Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-08-2024 23:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588.exe

  • Size

    1.8MB

  • MD5

    c280d106a32a8c5d5e4d93efc0abf97a

  • SHA1

    1ce409e19234b0a7359034c5074048d9dfb9dee8

  • SHA256

    2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588

  • SHA512

    c49c1c1307cdec417d9b93575aef7de2904a01a8bdcf8a05453e9e3232bb5a709c1c55ca76c8d395faf35b59b7e34cd574c27d422c7c7a0e02682d6ebae441e1

  • SSDEEP

    49152:dgpV8sXFYrot7ALPQzt679V4p5fXmUtph:n5ckMWU

Score
10/10
amadeyasyncratredlinestealczharkbot@cloudytteamdefaultdefault2fed3aalivetrafficbotnetcredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerpersistencepyinstallerratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

45.200.149.147:4782

Mutex

uXnIs7mA0Z5R

Attributes
  • delay

    3

  • install

    false

  • install_file

    javaupdate.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detects ZharkBot payload 1 IoCs

    ZharkBot is a botnet written C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZharkBot

    ZharkBot is a botnet written C++.

    botnetzharkbot
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 9 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 29 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Indirect Command Execution 1 TTPs 6 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion
  • Loads dropped DLL 18 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 3 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588.exe
    "C:\Users\Admin\AppData\Local\Temp\2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:896
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4508
        • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1304
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3300
            • C:\Users\Admin\AppData\Roaming\WGAP6ASxFm.exe
              "C:\Users\Admin\AppData\Roaming\WGAP6ASxFm.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3396
            • C:\Users\Admin\AppData\Roaming\rV23zx4Zky.exe
              "C:\Users\Admin\AppData\Roaming\rV23zx4Zky.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4920
        • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1680
          • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4768
        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
          "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:4040
        • C:\Users\Admin\AppData\Local\Temp\1000129001\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\1000129001\Setup.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Users\Admin\AppData\Local\Temp\service123.exe
            "C:\Users\Admin\AppData\Local\Temp\service123.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2928
        • C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe
          "C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"
          3⤵
          • Executes dropped EXE
          PID:3124
        • C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe
          "C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4944
          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4936
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1228
              5⤵
              • Program crash
              PID:4420
        • C:\Users\Admin\1000238002\Amadeus.exe
          "C:\Users\Admin\1000238002\Amadeus.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:952
          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3024
        • C:\Users\Admin\AppData\Local\Temp\1000239001\runtime.exe
          "C:\Users\Admin\AppData\Local\Temp\1000239001\runtime.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:4192
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4048
            • C:\Users\Admin\AppData\Local\Temp\1000255001\channel2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000255001\channel2.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:4940
            • C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe
              "C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe"
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:3128
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:576
            • C:\Users\Admin\AppData\Local\Temp\1000260001\Channel1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000260001\Channel1.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:1536
            • C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe
              "C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1580
              • C:\Users\Admin\AppData\Local\Temp\7zS816B.tmp\Install.exe
                .\Install.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3004
                • C:\Users\Admin\AppData\Local\Temp\7zS83AD.tmp\Install.exe
                  .\Install.exe /CtlLXdidO "385107" /S
                  7⤵
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  PID:1840
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2996
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:4628
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:2552
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:5104
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:1408
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:2108
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:3756
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:2340
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:2376
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:224
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:1460
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:3712
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:3584
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:4288
                      • C:\Windows\SysWOW64\cmd.exe
                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:3900
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                          11⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3448
                          • C:\Windows\SysWOW64\gpupdate.exe
                            "C:\Windows\system32\gpupdate.exe" /force
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:3468
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    8⤵
                    • Indirect Command Execution
                    • System Location Discovery: System Language Discovery
                    PID:1816
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:5100
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        10⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3476
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          11⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3408
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "bISIDNXXYteSJEZXLD" /SC once /ST 23:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS83AD.tmp\Install.exe\" W7 /kFhqdidCBs 385107 /S" /V1 /F
                    8⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:4896
            • C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe
              "C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:764
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 508
                6⤵
                • Program crash
                PID:1936
            • C:\Users\Admin\AppData\Local\Temp\1000277001\ovrflw.exe
              "C:\Users\Admin\AppData\Local\Temp\1000277001\ovrflw.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:3492
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4712
            • C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe
              "C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe"
              5⤵
              • Executes dropped EXE
              PID:2036
              • C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe
                "C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2376
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmpsii0ucsd.bat"
                  7⤵
                    PID:4832
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic diskdrive get Model
                      8⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4588
                    • C:\Windows\system32\findstr.exe
                      findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
                      8⤵
                        PID:1992
            • C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe
              "C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4964
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:3656
        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          1⤵
          • Executes dropped EXE
          PID:5008
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4936 -ip 4936
          1⤵
            PID:800
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3024 -ip 3024
            1⤵
              PID:4636
            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
              C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
              1⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:3264
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              1⤵
              • Executes dropped EXE
              PID:1400
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 764 -ip 764
              1⤵
                PID:3464

