Overview

overview

10

Static

static

3

4a497ffd50...e2.exe

windows7-x64

10

4a497ffd50...e2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/07/2024, 01:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4a497ffd501a8dad3c90c94a939b38b0f2c0f3c6836b14a2762b1e42e2d178e2.exe
  • Size 1.8MB
  • Sample240731-brndxaygrl
  • SHA256 4a497ffd501a8dad3c90c94a939b38b0f2c0f3c6836b14a2762b1e42e2d178e2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyquasarredlinesectopratstealc2507202330072024exodusmarket.iofed3aalivetrafficlogsoffice04qllvalencigacredential_accessdiscoveryevasionexecutioninfostealerpersistencepyinstallerratspywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.41

Botnet

  • fed3aa

C2

  • http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • LiveTraffic

C2

  • 20.52.165.210:39030

Extracted

Family

  • stealc

Botnet

  • QLL

C2

  • http://85.28.47.70

Attributes
  • url_path

    /744f169d372be841.php

Extracted

Family

  • redline

Botnet

  • 25072023

C2

  • 185.215.113.67:40960

Extracted

Family

  • redline

Botnet

  • Logs

C2

  • 185.215.113.9:9137

Extracted

Family

  • stealc

Botnet

  • valenciga

C2

  • http://91.225.219.163

Attributes
  • url_path

    /7e93b9fd3ae92094.php

Extracted

Family

  • redline

Botnet

  • 30072024

C2

  • 185.215.113.67:40960

Extracted

Family

  • redline

Botnet

  • exodusmarket.io

C2

  • 91.92.240.111:1334

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • 51.222.21.20:4782

Mutex

  • 374acc94-a8cd-45c6-bc31-752e0f83541d

Attributes
  • encryption_key

    5B2A5F50FABB3F6748116D7077D95758D0DFFC77

  • install_name

    svchost.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    svchost

  • subdirectory

    SubDir

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar payload 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 8 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    evasion
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 10 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 34 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 5 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 24 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 19 IoCs
  • Suspicious use of SendNotifyMessage 15 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3520
      • C:\Users\Admin\AppData\Local\Temp\4a497ffd501a8dad3c90c94a939b38b0f2c0f3c6836b14a2762b1e42e2d178e2.exe
        "C:\Users\Admin\AppData\Local\Temp\4a497ffd501a8dad3c90c94a939b38b0f2c0f3c6836b14a2762b1e42e2d178e2.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:3560
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2840
          • C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1640
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
                PID:952
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4500
            • C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
              "C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3812
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                  PID:4288
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:704
              • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
                "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5112
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                  • Checks computer location settings
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2684
                  • C:\Users\Admin\AppData\Roaming\Rb0mOI5QfQ.exe
                    "C:\Users\Admin\AppData\Roaming\Rb0mOI5QfQ.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1444
                  • C:\Users\Admin\AppData\Roaming\bcvmTrTZUb.exe
                    "C:\Users\Admin\AppData\Roaming\bcvmTrTZUb.exe"
                    6⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3740
              • C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
                "C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks SCSI registry key(s)
                PID:1804
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 356
                  5⤵
                  • Program crash
                  PID:3436
              • C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
                "C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1272
              • C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
                "C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3604
                • C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe"
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of WriteProcessMemory
                  PID:4204
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c "ver"
                    6⤵
                      PID:3444
                • C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:32
                  • C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe"
                    5⤵
                    • Drops startup file
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3544
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c "ver"
                      6⤵
                        PID:628
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\_MEI322\Blsvr.exe
                        6⤵
                          PID:4488
                          • C:\Users\Admin\AppData\Local\Temp\_MEI322\Blsvr.exe
                            C:\Users\Admin\AppData\Local\Temp\_MEI322\Blsvr.exe
                            7⤵
                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2484
                    • C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe"
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4088
                    • C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:5484
                    • C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Checks processor information in registry
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5564
                    • C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe"
                      4⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5776
                    • C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe"
                      4⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      PID:6316
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
                        5⤵
                          PID:6216
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.exe
                            clamer.exe -priverdD
                            6⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            PID:6120
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe"
                              7⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              PID:6036
                      • C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        PID:5908
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          5⤵
                            PID:6836
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            5⤵
                            • Checks computer location settings
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:6824
                            • C:\Users\Admin\AppData\Local\Temp\pureee.exe
                              "C:\Users\Admin\AppData\Local\Temp\pureee.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5380
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u ETC:0x612e5dBaff1fa2Be8D30e5684630c26db5c5196B.RIG_CPU -p x --cpu-max-threads-hint=50
