dbd1d06c5dfd4af28f1cfcc9866456487ae5db4ca82a9c3a642205d65387bf6f16a9474b670670773e7ad58293cc329604aaa5440a75f6fa7d0135a0b6

C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe

MD5 17eefbaaa30123fa3091add80026aed4
SHA1 8e43d736ea03bd33de5434bda5e20aae121cd218
SHA256 b780f8659c3cfab33ffa95b25b396b2b8ade8bd40c72aaf7c87ad3c6b6cf34c5
SHA512 e82fbbbfef61773fae1ed3e0767efa225ede0327ca5654de25e86359f4366942f85cf5542e67a52b24bb129d7fccf09fc68c64a73cf9269a75040d888005fa09

C:\Users\Admin\AppData\Local\Temp\u44o.0.exe

MD5 4c1211ca6acf41a9a2282c3291384bc5
SHA1 0d405a8e2c8df1621a10adf984c836e29f0a51c5
SHA256 52aa0c072e5c7fef19391a933cb34b085bf34d258d3fd7603a99907b262d547d
SHA512 1a7b194c8dba9f99ebb419a5ff2b0918f8ef6b44ee72f00953fd422e0028d9797181c7644e671013743fccea89abeb5e3306f32e94a0ecb4d5e90184cefbef2b

memory/6124-344-0x0000000000B40000-0x0000000000B52000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1000230001\4767d2e713f2021e8fe856e3ea638b58.exe

MD5 526a80021b8cf879a2da407a03fc250b
SHA1 33cfb8bae831bdb61e2062579a1df47d8057e522
SHA256 f4c2c862e6a7d85626a89defbfa1fbe1b392ab2361839d115817249cf597abaf
SHA512 9ba25ec0dd2455ee8ac22313b696f5fcd20aee8016d9be4f12c660d8583e08d4740328bb137575aaa5d402f89b19142eda8f3d2e1c6410967841aabee614fb61

memory/4892-361-0x0000028EEBC30000-0x0000028EEBC3A000-memory.dmp

memory/4892-362-0x0000028EEBCF0000-0x0000028EEBD4E000-memory.dmp

memory/5220-368-0x00000161EF880000-0x00000161EF8A2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjmynnei.t0o.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3196-382-0x0000000003260000-0x0000000003276000-memory.dmp

memory/3304-385-0x0000000000400000-0x0000000001A18000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\u44o.1.zip

MD5 78d3ca6355c93c72b494bb6a498bf639
SHA1 2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e
SHA256 a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001
SHA512 1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

memory/4092-401-0x000000001DDF0000-0x000000001DEFA000-memory.dmp

memory/4092-402-0x000000001B830000-0x000000001B842000-memory.dmp

memory/4092-403-0x000000001C4C0000-0x000000001C4FC000-memory.dmp

memory/1620-421-0x0000000000400000-0x0000000000408000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\u44o.2\run.exe

MD5 9fb4770ced09aae3b437c1c6eb6d7334
SHA1 fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256 a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512 140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

MD5 154c3f1334dd435f562672f2664fea6b
SHA1 51dd25e2ba98b8546de163b8f26e2972a90c2c79
SHA256 5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f
SHA512 1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

C:\Users\Admin\AppData\Local\Temp\u44o.2\relay.dll

MD5 10d51becd0bbce0fab147ff9658c565e
SHA1 4689a18112ff876d3c066bc8c14a08fd6b7b7a4a
SHA256 7b2db9c88f60ed6dd24b1dec321a304564780fdb191a96ec35c051856128f1ed
SHA512 29faf493bb28f7842c905adc5312f31741effb09f841059b53d73b22aea2c4d41d73db10bbf37703d6aeb936ffacbc756a3cc85ba3c0b6a6863ef4d27fefcd29

C:\Users\Admin\AppData\Local\Temp\u44o.2\whale.dbf

MD5 a723bf46048e0bfb15b8d77d7a648c3e
SHA1 8952d3c34e9341e4425571e10f22b782695bb915
SHA256 b440170853bdb43b66497f701aee2901080326975140b095a1669cb9dee13422
SHA512 ca8ea2f7f3c7af21b5673a0a3f2611b6580a7ed02efa2cfd8b343eb644ff09682bde43b25ef7aab68530d5ce31dcbd252c382dd336ecb610d4c4ebde78347273

C:\Users\Admin\AppData\Local\Temp\u44o.2\bunch.dat

MD5 1e8237d3028ab52821d69099e0954f97
SHA1 30a6ae353adda0c471c6ed5b7a2458b07185abf2
SHA256 9387488f9d338e211be2cb45109bf590a5070180bc0d4a703f70d3cb3c4e1742
SHA512 a6406d7c18694ee014d59df581f1f76e980b68e3361ae680dc979606a423eba48d35e37f143154dd97fe5f066baf0ea51a2e9f8bc822d593e1cba70ead6559f3

memory/1644-486-0x000000006BD60000-0x000000006BEDB000-memory.dmp

memory/1644-487-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\u44o.2\UIxMarketPlugin.dll

