amadey | 6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada

Analysis

max time kernel
42s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2024 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
Size

1.8MB
MD5

d4ed860bf819dd9b0f6e3e80107c9c94
SHA1

ebd62fcef67d426ce665bd9e14f87c9b4b61d00e
SHA256

6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada
SHA512

dd23ad7dfdad5bae4db713dd423c2f9930a5e0fb2aeff6e2e9e8ff112c2bfd7fa6c1e4033bf64dd117a72d3a7398ce118789f24af79bc6b84e1f52b66a982d15
SSDEEP

24576:y4PAI1YSShmEpuptdHVwPmGSTuPubim0J3SA3y8rWHnn7c/9wcNDP6RgEhrn0R0G:VAIS55GCmB0fQAC8KH7eweO0WpU

Score

10^/10

amadey cryptbot lumma redline stealc 1176f2 default_valenciga doma fed3aa tg cloud @rlreborn admin @fatherofcarders credential_access discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
78.138.146.51
Port:
21
Username:
stoneronald
Password:
$F@^sq72A(ODY!

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

lumma

https://snailyeductyi.sbs

https://ferrycheatyk.sbs

https://deepymouthi.sbs

https://wrigglesight.sbs

https://captaitwik.sbs

https://sidercotay.sbs

https://heroicmint.sbs

https://monstourtu.sbs

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29155

Extracted

Family

stealc

Botnet

doma

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

cryptbot

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4992-322-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4876	chrome.exe
4720	chrome.exe
3448	chrome.exe
3288	chrome.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Hkbsse.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	pvp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Newofff.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	processclass.exe

Executes dropped EXE 17 IoCs

pid	Process
1048	axplong.exe
4720	pvp.exe
2024	stealc_default2.exe
2000	processclass.exe
3608	pvp.exe
1508	4NEE3IJnl5.exe
4248	QCL4cOO2zz.exe
4576	splwow64.exe
4168	golden.exe
1888	golden.exe
1028	Newofff.exe
2184	Hkbsse.exe
2288	context.exe
2984	JavUmar1.exe
432	Hkbsse.exe
2692	axplong.exe
3132	bwapp.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Wine	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe

Loads dropped DLL 2 IoCs

pid	Process
2024	stealc_default2.exe
2024	stealc_default2.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bwapp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000489001\\bwapp.exe"	bwapp.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3236	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
1048	axplong.exe
2692	axplong.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 3608	4720	pvp.exe	95
PID 4168 set thread context of 1888	4168	golden.exe	158
PID 4576 set thread context of 3956	4576	splwow64.exe	148

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
File created	C:\Windows\Tasks\Hkbsse.job	Newofff.exe