                                7⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                PID:3100
                            • C:\Users\Admin\AppData\Local\Temp\adada.exe
                              "C:\Users\Admin\AppData\Local\Temp\adada.exe"
                              6⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2432
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
                                7⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:5912
                              • C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe
                                "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe"
                                7⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:7144
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svchost.exe" /rl HIGHEST /f
                                  8⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:7092
                            • C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
                              "C:\Users\Admin\AppData\Local\Temp\dropperrr.exe"
                              6⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              PID:668
                              • C:\Windows\System32\msiexec.exe
                                "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DirectX11\em_TaWHWZA1_installer_Win7-Win11_x86_x64.msi.msi"
                                7⤵
                                • Blocklisted process makes network request
                                • Enumerates connected drives
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                PID:2064
                    • C:\Windows\System32\cmd.exe
                      C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                      2⤵
                        PID:7028
                        • C:\Windows\System32\sc.exe
                          sc stop UsoSvc
                          3⤵
                          • Launches sc.exe
                          PID:808
                        • C:\Windows\System32\sc.exe
                          sc stop WaaSMedicSvc
                          3⤵
                          • Launches sc.exe
                          PID:7036
                        • C:\Windows\System32\sc.exe
                          sc stop wuauserv
                          3⤵
                          • Launches sc.exe
                          PID:1604
                        • C:\Windows\System32\sc.exe
                          sc stop bits
                          3⤵
                          • Launches sc.exe
                          PID:2096
                        • C:\Windows\System32\sc.exe
                          sc stop dosvc
                          3⤵
                          • Launches sc.exe
                          PID:7068
                      • C:\Windows\System32\cmd.exe
                        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                        2⤵
                        • Power Settings
                        PID:7080
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -hibernate-timeout-ac 0
                          3⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4636
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -hibernate-timeout-dc 0
                          3⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3240
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -standby-timeout-ac 0
                          3⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4960
                        • C:\Windows\System32\powercfg.exe
                          powercfg /x -standby-timeout-dc 0
                          3⤵
                          • Power Settings
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1180
                      • C:\Windows\System32\conhost.exe
                        C:\Windows\System32\conhost.exe
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:7132
                    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                      C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                      1⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious behavior: EnumeratesProcesses
                      PID:8
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1804 -ip 1804
                      1⤵
                        PID:3100
                      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                        C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5996
                      • C:\ProgramData\mgvpqtt\poeuj.exe
                        C:\ProgramData\mgvpqtt\poeuj.exe
                        1⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:6996
                      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                        C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:2576
                      • C:\Windows\system32\msiexec.exe
                        C:\Windows\system32\msiexec.exe /V
                        1⤵
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        PID:372
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding F0636B28AB211C43020BDF6C59F2BA23
                          2⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          PID:5212
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding 6F176D3A60ACDFD36EAFCD29A7F08D7B E Global\MSI0000
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          PID:6540
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\SysWOW64\cmd.exe" /C "cd "C:\Program Files (x86)\COMODO\Endpoint Manager\" && "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe" "
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:7152
                            • C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe
                              "C:\Program Files (x86)\COMODO\Endpoint Manager\python_x86_Lib.exe"
                              4⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • System Location Discovery: System Language Discovery
                              • Modifies data under HKEY_USERS
                              PID:7000
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:3668
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                          PID:7140
                        • C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe
                          "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMService.exe"
                          1⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          • Modifies data under HKEY_USERS
                          • Suspicious use of SetWindowsHookEx
                          PID:5536
                          • C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
                            "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of SetWindowsHookEx
                            PID:2672
                          • C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
                            "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe" noui
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:6976
                          • C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
                            "C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe"
                            2⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:5836

                        Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              System Services