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Indirect Command Execution

              1
              T1202

              Modify Registry

              2
              T1112

              Subvert Trust Controls

              1
              T1553

              Install Root Certificate

              1
              T1553.004

              Virtualization/Sandbox Evasion

              2
              T1497

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              4
              T1552.001

              Discovery

              Query Registry

              6
              T1012

              System Information Discovery

              4
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Virtualization/Sandbox Evasion

              2
              T1497

              Lateral Movement

              Collection

              Data from Local System

              3
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\mozglue.dll
                Filesize

                593KB

                MD5

                c8fd9be83bc728cc04beffafc2907fe9

                SHA1

                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                SHA256

                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                SHA512

                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                Download Submit

              • C:\ProgramData\nss3.dll
                Filesize

                2.0MB

                MD5

                1cc453cdf74f31e4d913ff9c10acdde2

                SHA1

                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                SHA256

                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                SHA512

                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                Download Submit

              • C:\Users\Admin\1000238002\Amadeus.exe
                Filesize

                5.3MB

                MD5

                36a627b26fae167e6009b4950ff15805

                SHA1

                f3cb255ab3a524ee05c8bab7b4c01c202906b801

                SHA256

                a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a

                SHA512

                2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                Filesize

                1KB

                MD5

                e080d58e6387c9fd87434a502e1a902e

                SHA1

                ae76ce6a2a39d79226c343cfe4745d48c7c1a91a

                SHA256

                6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425

                SHA512

                6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                15KB

                MD5

                4781823745a38172efd2754f469a3e5e

                SHA1

                82c4f03745538f4361032b6a5753196a50d7a757

                SHA256

                73d7626e51011353fc476476ee3417df207701d6363ce685aaad368b61054d27

                SHA512

                62cf4f39769e4f669fbf5a01ba6fb9f1e878db045d32849a7364191eef9902ce60e84bf340d0fa5ddf6184e7973ce30f22677b694414ec4e363efb1e708d1d7c

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
                Filesize

                314KB

                MD5

                6134586375c01f97f8777bae1bf5ed98

                SHA1

                4787fa996b75dbc54632cc321725ee62666868a1

                SHA256

                414becb8aabd4e8c406e84df062bee1a45cffa334ae30022078cfa71da9e330d

                SHA512

                652ed16d96b5700f105c2bab8e7258f167bc1615b6397be7340c08df7c977842844326e07fdef677aecfaf07263f99bb7968c9fc926e90e5a33d2ed793f8436b

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
                Filesize

                1.1MB

                MD5

                8e74497aff3b9d2ddb7e7f819dfc69ba

                SHA1

                1d18154c206083ead2d30995ce2847cbeb6cdbc1

                SHA256

                d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66

                SHA512

                9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
                Filesize

                416KB

                MD5

                f5d7b79ee6b6da6b50e536030bcc3b59

                SHA1

                751b555a8eede96d55395290f60adc43b28ba5e2

                SHA256

                2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                SHA512

                532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                Filesize

                187KB

                MD5

                7a02aa17200aeac25a375f290a4b4c95

                SHA1

                7cc94ca64268a9a9451fb6b682be42374afc22fd

                SHA256

                836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

                SHA512

                f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000129001\Setup.exe
                Filesize

                6.4MB

                MD5

                3b99c5464631ad74c76680196c3c64d9

                SHA1

                d631bc593e3e76215f15c4cd8244828225c12329

                SHA256

                33a7fabaceac3e73239ced3eec7c67fa0f17987e4d03fef30161b06564f6d8f9

                SHA512

                e24c258fe8416f3be43c2e37f2cad6561c5a3b501b59e430193360c20bc0c6eb9fc52224f5f844d9f8a6bae2092a1b9208a79f0cbd6fbdc1faf0738b15bdd491