MD5 d1ba9412e78bfc98074c5d724a1a87d6
SHA1 0572f98d78fb0b366b5a086c2a74cc68b771d368
SHA256 cbcea8f28d8916219d1e8b0a8ca2db17e338eb812431bc4ad0cb36c06fd67f15
SHA512 8765de36d3824b12c0a4478c31b985878d4811bd0e5b6fba4ea07f8c76340bd66a2da3490d4871b95d9a12f96efc25507dfd87f431de211664dbe9a9c914af6f

C:\Users\Admin\AppData\Local\Temp\u44o.3.exe

MD5 397926927bca55be4a77839b1c44de6e
SHA1 e10f3434ef3021c399dbba047832f02b3c898dbd
SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512 cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

memory/5188-504-0x0000000000B30000-0x0000000000FF4000-memory.dmp

memory/5352-505-0x0000000000400000-0x0000000001A3C000-memory.dmp

memory/5312-514-0x0000000007270000-0x00000000072D6000-memory.dmp

memory/4092-515-0x000000001E300000-0x000000001E376000-memory.dmp

C:\Users\Admin\Pictures\bBagzt3er9USMZej76KKEGAN.exe

MD5 5b423612b36cde7f2745455c5dd82577
SHA1 0187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256 e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512 c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

C:\Users\Admin\Pictures\utl5SGcJQXeLlQhdRdOW3yKc.exe

MD5 209baf341efd2d94d4a0158294c04d02
SHA1 3cfc11e2fd0a262ffad1359f7b127b9e74efd90c
SHA256 04043ec3c8c32b4b61ded42edb10fde3953690570505346e8c355946b2219574
SHA512 a57aa8d108c553011b7afa105f109954e52381f4b7997a2e57e4b36a2fdbcbbf4b16026e58e1022d83c34c0e75daff36c4c19d9baf8daad025b199b89e8500b2

memory/4092-536-0x000000001C480000-0x000000001C49E000-memory.dmp

C:\Users\Admin\Pictures\bTm0qR0uyjbpTVC3AuEkzNZl.exe

MD5 cb2b161bbed4739c90366ddd0419a84e
SHA1 01cf657f15a61959de97d7477044bb3988c033a5
SHA256 e77265234679dcaa6987f921a87c9209773dd7f57181e0020bd147a7fde06e6c
SHA512 9cf64201b610f7c2032ecccc4919c7c0748c89b198751daff7ebfa1bd929041fa7a08adae5d9c7d917332da4aad179a23f99065eac67fc2fc7c220ebc251b5fb

memory/1644-562-0x000000006BD60000-0x000000006BEDB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6a73b935

MD5 9943c31a8e47a82fc38223b2dce2e136
SHA1 c03db738061b02ab8efa5a50695979b61eb3094f
SHA256 597b3419233a9a15c733aba182afa700fde292448494eb97196dafd240770660
SHA512 7bf57311506e9b8e22d82e3c004215c2f7519687c2b82c253e3483683183112cd9999fb535715bca15f8d33c3acf6f320c09198eb8153fb5f520546e29d2e257

memory/5428-595-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

memory/5220-596-0x00000161F1C90000-0x00000161F1CA2000-memory.dmp

memory/5220-597-0x00000161F1C70000-0x00000161F1C7A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_Files_\SelectRedo.docx

MD5 7047cd38d07594a482b95d3f13a61618
SHA1 79f52e321e3d3db33cff86b6c4b840208b08d6a0
SHA256 ba02ba78047d1060c1ffc72c12c002a2b24560fa2a653c4db9b1adf68b2a6c9c
SHA512 e9fb2bd85c620feec02cac04d07cf4b44f28e431648e96642cd14bd05cb50e3634c00702ec029524592fa9716f15ab6e8a111299fbdcaaca4a7fa9848211e4cf

C:\Users\Admin\AppData\Local\Temp\_Files_\UninstallDismount.txt

MD5 07b08481c0e6de4b12c30d644542cf91
SHA1 24b98c115fe60b45d92d6533b66263ce1b42f7e9
SHA256 6375bcb04f07f26243ac569fcdad9b29809ee7306e7f73b285804e99d84a9dda
SHA512 4229dc6cf40f0b726c0a97c526540feb25062f295f6eba66475078c16ab1b0091791590de9d0194144cd5704069e1edd06ee37ae31ebb1255b025116604b02f5

memory/4092-619-0x000000001EA80000-0x000000001EC42000-memory.dmp

memory/4092-620-0x000000001F180000-0x000000001F6A8000-memory.dmp

memory/5188-621-0x0000000000B30000-0x0000000000FF4000-memory.dmp

memory/4588-622-0x0000000000400000-0x0000000001A18000-memory.dmp

memory/5628-624-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/3236-623-0x0000000000400000-0x0000000001DFB000-memory.dmp

memory/4424-625-0x0000000000400000-0x0000000001A3C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpD152.tmp