                              1
                              T1569

                              Service Execution

                              1
                              T1569.002

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Power Settings

                              1
                              T1653

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Impair Defenses

                              1
                              T1562

                              Modify Registry

                              2
                              T1112

                              Subvert Trust Controls

                              1
                              T1553

                              Install Root Certificate

                              1
                              T1553.004

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Unsecured Credentials

                              5
                              T1552

                              Credentials In Files

                              4
                              T1552.001

                              Credentials in Registry

                              1
                              T1552.002

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Peripheral Device Discovery

                              2
                              T1120

                              Query Registry

                              9
                              T1012

                              System Information Discovery

                              6
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Lateral Movement

                              Collection

                              Data from Local System

                              4
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Service Stop

                              1
                              T1489

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              e59bde8.rbs
                              • Path C:\Config.Msi\e59bde8.rbs
                              • Size 710KB
                              • SHA256 39b1ff60c709ecfa9185d4fc42a17cb0548e3bee12b723158921041bf7a5608f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              ITSMAgent.exe
                              • Path C:\Program Files (x86)\COMODO\Endpoint Manager\ITSMAgent.exe
                              • Size 3.0MB
                              • SHA256 5a137bfe1f0e6fc8a7b6957d5e9f10df997c485e0869586706b566015ff36763
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              zip-safe
                              • Path C:\Program Files (x86)\COMODO\Endpoint Manager\Lib\site-packages\setuptools-18.2.dist-info\zip-safe
                              • Size 2B
                              • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
                              • MD5 SHA1 SHA512
                              Submit Download

                              CFBAKEHI
                              • Path C:\ProgramData\CFBAKEHI
                              • Size 114KB
                              • SHA256 cea835dd92db41aa681b39dbe9376b854062d93733056788d83fe1c1f6b4eb27
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              DBGHJEBK
                              • Path C:\ProgramData\DBGHJEBK
                              • Size 116KB
                              • SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              KKEHDBAEGIIIEBGCAAFH
                              • Path C:\ProgramData\KKEHDBAEGIIIEBGCAAFH
                              • Size 10KB
                              • SHA256 cd5b670f1f2d3cccd121ba4194b93c7cd15db984e75f76d38910edbfadf07368
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              mozglue.dll
                              • Path C:\ProgramData\mozglue.dll
                              • Size 593KB
                              • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              nss3.dll
                              • Path C:\ProgramData\nss3.dll
                              • Size 2.0MB
                              • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              GOLD.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
                              • Size 529KB
                              • SHA256 519ee8e7e8891d779ac3238b9cb815fa2188c89ec58ccf96d8c5f14d53d2494b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              4434.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000003001\4434.exe
                              • Size 413KB
                              • SHA256 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              crypteda.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
                              • Size 1.4MB
                              • SHA256 e015f535c8a9fab72f2e06863c559108b1a25af90468cb9f80292c3ba2c33f6e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              2.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000005001\2.exe
                              • Size 184KB
                              • SHA256 5536fb1508ff354c9cde0cb7082d1c9de9fd9c4eee515a3a7e352a0d0e63f32c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              25072023.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000009001\25072023.exe
                              • Size 304KB
                              • SHA256 27955c80c620c31df686ccd2a92bce1d07e97c16fda6bd141812e9b0bdd7b06b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              pered.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000010001\pered.exe
                              • Size 10.9MB
                              • SHA256 1011889e66c56fd137bf85b832c4afc1fd054222b2fcbaae6608836d27e8f840
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              2020.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000012001\2020.exe
                              • Size 12.3MB
                              • SHA256 6f2964216c81a6f67309680b7590dfd4df31a19c7fc73917fa8057b9a194b617
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              buildred.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000027001\buildred.exe
                              • Size 304KB
                              • SHA256 a0d7bc2ccf07af7960c580fd43928b5fb02b901f9962eafb10f607e395759306
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Authenticator.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000036001\Authenticator.exe
                              • Size 11.0MB
                              • SHA256 f18afd984df441d642187620e435e8b227c0e31d407f82a67c6c8b36f94bd980
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              stealc_valenciga.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000045001\stealc_valenciga.exe
                              • Size 187KB
                              • SHA256 5b1538d09a2374d64a845d748f8008438e53938bea792c05bdcf926dfd4503e1
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              30072024.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000050001\30072024.exe
                              • Size 304KB
                              • SHA256 ba7517fbc65542871d06e7d4b7a017d5c165f55dda2b741e2ba52a6303d21b57
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              jsawdtyjde.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000057001\jsawdtyjde.exe
                              • Size 898KB
                              • SHA256 7f74b2c86e9f5706fc44c8d5093a027d1cd5856006aa80f270efae26d55c9131
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              deepweb.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\1000058001\deepweb.exe
                              • Size 294KB
                              • SHA256 2f502689b799fd964bced77e57edf4206809bb11da16cf4f7895df1df54cdc97
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              axplong.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                              • Size 1.8MB
                              • SHA256 4a497ffd501a8dad3c90c94a939b38b0f2c0f3c6836b14a2762b1e42e2d178e2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              thkdh.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\RarSFX1\thkdh.exe
                              • Size 16KB
                              • SHA256 b63a0e5f93b26ad0eeb9efba66691f3b7e7f51e93a2f0098bde43833f7a24cc2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              TmpD580.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\TmpD580.tmp
                              • Size 2KB
                              • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                              • MD5 SHA1 SHA512
                              Submit Download