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe
                Filesize

                13.0MB

                MD5

                1a8d05f20424f5bddfe29cd84afec17a

                SHA1

                f81a09b08c53b8f76ea6cf2e821bea65f8c9c213

                SHA256

                f1ecef25154188e919750404135580041edd3b9e608ff8ca311199e1fa11c912

                SHA512

                6d4dfe1f8f150371860cef26d63223a67f887307fdbd8d244e7f2610a07a0a16e70653f457095d1aa204b54c370d1a241e6c5ca398858c6495dec64fc6ca50cb

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe
                Filesize

                9.2MB

                MD5

                366eb232ccb1d3d063e8074f8c4b529f

                SHA1

                13e30ac58cfc74cb05edaf0074eb09927ab5a9fa

                SHA256

                33d866c385c3d05981986f7e3d56eac4966821813d216670d37aa7af7c30d62c

                SHA512

                0a9c2acbf9ef27345efeadda579fea582b3299f96078b9a2959bad5e87a0e7840949518fd905c82cb49b8ed604d93b404fdf85a11d71de1e1ba3dba9c0abab6f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000239001\runtime.exe
                Filesize

                539KB

                MD5

                4d40ebb93aa34bf94d303c07c6a7e5e5

                SHA1

                9333bc5b3f78f0a3cca32e1f6a90af8064bf8a81

                SHA256

                ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5

                SHA512

                9cdce881809159ad07d99e9691c1457e7888aa96cf0ea93a19eea105b9db928f8f61c8de98c3b9179556b528fde4eb790d59e954db8a86799aecb38461741d3a

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe
                Filesize

                413KB

                MD5

                05c1baaa01bd0aa0ccb5ec1c43a7d853

                SHA1

                e47d7f53987eb147f599321c858fe8d71ebc0d71

                SHA256

                9998d38b192309056d5109ac27a8b13f2b36fc27bac9ebdf5385452b2c1b0cdb

                SHA512

                996450fc8c8b702327eacfe2eb819c86baccf4d49f2eb58d3dd2b3ce35733f1e00857ac71b290bc99db71baab08d7d7b22ef5223504c93b26ade0df6c9369501

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000255001\channel2.exe
                Filesize

                6.3MB

                MD5

                cfc1a0b3dde8d2c81750a59a016ab5c4

                SHA1

                98874625561529f76b039f3e274be4400aa35d80

                SHA256

                0309d52f0c55715859aab3552dff19bc8529cb48e95576ad3d979b0154390609

                SHA512

                d74335d5a78a4d414bf79dcd13659ef0abad1a02e31aa48bf2087499cd29e1a7907a87339521a3483db3d9458df29c09b7032339d8f83bc651149c9e0c558248

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe
                Filesize

                2.4MB

                MD5

                c48765d2d33f303a03c8a70c8810dd78

                SHA1

                96e2e2ee3a93051e0a9a4945b11ee709ca50aa3c

                SHA256

                62919dc688726421395003025abf1bbcd405048fb5b7c544139a538e5bdc45b0

                SHA512

                d6065b5cae54667a5d35097b330c48847781306964801c5e4b6e7f7d1aea5b8d3a54b65c20cdc65c34e73e857fac3ed7f7d800e6b91f7c98b0cfe92f006f590f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000260001\Channel1.exe
                Filesize

                6.3MB

                MD5

                caff8b55cce4de6920096046f80ca991

                SHA1

                4d6ca5d42bf49e45cce7222dd4e35f4b5be7f563

                SHA256

                ed8342a9e176e5aad2554216077fc94b9bf541acfb518736bdc1883630da159e

                SHA512

                ae8a316e9740db4b4fdb4e3dd3701bcd87593e9a51693d76672b5c21c806840f5bfa01364839711c33529684e0d40d3bbf9695665974811f0e5e114b1d1303e6

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe
                Filesize

                7.3MB

                MD5

                22ef043d76de3aed57bb4188413c6446

                SHA1

                4cafe87db9bc7842c231eef25894fdb0ffcdf335

                SHA256

                cafae0c470a14a3290a2fcd8dfd923ea474b877c236cf84eba1eecf39e458b2f

                SHA512

                aa9da2a4cd14e84519a72d433b89526166201b30946d05b49d7985612d3612e81a21082c37f45bb98c74717e009529590135a14259762fdccecad478927d67b9