MD5 02d2c46697e3714e49f46b680b9a6b83
SHA1 84f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA512 60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 0161e4d30ea0c945f2d2a2185e8133a4
SHA1 87b1b2b12534d7074de9e8ba84c177bbd67c7435
SHA256 45d834d5bbfad1d69dce8ad1cd68152de37c767e1203967e07a2a589df00e2e3
SHA512 89d6222d5b4add85ec76428b652e5dd831f399d447c1894167b4197c57ea0438d2cb154604105a2973898371e1c827a28156200ed1e0e88bb492b2a19af11b62

C:\Users\Admin\AppData\Local\Temp\tmpD6D6.tmp

MD5 d444c807029c83b8a892ac0c4971f955
SHA1 fa58ce7588513519dc8fed939b26b05dc25e53b5
SHA256 8297a7698f19bb81539a18363db100c55e357fa73f773c2b883d2c4161f6a259
SHA512 b7958b843639d4223bef65cdc6c664d7d15b76ac4e0a8b1575201dd47a32899feff32389dcc047314f47944ebe7b774cd59e51d49202f49541bbd70ecbb31a2e

C:\Users\Admin\AppData\Local\Temp\tmpD737.tmp

MD5 bf69aee53eb7e09784128e340390db21
SHA1 865c14f705ff90740cfca41125503f7b09d3b02d
SHA256 2e278ecc4627497ad3f5cb82afe333e221e36f464a06b9d0926583add3f5c4b3
SHA512 d6ee39f91cae3960aa6f2a251649eb6f7bf213539aaee8ea9c7db511cd2e35de1c62dab75f6e94eb6c48c45c0825fad0e0073e26204f1f2868e4dfffa44cfcc0

C:\Users\Admin\Pictures\eX4X2LwZyW6G8seCoyRNE6va.exe

MD5 7ad0ae82b83b3a170044102d5a6232e5
SHA1 35163a1fbca5002d796322a0abae7872a83e2d99
SHA256 595cd83bdf4e6c74ca0c53121a902a667168dc236b865af3cb4b868e2d971455
SHA512 e31b328a59fc760e5d66d357fedc056a22596e38e72a0d596c17807711cdd789d6e59e866e3f510d7a5776638b0703cf55c015cfbbfec303c26ce523f052d309

C:\Users\Admin\Pictures\MqVgsdrvydxEqnV91JhcXMrK.exe

MD5 40e24b56642185d3b45d17f44d3a256a
SHA1 0ef796ac02581ccfcd3c7ae44af693a200d8b12e
SHA256 22ff278aa3fe118f203d791f4a99b54dd5b9f09ccf2895528e90f199d470b435
SHA512 c54fbeb1bbc1f7b4a09172934d4a755de84cd55ab152e1b77f2af63a516651b0f2bf44b1a4125e52fb63973e08198c82b8e94965ac22902f06d07a7ade50c567

memory/5188-776-0x0000000000B30000-0x0000000000FF4000-memory.dmp

memory/3236-777-0x0000000000400000-0x0000000001DFB000-memory.dmp

C:\Users\Admin\Pictures\TYq0mRPbrgiK04KheSKfqOuC.exe

MD5 a63018cc078f57c640ac2ec8ed84dead
SHA1 1f5c17894a755114527e92304f4a74195c48031d
SHA256 41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558
SHA512 a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864

memory/2392-779-0x0000000000400000-0x0000000001DFB000-memory.dmp

memory/2720-804-0x000000006BD60000-0x000000006BEDB000-memory.dmp

memory/5384-802-0x0000000140000000-0x0000000140749000-memory.dmp

memory/1660-797-0x0000000000400000-0x0000000001A18000-memory.dmp

memory/2428-787-0x0000000000400000-0x0000000001DFB000-memory.dmp

memory/4424-803-0x0000000000400000-0x0000000001A3C000-memory.dmp

memory/2720-805-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

C:\Windows\System32\GroupPolicy\gpt.ini

MD5 8ef9853d1881c5fe4d681bfb31282a01
SHA1 a05609065520e4b4e553784c566430ad9736f19f
SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA512 5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

memory/5188-842-0x0000000000B30000-0x0000000000FF4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404281829528034036.dll

