amadey | 05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6

Analysis

max time kernel
291s
max time network
291s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-10-2024 01:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
Size

1.8MB
MD5

4d8c8e00df7b423ef785ec97502caf68
SHA1

3df9f68f934cbfefd2e49963fa7515690333be2f
SHA256

05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6
SHA512

43ede6dce79807602efd51edde5ed2706781409d47cec9f60e96f58434c81babb9be8d6ec2d739ff66d0dc53dd4c6634b66656afeaf325bfe622f14ea50932c5
SSDEEP

24576:CFbiGWMLycQXT4chb4lfVDTbRHxcLuHbGFMRG1Al2tkD+08am7jcPhI6EMLTM9jq:C+lj9ybHcy7IMc1cmamPuhI8TMOp

Score

10^/10

amadey lumma redline stealc default_valenciga doma fed3aa tg cloud @rlreborn admin @fatherofcarders credential_access discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

lumma

https://snailyeductyi.sbs

https://ferrycheatyk.sbs

https://deepymouthi.sbs

https://wrigglesight.sbs

https://captaitwik.sbs

https://sidercotay.sbs

https://heroicmint.sbs

https://monstourtu.sbs

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29155

Extracted

Family

stealc

Botnet

doma

http://185.215.113.37

Attributes

url_path
/e2b1563c6670f193.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 5 IoCs

resource	yara_rule
behavioral1/memory/1036-311-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1036-310-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1036-309-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1036-306-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1036-304-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	798c99797c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	567a4d46af.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2820	chrome.exe
2656	chrome.exe
3032	chrome.exe
2784	chrome.exe
1784	chrome.exe
2724	chrome.exe
2116	chrome.exe
1880	chrome.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	798c99797c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	798c99797c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	567a4d46af.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	567a4d46af.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	splwow64.exe

Executes dropped EXE 23 IoCs

pid	Process
2780	axplong.exe
2992	zxcv.exe
1788	stealc_default2.exe
376	zxcv.exe
2384	vTLCaaa5Dn.exe
2224	dNqlEwZtAD.exe
316	processclass.exe
2948	splwow64.exe
1972	golden.exe
812	golden.exe
2860	Newofff.exe
1216	Hkbsse.exe
308	bwapp.exe
2476	myrdx.exe
1920	JavUmar1.exe
2516	context.exe
2636	Set-up-1.exe
1332	798c99797c.exe
2144	567a4d46af.exe
2228	service123.exe
2716	service123.exe
1360	service123.exe
936	service123.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	798c99797c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Wine	567a4d46af.exe

Loads dropped DLL 48 IoCs

pid	Process
2332	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
2780	axplong.exe
2780	axplong.exe
2780	axplong.exe
2992	zxcv.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
1856	WerFault.exe
376	zxcv.exe
376	zxcv.exe
1856	WerFault.exe
2780	axplong.exe
2780	axplong.exe
2780	axplong.exe
1972	golden.exe
3068	WerFault.exe
3068	WerFault.exe
3068	WerFault.exe
2780	axplong.exe
2860	Newofff.exe
1788	stealc_default2.exe
1788	stealc_default2.exe
2780	axplong.exe
2780	axplong.exe
2780	axplong.exe
2900	WerFault.exe
2900	WerFault.exe
2900	WerFault.exe
1216	Hkbsse.exe
1216	Hkbsse.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
1652	WerFault.exe
2780	axplong.exe
2780	axplong.exe
2780	axplong.exe
2780	axplong.exe
2780	axplong.exe
2780	axplong.exe
2636	Set-up-1.exe
2636	Set-up-1.exe
2228	service123.exe
2716	service123.exe
1360	service123.exe
936	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\798c99797c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000622001\\798c99797c.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\567a4d46af.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000623001\\567a4d46af.exe"	axplong.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2332	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
2780	axplong.exe
1332	798c99797c.exe
2144	567a4d46af.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 376	2992	zxcv.exe	34
PID 1972 set thread context of 812	1972	golden.exe	41
PID 2476 set thread context of 1036	2476	myrdx.exe	49
PID 2948 set thread context of 1360	2948	splwow64.exe	57