                              VCRUNTIME140.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\VCRUNTIME140.dll
                              • Size 96KB
                              • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              _brotli.cp310-win_amd64.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_brotli.cp310-win_amd64.pyd
                              • Size 801KB
                              • SHA256 791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              _bz2.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_bz2.pyd
                              • Size 81KB
                              • SHA256 f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              _ctypes.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_ctypes.pyd
                              • Size 119KB
                              • SHA256 92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              _hashlib.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_hashlib.pyd
                              • Size 60KB
                              • SHA256 1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              _lzma.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_lzma.pyd
                              • Size 154KB
                              • SHA256 80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              _pytransform.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_pytransform.dll
                              • Size 1.1MB
                              • SHA256 c140866b8e579c106fbcd10263282b35075ed542e10b8fd208847490afde23a9
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              _queue.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_queue.pyd
                              • Size 29KB
                              • SHA256 09c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              _socket.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_socket.pyd
                              • Size 75KB
                              • SHA256 8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              _ssl.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\_ssl.pyd
                              • Size 155KB
                              • SHA256 58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              base_library.zip
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\base_library.zip
                              • Size 1.0MB
                              • SHA256 ebf947f7a753533dda44368adf308808ade5b2aa6022470c38af6aca4e230085
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              libcrypto-1_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\libcrypto-1_1.dll
                              • Size 3.3MB
                              • SHA256 9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              libffi-7.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\libffi-7.dll
                              • Size 32KB
                              • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              libssl-1_1.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\libssl-1_1.dll
                              • Size 682KB
                              • SHA256 ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              python3.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\python3.dll
                              • Size 63KB
                              • SHA256 5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              python310.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\python310.dll
                              • Size 4.3MB
                              • SHA256 058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              select.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\select.pyd
                              • Size 28KB
                              • SHA256 68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              ucrtbase.dll
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\ucrtbase.dll
                              • Size 964KB
                              • SHA256 f4723261c04974542a2c618fe58f4995f2dcaf6996656bb027d65adeeca6caf7
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              unicodedata.pyd
                              • Path C:\Users\Admin\AppData\Local\Temp\_MEI36042\unicodedata.pyd
                              • Size 1.1MB
                              • SHA256 2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              adada.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\adada.exe
                              • Size 3.1MB
                              • SHA256 36e6a3dd4bfc86c4e707f43cd9515707442d6c424b7661cb41766cfdca322522
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              dropperrr.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\dropperrr.exe
                              • Size 476KB
                              • SHA256 2449fe334bbf8f09ff80422578a6c6961d20a0a456b214f6490c5ed1ae859c9e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              pureee.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\pureee.exe
                              • Size 662KB
                              • SHA256 014d6c58dd7459c1664196ccd49b796f861d7d7e7e6c573bbb9cdc7cadc21450
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              tmpCE9D.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\tmpCE9D.tmp
                              • Size 40KB
                              • SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              tmpCF0C.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\tmpCF0C.tmp
                              • Size 48KB
                              • SHA256 c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              tmpCF22.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\tmpCF22.tmp
                              • Size 20KB
                              • SHA256 d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              tmpCF54.tmp
                              • Path C:\Users\Admin\AppData\Local\Temp\tmpCF54.tmp
                              • Size 96KB
                              • SHA256 cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              76b53b3ec448f7ccdda2063b15d2bfc3_144fa508-43d0-438d-9b61-75b963a9b225
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3089151618-2647890268-2710988337-1000\76b53b3ec448f7ccdda2063b15d2bfc3_144fa508-43d0-438d-9b61-75b963a9b225
                              • Size 2KB
                              • SHA256 513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a
                              • MD5 SHA1 SHA512
                              Submit Download