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe
                Filesize

                319KB

                MD5

                0ec1f7cc17b6402cd2df150e0e5e92ca

                SHA1

                8405b9bf28accb6f1907fbe28d2536da4fba9fc9

                SHA256

                4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4

                SHA512

                7caa2416bc7878493b62a184ddc844d201a9ab5282abfa77a616316af39ff65309e37bb566b3e29d9e764e08f4eda43a06464acaf9962f911b33e6dbc60c1861

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe
                Filesize

                8.1MB

                MD5

                3819953d6049a482c916f184706e6157

                SHA1

                79e27c88e913850f29bbaf83cbf771c56b7e0584

                SHA256

                39be0d9e62066bd79cbce3416f41776c8e36146cf8f729af61bbb49c800c13f4

                SHA512

                b6ea45775c8bb110e48a9fff8d5d6a6d12c58a98aa0682448c1b737f4added5043b189723b39dd7485e08abb75522c096871d4cbaa500dc68d06a6ba92b03f7f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                Filesize

                1.8MB

                MD5

                c280d106a32a8c5d5e4d93efc0abf97a

                SHA1

                1ce409e19234b0a7359034c5074048d9dfb9dee8

                SHA256

                2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588

                SHA512

                c49c1c1307cdec417d9b93575aef7de2904a01a8bdcf8a05453e9e3232bb5a709c1c55ca76c8d395faf35b59b7e34cd574c27d422c7c7a0e02682d6ebae441e1

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\761892313337
                Filesize

                78KB

                MD5

                b8a6484849c1f6adcf59b198dd8da59c

                SHA1

                8b4a10738670ae16b2ade1376c73d62b9e24c383

                SHA256

                acc97767d9598a83752b91117c3fa9bfc9b5d96de13f9026b2ec901eb573f272

                SHA512

                b8bfd51bc57e908416e82717d1354403e644164d90b4468769165c1a58ec5e13a8d6c60368cad600aa07f69242468a5fde5039a9ae171ee4043c163b9fac0522

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\7zS816B.tmp\Install.exe
                Filesize

                6.4MB

                MD5

                e07d47cc84fc70424b638188d0018360

                SHA1

                360409e54d133a304643e08ab07268ae62f3ec75

                SHA256

                e14b223c0d62833c0a4c4c136fd3b75a9a6a76d7f1b52f3efc6042c38fa7b0b5

                SHA512

                c1b8a5e196657bd6958edc6b8611cf2287d41d31def8e2dda1bacdbf714ebc3f856753fc4e33fd0a257fbec9065ab13d70705a98cb4eef2d83d500a4b98e6086

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\7zS83AD.tmp\Install.exe
                Filesize

                6.7MB

                MD5

                523c9df50948340df2e82213b22c72b7

                SHA1

                9260e4afb910e4f0c98aad1bf8b9bc31f5d7467f

                SHA256

                26f9eafb7869a2bfa9af2ede0363c2a41af6839c4263f6c107ab723de9dd2e37

                SHA512

                28432c1fe74d0f74f3b2edce9cdb2a987e170cd19738384ca63be432108d17d636fc78fc4d55a84b36f7c19ea1999988cd488798064daef986784d6eb4e92c32

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\TmpB277.tmp
                Filesize

                2KB

                MD5

                1420d30f964eac2c85b2ccfe968eebce

                SHA1

                bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                SHA256

                f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                SHA512

                6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\_MEI20362\VCRUNTIME140.dll
                Filesize

                116KB

                MD5

                be8dbe2dc77ebe7f88f910c61aec691a

                SHA1

                a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                SHA256

                4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                SHA512

                0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\_MEI20362\python312.dll
                Filesize

                6.6MB

                MD5

                cae8fa4e7cb32da83acf655c2c39d9e1

                SHA1

                7a0055588a2d232be8c56791642cb0f5abbc71f8

                SHA256

                8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

                SHA512

                db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sdog2b2c.ylx.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3761892313-3378554128-2287991803-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1a4dc33f-c784-4d28-8db2-389663d94aeb
                Filesize

                2KB

                MD5

                f25c8997cad9d584fa05c38c55de4e11

                SHA1

                9321f0e4d5010d1aacdb96092e9a463a2fe6dcae

                SHA256

                f9b3b7b440faef68ffebcb49aac02d6fd4d4824da430c893d5b43ef552279a36

                SHA512

                c3b1ff062f12535df6332cfa96b492e21af1c3762ba9b3d742fff9667a9b64a2f110b13d0fd6a65e95803cdc62c3a6c2e9fc1660d1a783ceafbedd7981977db2