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
File created	C:\Windows\Tasks\Hkbsse.job	Newofff.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00050000000195c7-334.dat	embeds_openssl
behavioral1/files/0x00050000000196a0-402.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1856	2992	WerFault.exe	31
3068	1972	WerFault.exe	40
2900	2476	WerFault.exe	48
1652	2516	WerFault.exe	55

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	myrdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Set-up-1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	798c99797c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JavUmar1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Newofff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	567a4d46af.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxcv.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Set-up-1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Set-up-1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JavUmar1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JavUmar1.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1212	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
840	taskkill.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	golden.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	golden.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	golden.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	golden.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	567a4d46af.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	567a4d46af.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1780	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2516	context.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
2332	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
2780	axplong.exe
1788	stealc_default2.exe
2384	vTLCaaa5Dn.exe
2224	dNqlEwZtAD.exe
1788	stealc_default2.exe
2948	splwow64.exe
2948	splwow64.exe
1036	MSBuild.exe
1036	MSBuild.exe
1036	MSBuild.exe
2516	context.exe
2516	context.exe
1332	798c99797c.exe
2144	567a4d46af.exe
2116	chrome.exe
2116	chrome.exe
3032	chrome.exe
3032	chrome.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeBackupPrivilege	2384	vTLCaaa5Dn.exe
Token: SeBackupPrivilege	2224	dNqlEwZtAD.exe
Token: SeSecurityPrivilege	2384	vTLCaaa5Dn.exe
Token: SeSecurityPrivilege	2224	dNqlEwZtAD.exe
Token: SeSecurityPrivilege	2224	dNqlEwZtAD.exe
Token: SeSecurityPrivilege	2224	dNqlEwZtAD.exe
Token: SeSecurityPrivilege	2224	dNqlEwZtAD.exe
Token: SeSecurityPrivilege	2384	vTLCaaa5Dn.exe
Token: SeSecurityPrivilege	2384	vTLCaaa5Dn.exe
Token: SeSecurityPrivilege	2384	vTLCaaa5Dn.exe
Token: SeDebugPrivilege	2224	dNqlEwZtAD.exe
Token: SeDebugPrivilege	2384	vTLCaaa5Dn.exe
Token: SeDebugPrivilege	316	processclass.exe
Token: SeDebugPrivilege	2948	splwow64.exe
Token: SeDebugPrivilege	840	taskkill.exe
Token: SeDebugPrivilege	1036	MSBuild.exe
Token: SeDebugPrivilege	2516	context.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe
Token: SeShutdownPrivilege	3032	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2332	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
2860	Newofff.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe
3032	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2780	2332	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe	30
PID 2332 wrote to memory of 2780	2332	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe	30
PID 2332 wrote to memory of 2780	2332	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe	30
PID 2332 wrote to memory of 2780	2332	05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe	30
PID 2780 wrote to memory of 2992	2780	axplong.exe	31
PID 2780 wrote to memory of 2992	2780	axplong.exe	31
PID 2780 wrote to memory of 2992	2780	axplong.exe	31
PID 2780 wrote to memory of 2992	2780	axplong.exe	31
PID 2780 wrote to memory of 1788	2780	axplong.exe	33
PID 2780 wrote to memory of 1788	2780	axplong.exe	33
PID 2780 wrote to memory of 1788	2780	axplong.exe	33
PID 2780 wrote to memory of 1788	2780	axplong.exe	33
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 376	2992	zxcv.exe	34
PID 2992 wrote to memory of 1856	2992	zxcv.exe	35
PID 2992 wrote to memory of 1856	2992	zxcv.exe	35
PID 2992 wrote to memory of 1856	2992	zxcv.exe	35
PID 2992 wrote to memory of 1856	2992	zxcv.exe	35
PID 376 wrote to memory of 2384	376	zxcv.exe	36
PID 376 wrote to memory of 2384	376	zxcv.exe	36
PID 376 wrote to memory of 2384	376	zxcv.exe	36
PID 376 wrote to memory of 2384	376	zxcv.exe	36
PID 376 wrote to memory of 2224	376	zxcv.exe	37
PID 376 wrote to memory of 2224	376	zxcv.exe	37
PID 376 wrote to memory of 2224	376	zxcv.exe	37
PID 376 wrote to memory of 2224	376	zxcv.exe	37
PID 2780 wrote to memory of 316	2780	axplong.exe	38
PID 2780 wrote to memory of 316	2780	axplong.exe	38
PID 2780 wrote to memory of 316	2780	axplong.exe	38
PID 2780 wrote to memory of 316	2780	axplong.exe	38
PID 2780 wrote to memory of 2948	2780	axplong.exe	39
PID 2780 wrote to memory of 2948	2780	axplong.exe	39
PID 2780 wrote to memory of 2948	2780	axplong.exe	39
PID 2780 wrote to memory of 2948	2780	axplong.exe	39
PID 2780 wrote to memory of 1972	2780	axplong.exe	40
PID 2780 wrote to memory of 1972	2780	axplong.exe	40
PID 2780 wrote to memory of 1972	2780	axplong.exe	40
PID 2780 wrote to memory of 1972	2780	axplong.exe	40
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 812	1972	golden.exe	41
PID 1972 wrote to memory of 3068	1972	golden.exe	42
PID 1972 wrote to memory of 3068	1972	golden.exe	42
PID 1972 wrote to memory of 3068	1972	golden.exe	42
PID 1972 wrote to memory of 3068	1972	golden.exe	42
PID 2780 wrote to memory of 2860	2780	axplong.exe	44
PID 2780 wrote to memory of 2860	2780	axplong.exe	44
PID 2780 wrote to memory of 2860	2780	axplong.exe	44