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023cce-270.dat	embeds_openssl
behavioral2/files/0x0007000000023cef-386.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4020	4720	WerFault.exe	91
1568	4168	WerFault.exe	103
2536	1888	WerFault.exe	104
4480	1888	WerFault.exe	104
1860	1264	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JavUmar1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Newofff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
3840	timeout.exe
3772	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4460	taskkill.exe
4264	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5024	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3236	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
3236	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
1048	axplong.exe
1048	axplong.exe
2024	stealc_default2.exe
2024	stealc_default2.exe
1508	4NEE3IJnl5.exe
1508	4NEE3IJnl5.exe
4576	splwow64.exe
4576	splwow64.exe
4576	splwow64.exe
4576	splwow64.exe
2024	stealc_default2.exe
2024	stealc_default2.exe
2692	axplong.exe
2692	axplong.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeBackupPrivilege	1508	4NEE3IJnl5.exe
Token: SeSecurityPrivilege	1508	4NEE3IJnl5.exe
Token: SeSecurityPrivilege	1508	4NEE3IJnl5.exe
Token: SeSecurityPrivilege	1508	4NEE3IJnl5.exe
Token: SeSecurityPrivilege	1508	4NEE3IJnl5.exe
Token: SeDebugPrivilege	1508	4NEE3IJnl5.exe
Token: SeDebugPrivilege	2000	processclass.exe
Token: SeDebugPrivilege	4576	splwow64.exe
Token: SeDebugPrivilege	4264	taskkill.exe
Token: SeDebugPrivilege	2288	context.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3236	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 1048	3236	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe	87
PID 3236 wrote to memory of 1048	3236	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe	87
PID 3236 wrote to memory of 1048	3236	6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe	87
PID 1048 wrote to memory of 4720	1048	axplong.exe	146
PID 1048 wrote to memory of 4720	1048	axplong.exe	146
PID 1048 wrote to memory of 4720	1048	axplong.exe	146
PID 1048 wrote to memory of 2024	1048	axplong.exe	93
PID 1048 wrote to memory of 2024	1048	axplong.exe	93
PID 1048 wrote to memory of 2024	1048	axplong.exe	93
PID 1048 wrote to memory of 2000	1048	axplong.exe	94
PID 1048 wrote to memory of 2000	1048	axplong.exe	94
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 4720 wrote to memory of 3608	4720	pvp.exe	95
PID 3608 wrote to memory of 1508	3608	pvp.exe	99
PID 3608 wrote to memory of 1508	3608	pvp.exe	99
PID 3608 wrote to memory of 4248	3608	pvp.exe	100
PID 3608 wrote to memory of 4248	3608	pvp.exe	100
PID 1048 wrote to memory of 4576	1048	axplong.exe	102
PID 1048 wrote to memory of 4576	1048	axplong.exe	102
PID 1048 wrote to memory of 4576	1048	axplong.exe	102
PID 1048 wrote to memory of 4168	1048	axplong.exe	143
PID 1048 wrote to memory of 4168	1048	axplong.exe	143
PID 1048 wrote to memory of 4168	1048	axplong.exe	143
PID 4168 wrote to memory of 1888	4168	golden.exe	158
PID 4168 wrote to memory of 1888	4168	golden.exe	158
PID 4168 wrote to memory of 1888	4168	golden.exe	158
PID 4168 wrote to memory of 1888	4168	golden.exe	158
PID 4168 wrote to memory of 1888	4168	golden.exe	158
PID 4168 wrote to memory of 1888	4168	golden.exe	158
PID 4168 wrote to memory of 1888	4168	golden.exe	158
PID 4168 wrote to memory of 1888	4168	golden.exe	158
PID 4168 wrote to memory of 1888	4168	golden.exe	158
PID 1048 wrote to memory of 1028	1048	axplong.exe	109
PID 1048 wrote to memory of 1028	1048	axplong.exe	109
PID 1048 wrote to memory of 1028	1048	axplong.exe	109
PID 1028 wrote to memory of 2184	1028	Newofff.exe	114
PID 1028 wrote to memory of 2184	1028	Newofff.exe	114
PID 1028 wrote to memory of 2184	1028	Newofff.exe	114
PID 2000 wrote to memory of 3988	2000	processclass.exe	115
PID 2000 wrote to memory of 3988	2000	processclass.exe	115
PID 3988 wrote to memory of 2288	3988	cmd.exe	117
PID 3988 wrote to memory of 2288	3988	cmd.exe	117
PID 3988 wrote to memory of 2288	3988	cmd.exe	117
PID 4576 wrote to memory of 2880	4576	splwow64.exe	118
PID 4576 wrote to memory of 2880	4576	splwow64.exe	118
PID 4576 wrote to memory of 2880	4576	splwow64.exe	118
PID 4576 wrote to memory of 3724	4576	splwow64.exe	119
PID 4576 wrote to memory of 3724	4576	splwow64.exe	119
PID 4576 wrote to memory of 3724	4576	splwow64.exe	119
PID 4576 wrote to memory of 3956	4576	splwow64.exe	148
PID 4576 wrote to memory of 3956	4576	splwow64.exe	148
PID 4576 wrote to memory of 3956	4576	splwow64.exe	148
PID 4576 wrote to memory of 3956	4576	splwow64.exe	148
PID 4576 wrote to memory of 3956	4576	splwow64.exe	148
PID 4576 wrote to memory of 3956	4576	splwow64.exe	148
PID 4576 wrote to memory of 3956	4576	splwow64.exe	148