                Download Submit

              • C:\Users\Admin\AppData\Roaming\WGAP6ASxFm.exe
                Filesize

                544KB

                MD5

                88367533c12315805c059e688e7cdfe9

                SHA1

                64a107adcbac381c10bd9c5271c2087b7aa369ec

                SHA256

                c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9

                SHA512

                7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

                Download Submit

              • C:\Users\Admin\AppData\Roaming\rV23zx4Zky.exe
                Filesize

                304KB

                MD5

                30f46f4476cdc27691c7fdad1c255037

                SHA1

                b53415af5d01f8500881c06867a49a5825172e36

                SHA256

                3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0

                SHA512

                271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

                Download Submit

              • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                Filesize

                2KB

                MD5

                6a4472d4c7abec00310b234ea0c28547

                SHA1

                4171fb4c397752ec698de83792768845ccd2d529

                SHA256

                4dc3c62597461ffcf8ba29dc8ec65361b4ceb86a004ba03a5cabab724d117c5c

                SHA512

                4341c8ef29c8d1a030b0778463bf5426df381dd9a5c61d8ccf2071891e13b29333b6b2004755e57297ac47db084560dab17a950f2989ebb0d42a7205f26a4d60

                Download Submit

              • C:\Users\Public\Desktop\Google Chrome.lnk
                Filesize

                2KB

                MD5

                c76fbef985ab379c9e911d2f9b48041d

                SHA1

                1a34bf7262aa31adfa1728f21159a545c8ae331b

                SHA256

                036f1cf1929d43398566c74ff519b4b378201f9d1b455f33a00f761ed9e1da11

                SHA512

                7eebb9b34186e448df4b98e70a8bba70e16927d616379e06c5dd622f6fcc234492c6d14971e34bc19bd3225ba71e5dd480c004b4cdee173fb8c956112db05deb

                Download Submit

              • memory/576-628-0x0000000000390000-0x00000000003A2000-memory.dmp

                Filesize

                72KB

                Download

              • memory/576-652-0x0000000005010000-0x00000000050AC000-memory.dmp

                Filesize

                624KB

                Download

              • memory/1304-93-0x0000000000260000-0x0000000000372000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/1840-593-0x00000000002D0000-0x0000000000981000-memory.dmp

                Filesize

                6.7MB

                Download

              • memory/1840-723-0x00000000002D0000-0x0000000000981000-memory.dmp

                Filesize

                6.7MB

                Download

              • memory/2620-323-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-19-0x0000000000AE1000-0x0000000000B0F000-memory.dmp

                Filesize

                184KB

                Download

              • memory/2620-21-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-20-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-186-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-377-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-188-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-261-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-344-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-16-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-197-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2620-288-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/2740-43-0x0000000000790000-0x00000000007E4000-memory.dmp

                Filesize

                336KB

                Download

              • memory/2740-42-0x000000007278E000-0x000000007278F000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2928-378-0x0000000000090000-0x00000000000A1000-memory.dmp

                Filesize

                68KB

                Download

              • memory/2928-379-0x0000000072F00000-0x000000007303C000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/3124-316-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-321-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-313-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-314-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-333-0x0000000000400000-0x0000000001121000-memory.dmp

                Filesize

                13.1MB

                Download

              • memory/3124-307-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-345-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-325-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-320-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-319-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-318-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-317-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3124-315-0x0000000140000000-0x00000001402B1000-memory.dmp

                Filesize

                2.7MB

                Download

              • memory/3264-529-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/3264-531-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/3300-99-0x0000000000400000-0x000000000050D000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/3300-97-0x0000000000400000-0x000000000050D000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/3300-100-0x0000000000400000-0x000000000050D000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/3300-95-0x0000000000400000-0x000000000050D000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/3300-120-0x0000000000400000-0x000000000050D000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/3396-125-0x0000000000390000-0x000000000041E000-memory.dmp

                Filesize

                568KB

                Download

              • memory/3448-614-0x0000000005510000-0x0000000005532000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3448-624-0x0000000005700000-0x0000000005A57000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3448-630-0x0000000006070000-0x000000000608A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3448-631-0x00000000060C0000-0x00000000060E2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3448-613-0x0000000004D70000-0x000000000539A000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/3448-615-0x00000000055B0000-0x0000000005616000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3448-626-0x0000000005C80000-0x0000000005CCC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3448-612-0x0000000004700000-0x0000000004736000-memory.dmp