C:\Users\Admin\AppData\Local\Temp\05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe
"C:\Users\Admin\AppData\Local\Temp\05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:376
    - - C:\Users\Admin\AppData\Roaming\vTLCaaa5Dn.exe
        
        "C:\Users\Admin\AppData\Roaming\vTLCaaa5Dn.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
    - - C:\Users\Admin\AppData\Roaming\dNqlEwZtAD.exe
        
        "C:\Users\Admin\AppData\Roaming\dNqlEwZtAD.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 96
      4⤵
      Loads dropped DLL
      Program crash
      PID:1856
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1788
- - C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
    "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:316
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start context.exe
      4⤵
      PID:2864
    - - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2516
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 728
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1652
- - C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
    "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:1060
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1360
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1212
- - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
    "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
      "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:812
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 52
      4⤵
      Loads dropped DLL
      Program crash
      PID:3068
- - C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe
    "C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1216
    - - C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:1920
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3032
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67c9758,0x7fef67c9768,0x7fef67c9778
        7⤵
        
        PID:2536
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1232,i,6355980517071725712,11438774508347115298,131072 /prefetch:2
        7⤵
        
        PID:944
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1232,i,6355980517071725712,11438774508347115298,131072 /prefetch:8
        7⤵
        
        PID:2284
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1232,i,6355980517071725712,11438774508347115298,131072 /prefetch:8
        7⤵
        
        PID:1840
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1232,i,6355980517071725712,11438774508347115298,131072 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:2784
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2268 --field-trial-handle=1232,i,6355980517071725712,11438774508347115298,131072 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:1784
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1464 --field-trial-handle=1232,i,6355980517071725712,11438774508347115298,131072 /prefetch:2
        7⤵
        
        PID:2036
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3328 --field-trial-handle=1232,i,6355980517071725712,11438774508347115298,131072 /prefetch:8
        7⤵
        