C:\Users\Admin\AppData\Local\Temp\6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe
"C:\Users\Admin\AppData\Local\Temp\6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3608
    - - C:\Users\Admin\AppData\Roaming\4NEE3IJnl5.exe
        
        "C:\Users\Admin\AppData\Roaming\4NEE3IJnl5.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
    - - C:\Users\Admin\AppData\Roaming\QCL4cOO2zz.exe
        
        "C:\Users\Admin\AppData\Roaming\QCL4cOO2zz.exe"
        5⤵
        Executes dropped EXE
        
        PID:4248
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 264
      4⤵
      Program crash
      PID:4020
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2024
- - C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
    "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start context.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2288
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:4560
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        7⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        8⤵
        Kills process with taskkill
        
        PID:4460
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        8⤵
        Delays execution with timeout.exe
        
        PID:3772
- - C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
    "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:2880
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:3724
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3956
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2892
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4264
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3840
- - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
    "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
      "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1888
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1276
        5⤵
        Program crash
        
        PID:2536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 1256
        5⤵
        Program crash
        
        PID:4480
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 256
      4⤵
      Program crash
      PID:1568
- - C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe
    "C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2984
- - C:\Users\Admin\AppData\Local\Temp\1000489001\bwapp.exe
    "C:\Users\Admin\AppData\Local\Temp\1000489001\bwapp.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:3132
- - C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe
    "C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe"
    3⤵
    PID:1264
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:4992
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 252
      4⤵
      Program crash
      PID:1860
- - C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe"
    3⤵
    PID:4168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      PID:4720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff93e5ccc40,0x7ff93e5ccc4c,0x7ff93e5ccc58
        5⤵
        
        PID:1748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1892 /prefetch:2
        5⤵
        
        PID:1092
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2156 /prefetch:3
        5⤵
        
        PID:4564
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2564 /prefetch:8
        5⤵
        
        PID:2120
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3172,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3192 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3288
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3448
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3176,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4488 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4876
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4804,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4700 /prefetch:8
        5⤵
        
        PID:2160
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4720,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4816 /prefetch:8
        5⤵
        
        PID:3508
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4960,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4968 /prefetch:8
        5⤵
        
        PID:1888
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5116,i,5466877816316478862,17427391840534212789,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5136 /prefetch:8
        5⤵
        
        PID:452
  - - C:\Users\Admin\AppData\Local\Temp\service123.exe
      "C:\Users\Admin\AppData\Local\Temp\service123.exe"
      4⤵
      PID:4312
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5024
- - C:\Users\Admin\AppData\Local\Temp\1000592001\f36b488590.exe
    "C:\Users\Admin\AppData\Local\Temp\1000592001\f36b488590.exe"
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\1000593001\7072114223.exe
    "C:\Users\Admin\AppData\Local\Temp\1000593001\7072114223.exe"
    3⤵
    PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4720 -ip 4720
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4168 -ip 4168
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1888 -ip 1888
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1888 -ip 1888
1⤵
PID:2596

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
- Executes dropped EXE
PID:432

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1264 -ip 1264
1⤵
PID:4168

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1592

C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
1⤵
PID:3364

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\050598569159

Filesize
83KB

MD5
8b067a850b30944816a4dffdc2e98bfd

SHA1
fd8cce01fb77d84e41d4ce7d92d3d1321b03f5fb

SHA256
9d66266aa978d2b5ce00255c6cb212104817565424ddb04f02404764c4fa4c60

SHA512
73cc217a4f07647723b40c3fec366eb00a2d32ed6bf68d09b929c80d57c703e51c6e1666d118c45f657d260aa8be353117266797fdde4a12ccdc0c7f5b8b32f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe

Filesize
1.3MB

MD5
d419a0a5a81da8360c3db8c358e7492e

SHA1
a4fa4a9cd4143b152c52c678dd2433379d5c5b7b

SHA256
c8718abc923b7a8f552445edb5a69ff56c76cd73d4703ec8acfe02a0ce0cb5b2

SHA512
8b02a250070de14eebcdea2688302bf0701005cbb64d89684fb45da1284828bda89241beab60565c1c8d6c4a20c5f5510afda92aa170babb6dc8efba087c023e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe

Filesize
6.3MB

MD5
02cdcc122a549d0a84e2a1342a57afa4

SHA1
660ec77fdddcb3596e600a3e1e904855e29994c1

SHA256
2b1f016f12fef7124ea7c9898622e650e53814f2d5ff4d76fa712c3e591f9a7f

SHA512
0d25c04f17021e191daa73d746e60ffbe1fd2fd725e7376b5a3ec33f4985c820e52d504b214a191cc3efc45bd58512a5ba38b793e05fccb33d31d215fd79ac38

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe

Filesize
6KB

MD5
c042782226565f89ce3954489075e516

SHA1
256dd5ba42837a33c7aa6cb71cef33d5617117ee

SHA256
a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

SHA512
9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe

Filesize
1.1MB

MD5
ed9393d5765529c845c623e35c1b1a34

SHA1
d3eca07f5ce0df847070d2d7fe5253067f624285

SHA256
53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

SHA512
565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe

Filesize
551KB

MD5
3a0f1fe734b215e85f47816085e425c9

SHA1
30a3ddb576c2f0eeb1bfc718b30266123eb1e474

SHA256
ec189d42b19d842d94772287dd02c5b2a2a6a79fce75f2f132111820646b8fba

SHA512
840546dbba54a94452eaf069dbbb53fd00fdf42dff20ce5722226a1a25b7410731dfd7ad01c04ca97b269aabbd46cead03cd82e52ed49ba6ea1f6c5bdba37189

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000489001\bwapp.exe

Filesize
2.3MB

MD5
17ba78456e2957567beab62867246567

SHA1
214fed374f370b9cf63df553345a5e881fd9fc02

SHA256
898db742c0c5503bc396a53b67b8a86da0722d51907c4be2beb364c2d578023a

SHA512
2165ba2aa0a0214f06bc31402bc2ea170d11032efc7ee56070b6abb0feb322b082ffd5dc5b2ad9841295ea85bd25826ba55fb00ed924fdb5ffd0f9f14d671eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe

Filesize
515KB

MD5
a904ae8b26c7d421140be930266ed425

SHA1
c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2

SHA256
9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84

SHA512
2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe

Filesize
12.2MB

MD5
b7f95a6fba7ee898425a69ffd2b6c204

SHA1
d995e2ed97947778c489f6384ba3af0f4343c0bc

SHA256
8b6a0a8d8594fb4f465a8220533a8cbf25fb725220dfc35056c7787b27d89643

SHA512
3b9d35e20161767dabea7bda5ed7db3f63ce738e0934965695dedf1f7487fc092c0e2fe3cf35b9656f521c2ab9e30596cda49d38c7ace360ff2b2b0e52930b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000592001\f36b488590.exe

Filesize
1.8MB

MD5
b85d612d902fe6bcfb29bf23a8fa837b

SHA1
9a0bd596c157a1b3642d4f18fb29317d8e0aa9e9

SHA256
44ba7f65ee397052f69094d90c36bc4ab977fc616dda0106604e7d6ce99e30b3

SHA512
9c9520fc97c7519cd895547507d7fd607086626f28a57063fc6b907abca718edee76e13fa295ba7ce5339eadb48e326b10fea479aa672ef2535cf769ed514814

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000593001\7072114223.exe

Filesize
2.9MB

MD5
0c25e84952637590d40764410c7c2a27

SHA1
87b09fedd7e71b9fc899988dd6a7ea1cb5402063

SHA256
1b0d4831c3c0f5c732dd05edf537aff4d04b0edc89e329cb7016bcb3d631aa0f

SHA512
3f0fae0aa79448d2a745a6c4182cc080df21779df3aca37a657d9ff55708cbbeeba27351a8624cb48e84bdcde23202df5b631344e73d0a6f012845834e432d7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
d4ed860bf819dd9b0f6e3e80107c9c94