                              76b53b3ec448f7ccdda2063b15d2bfc3_144fa508-43d0-438d-9b61-75b963a9b225
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3089151618-2647890268-2710988337-1000\76b53b3ec448f7ccdda2063b15d2bfc3_144fa508-43d0-438d-9b61-75b963a9b225
                              • Size 2KB
                              • SHA256 50b5ebcb6c87a65af6d8169d812ed4b3b7ebd7ed2db08ae50950e18bfb6bbdb3
                              • MD5 SHA1 SHA512
                              Submit Download

                              76b53b3ec448f7ccdda2063b15d2bfc3_144fa508-43d0-438d-9b61-75b963a9b225
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3089151618-2647890268-2710988337-1000\76b53b3ec448f7ccdda2063b15d2bfc3_144fa508-43d0-438d-9b61-75b963a9b225
                              • Size 79B
                              • SHA256 0399ccf5e780949a63400736a46cce7d1879903d0f45c6b7d194c960ba4dddc2
                              • MD5 SHA1 SHA512
                              Submit Download

                              Rb0mOI5QfQ.exe
                              • Path C:\Users\Admin\AppData\Roaming\Rb0mOI5QfQ.exe
                              • Size 510KB
                              • SHA256 0928c96b35cd4cc5887fb205731aa91eb68886b816bcc5ec151aeee81ce4f9a6
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              bcvmTrTZUb.exe
                              • Path C:\Users\Admin\AppData\Roaming\bcvmTrTZUb.exe
                              • Size 503KB
                              • SHA256 0c7173daaa5ad8dabe7a2cde6dbd0eee1ca790071443aa13b01a1e731053491e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Microsoft Edge.lnk
                              • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                              • Size 2KB
                              • SHA256 93400a2790ab6299006ca138e0f91eca7f8a8f2ab7fd5521d6a01d8ba13f1af6
                              • MD5 SHA1 SHA512
                              Submit Download

                              Google Chrome.lnk
                              • Path C:\Users\Public\Desktop\Google Chrome.lnk
                              • Size 2KB
                              • SHA256 aba614c60f872c22fe3be3ee1d64fa0728732ce710602f4d4ec84a2bfc79bb90
                              • MD5 SHA1 SHA512
                              Submit Download

                              MSICB2B.tmp
                              • Path C:\Windows\Installer\MSICB2B.tmp
                              • Size 285KB
                              • SHA256 8f4894b9d19bfe5d8e54b5e120cef6c69abea8958db066cdd4905cc78ecd58b6
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MSICC26.tmp
                              • Path C:\Windows\Installer\MSICC26.tmp
                              • Size 203KB
                              • SHA256 2a81878be73b5c1d7d02c6afc8a82336d11e5f8749eaacf54576638d81ded6e2
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              memory/8-24-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/8-27-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/8-25-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/8-20-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/704-87-0x0000000000400000-0x0000000000643000-memory.dmp
                              Download

                              memory/704-88-0x0000000000400000-0x0000000000643000-memory.dmp
                              Download

                              memory/704-198-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                              Download

                              memory/1272-172-0x0000000000120000-0x0000000000172000-memory.dmp
                              Download

                              memory/1444-135-0x0000000000D00000-0x0000000000D86000-memory.dmp
                              Download

                              memory/1804-216-0x0000000000400000-0x0000000000442000-memory.dmp
                              Download

                              memory/2432-3590-0x0000000000580000-0x00000000008A4000-memory.dmp
                              Download

                              memory/2576-6592-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/2576-6594-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/2684-111-0x0000000000400000-0x0000000000536000-memory.dmp
                              Download

                              memory/2684-107-0x0000000000400000-0x0000000000536000-memory.dmp
                              Download

                              memory/2684-131-0x0000000000400000-0x0000000000536000-memory.dmp
                              Download

                              memory/2684-108-0x0000000000400000-0x0000000000536000-memory.dmp
                              Download

                              memory/2684-110-0x0000000000400000-0x0000000000536000-memory.dmp
                              Download

                              memory/2840-17-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/2840-197-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/2840-293-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/2840-22-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/2840-21-0x0000000000F71000-0x0000000000F9F000-memory.dmp
                              Download