                Filesize

                216KB

                Download

              • memory/3448-625-0x0000000005B90000-0x0000000005BAE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3448-629-0x0000000006B60000-0x0000000006BF6000-memory.dmp

                Filesize

                600KB

                Download

              • memory/3476-648-0x0000000006470000-0x00000000064BC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3568-4-0x0000000000840000-0x0000000000CD8000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/3568-3-0x0000000000840000-0x0000000000CD8000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/3568-18-0x0000000000840000-0x0000000000CD8000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/3568-0-0x0000000000840000-0x0000000000CD8000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/3568-2-0x0000000000841000-0x000000000086F000-memory.dmp

                Filesize

                184KB

                Download

              • memory/3568-1-0x0000000076EE6000-0x0000000076EE8000-memory.dmp

                Filesize

                8KB

                Download

              • memory/3656-335-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/3656-342-0x0000000000AE0000-0x0000000000F78000-memory.dmp

                Filesize

                4.6MB

                Download

              • memory/4040-202-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                Filesize

                972KB

                Download

              • memory/4040-287-0x0000000000EE0000-0x0000000001123000-memory.dmp

                Filesize

                2.3MB

                Download

              • memory/4040-187-0x0000000000EE0000-0x0000000001123000-memory.dmp

                Filesize

                2.3MB

                Download

              • memory/4192-432-0x000000001CF40000-0x000000001CFB0000-memory.dmp

                Filesize

                448KB

                Download

              • memory/4192-431-0x000000001CD80000-0x000000001CE02000-memory.dmp

                Filesize

                520KB

                Download

              • memory/4192-430-0x0000000000ED0000-0x0000000000F5E000-memory.dmp

                Filesize

                568KB

                Download

              • memory/4508-50-0x0000000004E10000-0x0000000004EA2000-memory.dmp

                Filesize

                584KB

                Download

              • memory/4508-200-0x0000000009030000-0x0000000009080000-memory.dmp

                Filesize

                320KB

                Download

              • memory/4508-67-0x00000000060F0000-0x000000000610E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/4508-189-0x00000000064E0000-0x0000000006546000-memory.dmp

                Filesize

                408KB

                Download

              • memory/4508-51-0x0000000004EB0000-0x0000000004EBA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/4508-70-0x0000000006A80000-0x0000000007098000-memory.dmp

                Filesize

                6.1MB

                Download

              • memory/4508-71-0x0000000008240000-0x000000000834A000-memory.dmp

                Filesize

                1.0MB

                Download

              • memory/4508-72-0x00000000069B0000-0x00000000069C2000-memory.dmp

                Filesize

                72KB

                Download

              • memory/4508-73-0x0000000006A10000-0x0000000006A4C000-memory.dmp

                Filesize

                240KB

                Download

              • memory/4508-192-0x00000000090C0000-0x0000000009282000-memory.dmp

                Filesize

                1.8MB

                Download

              • memory/4508-74-0x0000000008350000-0x000000000839C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/4508-66-0x0000000005380000-0x00000000053F6000-memory.dmp

                Filesize

                472KB

                Download

              • memory/4508-193-0x00000000097C0000-0x0000000009CEC000-memory.dmp

                Filesize

                5.2MB

                Download

              • memory/4508-49-0x0000000005490000-0x0000000005A36000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/4508-46-0x0000000000400000-0x0000000000452000-memory.dmp

                Filesize

                328KB

                Download

              • memory/4920-124-0x0000000000100000-0x0000000000152000-memory.dmp

                Filesize

                328KB

                Download

              • memory/4964-466-0x0000000000970000-0x00000000009DE000-memory.dmp

                Filesize

                440KB

                Download

              • memory/4964-472-0x0000000008760000-0x00000000087AC000-memory.dmp

                Filesize

                304KB

                Download

              • memory/5024-322-0x0000000000400000-0x000000000106C000-memory.dmp

                Filesize

                12.4MB

                Download

              • memory/5024-286-0x0000000000400000-0x000000000106C000-memory.dmp

                Filesize

                12.4MB

                Download

              • memory/5024-356-0x0000000000400000-0x000000000106C000-memory.dmp

                Filesize

                12.4MB

                Download