SHA1
ebd62fcef67d426ce665bd9e14f87c9b4b61d00e

SHA256
6e68675ba20d0441679d3e63189e4aa6bf4a62b87906a8a222deb10d06ea4ada

SHA512
dd23ad7dfdad5bae4db713dd423c2f9930a5e0fb2aeff6e2e9e8ff112c2bfd7fa6c1e4033bf64dd117a72d3a7398ce118789f24af79bc6b84e1f52b66a982d15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp4D60.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Roaming\4NEE3IJnl5.exe

Filesize
469KB

MD5
3eba6a9c3a91b6cab9e2cba1620bfc3e

SHA1
52d195538a8162143cefd745bf9eee7df1f84e9d

SHA256
664d5913432f1b76c33b37599b46cc5f6324283428dba6b45801de37ee2f8d81

SHA512
eb9224e84993a19cddc9eaf75bf422f43fa61e73ab59be0b1b20110eeea6ee75e06f863ad327c9c2314e164f00e2b8813d6498bd442203fb457e0e9c34724fb9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url

Filesize
70B

MD5
1c5c0d2105718982915d88e1e34b7c24

SHA1
ecb11df5274a3a37c81fc19b95ec316d39bb6f03

SHA256
b5fd05a1a23d90dee32a1f61158a1e0859fde6882b289267c90845bb995b0c09

SHA512
9e1f86ca561c034078acbce22e6b3b2dc938a883f4897167c96ad7c61f28d30075d66557335825c18a00f96467fbd1dee067bb756388ba60b21443ba964ba331

Download Submit
C:\Users\Admin\AppData\Roaming\QCL4cOO2zz.exe

Filesize
315KB

MD5
59c9d5bc2cfca695e10f12c6f5f5be3c

SHA1
64f8568e8beeef61e3c3918b2f6c38c8af42c46e

SHA256
cac6b02d8f2ae8f58e7e02ab86fc82149bf466a5857d92e3457aabfca468cf47

SHA512
220b2013d60713e5041ce6422f68aa7753042e1c9ffe8f6644515590d605b6f1701eaf4ecda1f03357a52d04956933261ba02f7948bb652438598211d72b0874

Download Submit
memory/1048-396-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-20-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-17-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-461-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-483-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-487-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-493-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-299-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-128-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-19-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-18-0x00000000005A1000-0x00000000005CF000-memory.dmp

Filesize
184KB

Download
memory/1048-246-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-376-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-21-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-175-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-229-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-226-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-223-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1048-190-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/1508-224-0x000000001E8E0000-0x000000001E956000-memory.dmp

Filesize
472KB

Download
memory/1508-174-0x000000001DB80000-0x000000001DBBC000-memory.dmp

Filesize
240KB

Download
memory/1508-105-0x0000000000AC0000-0x0000000000B3A000-memory.dmp

Filesize
488KB

Download
memory/1508-225-0x000000001C490000-0x000000001C4AE000-memory.dmp

Filesize
120KB

Download
memory/1508-228-0x000000001FA60000-0x000000001FF88000-memory.dmp

Filesize
5.2MB

Download
memory/1508-227-0x000000001F360000-0x000000001F522000-memory.dmp

Filesize
1.8MB

Download
memory/1508-169-0x000000001DC90000-0x000000001DD9A000-memory.dmp

Filesize
1.0MB

Download
memory/1508-173-0x000000001C6B0000-0x000000001C6C2000-memory.dmp

Filesize
72KB

Download
memory/1888-186-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1888-184-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2000-77-0x00000000009E0000-0x00000000009E8000-memory.dmp

Filesize
32KB

Download
memory/2024-286-0x0000000000550000-0x00000000007B1000-memory.dmp

Filesize
2.4MB

Download
memory/2024-58-0x0000000000550000-0x00000000007B1000-memory.dmp

Filesize
2.4MB

Download
memory/2024-131-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2692-290-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/2692-289-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/2984-349-0x0000000069CC0000-0x000000006A71B000-memory.dmp