                              memory/2840-23-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/2840-287-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/2840-1705-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/2840-294-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/3560-2-0x0000000000EB1000-0x0000000000EDF000-memory.dmp
                              Download

                              memory/3560-1-0x00000000771D4000-0x00000000771D6000-memory.dmp
                              Download

                              memory/3560-0-0x0000000000EB0000-0x000000000136B000-memory.dmp
                              Download

                              memory/3560-3-0x0000000000EB0000-0x000000000136B000-memory.dmp
                              Download

                              memory/3560-4-0x0000000000EB0000-0x000000000136B000-memory.dmp
                              Download

                              memory/3560-18-0x0000000000EB0000-0x000000000136B000-memory.dmp
                              Download

                              memory/3740-136-0x00000000007A0000-0x0000000000824000-memory.dmp
                              Download

                              memory/4088-1818-0x0000000000940000-0x0000000000992000-memory.dmp
                              Download

                              memory/4204-429-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-433-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-461-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-447-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-445-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-427-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-449-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-459-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-431-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-453-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-435-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-437-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-439-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-424-0x0000021C4D670000-0x0000021C4D671000-memory.dmp
                              Download

                              memory/4204-441-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-451-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-443-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-457-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-455-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4204-425-0x0000021C4D680000-0x0000021C4D681000-memory.dmp
                              Download

                              memory/4500-84-0x0000000007310000-0x0000000007322000-memory.dmp
                              Download

                              memory/4500-60-0x0000000005560000-0x00000000055F2000-memory.dmp
                              Download

                              memory/4500-85-0x0000000007370000-0x00000000073AC000-memory.dmp
                              Download

                              memory/4500-86-0x00000000073B0000-0x00000000073FC000-memory.dmp
                              Download

                              memory/4500-82-0x0000000007430000-0x0000000007A48000-memory.dmp
                              Download

                              memory/4500-194-0x0000000006E80000-0x0000000006EE6000-memory.dmp
                              Download

                              memory/4500-79-0x0000000006AA0000-0x0000000006ABE000-memory.dmp
                              Download

                              memory/4500-78-0x00000000062E0000-0x0000000006356000-memory.dmp
                              Download

                              memory/4500-61-0x0000000005710000-0x000000000571A000-memory.dmp
                              Download

                              memory/4500-83-0x0000000008CB0000-0x0000000008DBA000-memory.dmp
                              Download

                              memory/4500-59-0x0000000005A70000-0x0000000006014000-memory.dmp
                              Download

                              memory/4500-225-0x000000000A630000-0x000000000AB5C000-memory.dmp
                              Download

                              memory/4500-219-0x0000000009F30000-0x000000000A0F2000-memory.dmp
                              Download

                              memory/4500-58-0x0000000000400000-0x0000000000452000-memory.dmp
                              Download

                              memory/4500-215-0x0000000008E50000-0x0000000008EA0000-memory.dmp
                              Download

                              memory/5380-2375-0x00000222FF820000-0x00000222FF92A000-memory.dmp
                              Download

                              memory/5380-6410-0x00000222980D0000-0x000002229811C000-memory.dmp
                              Download

                              memory/5380-6409-0x0000022298070000-0x00000222980C6000-memory.dmp
                              Download

                              memory/5380-2374-0x00000222FD300000-0x00000222FD3AA000-memory.dmp
                              Download

                              memory/5564-1934-0x0000000000B40000-0x0000000000D83000-memory.dmp
                              Download

                              memory/5564-2119-0x0000000000B40000-0x0000000000D83000-memory.dmp
                              Download

                              memory/5776-1965-0x0000000000550000-0x00000000005A2000-memory.dmp
                              Download

                              memory/5996-2112-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/5996-2079-0x0000000000F70000-0x000000000142B000-memory.dmp
                              Download

                              memory/6824-2113-0x0000000000400000-0x000000000041E000-memory.dmp
                              Download

                              memory/7144-6439-0x000000001CA40000-0x000000001CA7C000-memory.dmp
                              Download

                              memory/7144-6438-0x000000001C370000-0x000000001C382000-memory.dmp
                              Download

                              memory/7144-6437-0x000000001CAC0000-0x000000001CB72000-memory.dmp
                              Download

                              memory/7144-6436-0x000000001C390000-0x000000001C3E0000-memory.dmp
                              Download