MD5 45fe60d943ad11601067bc2840cc01be
SHA1 911d70a6aad7c10b52789c0312c5528556a2d609
SHA256 0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add
SHA512 30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba

memory/5188-848-0x0000000000B30000-0x0000000000FF4000-memory.dmp

memory/3236-843-0x0000000000400000-0x0000000001DFB000-memory.dmp

memory/2428-847-0x0000000000400000-0x0000000001DFB000-memory.dmp

memory/2392-844-0x0000000000400000-0x0000000001DFB000-memory.dmp

memory/1588-850-0x0000000000B40000-0x00000000011B4000-memory.dmp

memory/2812-864-0x0000000006700000-0x0000000006750000-memory.dmp

memory/2720-886-0x000000006BD60000-0x000000006BEDB000-memory.dmp

memory/5856-889-0x0000000000400000-0x00000000008AD000-memory.dmp

memory/5696-893-0x00007FFDA2A10000-0x00007FFDA2C05000-memory.dmp

memory/1588-894-0x0000000010000000-0x00000000105E1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt

MD5 7bb9636b237e4fd865d80e6f884d520e
SHA1 b8bb957bc01c787a5681286e483b25f496bdc2db
SHA256 7b0c4039557c2e8491f7e2eaf9d2ef668aa3dc7dc63fe145658b02ad59851ab5
SHA512 ced808098ce51716c83b62517a9f19999ce0155d000c42a6fbe1eb10e0aa89d23dd70f3f2d2e0fc9179bf662798a0151dd4c9897c1bdc9826645a4204095df25

memory/4424-904-0x0000000000400000-0x0000000001A3C000-memory.dmp

memory/5428-907-0x000000006BD60000-0x000000006BEDB000-memory.dmp

memory/3120-910-0x0000000002490000-0x00000000024C6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-28 18:27

Reported

2024-04-28 18:30

Platform

win11-20240419-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe"

Signatures

Amadey

trojan amadey

Identifies VirtualBox via ACPI registry values (likely anti-VM)

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\chrosha.job C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe N/A

Enumerates physical storage devices

Processes

C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe

"C:\Users\Admin\AppData\Local\Temp\951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787.exe"

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

Network

Country Destination Domain Proto
RU 193.233.132.167:80 tcp
RU 193.233.132.167:80 tcp
RU 193.233.132.167:80 tcp
RU 193.233.132.167:80 tcp
RU 193.233.132.167:80 tcp
RU 193.233.132.167:80 tcp
RU 193.233.132.167:80 tcp

Files

memory/4792-0-0x00000000004D0000-0x0000000000994000-memory.dmp

memory/4792-1-0x0000000077026000-0x0000000077028000-memory.dmp

memory/4792-2-0x00000000004D0000-0x0000000000994000-memory.dmp

memory/4792-8-0x0000000004F50000-0x0000000004F51000-memory.dmp

memory/4792-7-0x0000000004F40000-0x0000000004F41000-memory.dmp

memory/4792-6-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

memory/4792-5-0x0000000004F60000-0x0000000004F61000-memory.dmp

memory/4792-4-0x0000000004F80000-0x0000000004F81000-memory.dmp

memory/4792-3-0x0000000004F70000-0x0000000004F71000-memory.dmp

memory/4792-11-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

memory/4792-10-0x0000000004FD0000-0x0000000004FD1000-memory.dmp

memory/4792-15-0x00000000004D0000-0x0000000000994000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe

MD5 93338c2f6145798dfafcee30c199e20f
SHA1 5b7d99b4c1d83ff9ee31bc4c548c32b80f976597
SHA256 951d9f6c539b26b74dbf17033a7a6d62edd2cd6af7fbd79da023bcdf30770787
SHA512 b9596186abd820f85c2e72a6354bea9ab323ed75f4bfd7a815e8afebc5e25611e246948d7ed22bac934a114c9a309defeff149747751195ca98db24846e735cf

memory/1396-18-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-19-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-25-0x00000000053F0000-0x00000000053F1000-memory.dmp

memory/1396-24-0x00000000053E0000-0x00000000053E1000-memory.dmp

memory/1396-23-0x0000000005440000-0x0000000005441000-memory.dmp

memory/1396-22-0x0000000005400000-0x0000000005401000-memory.dmp

memory/1396-21-0x0000000005420000-0x0000000005421000-memory.dmp

memory/1396-20-0x0000000005410000-0x0000000005411000-memory.dmp

memory/1396-27-0x0000000005460000-0x0000000005461000-memory.dmp

memory/1396-26-0x0000000005470000-0x0000000005471000-memory.dmp

memory/1396-28-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-29-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-30-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-31-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-32-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-33-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-34-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-35-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-36-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-37-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-38-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-39-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-40-0x00000000001C0000-0x0000000000684000-memory.dmp

memory/1396-41-0x00000000001C0000-0x0000000000684000-memory.dmp