Filesize
10.4MB

Download
memory/2984-368-0x0000000000B70000-0x00000000011CC000-memory.dmp

Filesize
6.4MB

Download
memory/2984-379-0x0000000000B70000-0x00000000011CC000-memory.dmp

Filesize
6.4MB

Download
memory/3236-15-0x0000000000370000-0x0000000000822000-memory.dmp

Filesize
4.7MB

Download
memory/3236-0-0x0000000000370000-0x0000000000822000-memory.dmp

Filesize
4.7MB

Download
memory/3236-4-0x0000000000370000-0x0000000000822000-memory.dmp

Filesize
4.7MB

Download
memory/3236-3-0x0000000000370000-0x0000000000822000-memory.dmp

Filesize
4.7MB

Download
memory/3236-2-0x0000000000371000-0x000000000039F000-memory.dmp

Filesize
184KB

Download
memory/3236-1-0x00000000778F4000-0x00000000778F6000-memory.dmp

Filesize
8KB

Download
memory/3608-78-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3608-81-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3608-80-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3608-103-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/3956-238-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3956-474-0x0000000000560000-0x0000000000879000-memory.dmp

Filesize
3.1MB

Download
memory/3956-433-0x0000000000560000-0x0000000000879000-memory.dmp

Filesize
3.1MB

Download
memory/3956-237-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3956-236-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3956-244-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4004-492-0x00000000005A0000-0x0000000000A52000-memory.dmp

Filesize
4.7MB

Download
memory/4168-484-0x0000000000260000-0x0000000000E9D000-memory.dmp

Filesize
12.2MB

Download
memory/4168-462-0x0000000000260000-0x0000000000E9D000-memory.dmp

Filesize
12.2MB

Download
memory/4576-125-0x00000000053E0000-0x0000000005984000-memory.dmp

Filesize
5.6MB

Download
memory/4576-127-0x0000000004E70000-0x0000000004E7A000-memory.dmp

Filesize
40KB

Download
memory/4576-124-0x0000000000260000-0x0000000000378000-memory.dmp

Filesize
1.1MB

Download
memory/4576-126-0x0000000004D50000-0x0000000004DE2000-memory.dmp

Filesize
584KB

Download
memory/4576-129-0x000000000AF20000-0x000000000AFA4000-memory.dmp

Filesize
528KB

Download
memory/4720-82-0x0000000000B85000-0x0000000000B86000-memory.dmp

Filesize
4KB

Download
memory/4896-415-0x0000000000310000-0x00000000009AB000-memory.dmp

Filesize
6.6MB

Download
memory/4896-414-0x0000000000310000-0x00000000009AB000-memory.dmp

Filesize
6.6MB

Download
memory/4992-322-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4992-344-0x0000000008BB0000-0x0000000008CBA000-memory.dmp

Filesize
1.0MB

Download
memory/4992-374-0x0000000009940000-0x0000000009B02000-memory.dmp

Filesize
1.8MB

Download
memory/4992-370-0x0000000006D80000-0x0000000006DE6000-memory.dmp

Filesize
408KB

Download
memory/4992-343-0x0000000007330000-0x0000000007948000-memory.dmp

Filesize
6.1MB

Download
memory/4992-339-0x0000000006350000-0x00000000063C6000-memory.dmp

Filesize
472KB

Download
memory/4992-375-0x000000000A040000-0x000000000A56C000-memory.dmp

Filesize
5.2MB

Download
memory/4992-346-0x0000000007280000-0x00000000072BC000-memory.dmp

Filesize
240KB

Download
memory/4992-340-0x00000000069A0000-0x00000000069BE000-memory.dmp

Filesize
120KB

Download
memory/4992-347-0x00000000072C0000-0x000000000730C000-memory.dmp

Filesize
304KB

Download
memory/4992-371-0x0000000008D20000-0x0000000008D70000-memory.dmp

Filesize
320KB

Download
memory/4992-345-0x0000000007220000-0x0000000007232000-memory.dmp

Filesize
72KB

Download
memory/5024-358-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5024-359-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5024-366-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download