        PID:2244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1388 --field-trial-handle=1232,i,6355980517071725712,11438774508347115298,131072 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:2724
- - C:\Users\Admin\AppData\Local\Temp\1000489001\bwapp.exe
    "C:\Users\Admin\AppData\Local\Temp\1000489001\bwapp.exe"
    3⤵
    - Executes dropped EXE
    PID:308
- - C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe
    "C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:2476
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 52
      4⤵
      Loads dropped DLL
      Program crash
      PID:2900
- - C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:2636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2116
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67c9758,0x7fef67c9768,0x7fef67c9778
        5⤵
        
        PID:2696
    - - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        5⤵
        
        PID:2092
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:2
        5⤵
        
        PID:2244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:8
        5⤵
        
        PID:2464
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:8
        5⤵
        
        PID:1308
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2144 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2152 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1368 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:2
        5⤵
        
        PID:2136
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2244 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2656
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3476 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:8
        5⤵
        
        PID:1928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3592 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:8
        5⤵
        
        PID:2540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3708 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:8
        5⤵
        
        PID:1832
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3828 --field-trial-handle=1352,i,2905953733654608437,2965091349725558233,131072 /prefetch:8
        5⤵
        
        PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\service123.exe
      "C:\Users\Admin\AppData\Local\Temp\service123.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2228
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1780
- - C:\Users\Admin\AppData\Local\Temp\1000622001\798c99797c.exe
    "C:\Users\Admin\AppData\Local\Temp\1000622001\798c99797c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1332
- - C:\Users\Admin\AppData\Local\Temp\1000623001\567a4d46af.exe
    "C:\Users\Admin\AppData\Local\Temp\1000623001\567a4d46af.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:2144

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2508

C:\Windows\system32\taskeng.exe
taskeng.exe {13F6A7E4-22D6-4128-BDE3-4343D82BA124} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]
1⤵
PID:1984
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1360
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:936

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff412f60f97237a913c919b64d19d65c

SHA1
63499907a7ab4648f02d50e25068b887d5f999d9

SHA256
ce9435d5eb9e0771d531334d11ea206c7da039c13c8adefbab3cd244aea33fee

SHA512
53147f4ecb3b9b8b41f7619564d2ab09b8a48811e52b7828b731a4246c50265712d697a8e666be6d3b021544dab99c9c02863658169d313857d269a4d5ccbaa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
6440e5b4ea3156744e4a29d42c8a2bd7

SHA1
da7b625fdca100cadf355ded3e112a57f8d25866

SHA256
c06f6986514f9e2a2853949c3809aa06a2d39594470ed4ffc77b5a9552565fb7

SHA512
960de88d405bccc917ad98c1cc04b9a3cb2daddd7a53ab5934e27e3bb2b1638dfa81688239db0910b53af711521a998a788ffabcdcaecf36caa0df2a31582d7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000009.dbtmp

Filesize
16B

MD5
979c29c2917bed63ccf520ece1d18cda

SHA1
65cd81cdce0be04c74222b54d0881d3fdfe4736c

SHA256
b3524365a633ee6d1fa9953638d2867946c515218c497a5ec2dbef7dc44a7c53

SHA512
e38f694fd6ab9f678ae156528230d7a8bfb7b59a13b227f59f9c38ab5617db11ebb6be1276323a905d09c4066a3fe820cf58077ab48bf201f3c467a98516ee7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000010.dbtmp

Filesize
16B

MD5
60e3f691077715586b918375dd23c6b0

SHA1
476d3eab15649c40c6aebfb6ac2366db50283d1b

SHA256
e91d13722e31f9b06c5df3582cad1ea5b73547ce3dc08b12ed461f095aad48ee

SHA512
d1c146d27bbf19362d6571e2865bb472ce4fe43dc535305615d92d6a2366f98533747a8a70a578d1f00199f716a61ce39fac5cab9dd67e9c044bc49e7343130e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe

Filesize
1.1MB

MD5
a5cf5de46ec3f0a677e94188b19e7862

SHA1
d07e3fd100c423662dbb3ed85713ff7b87c52e60

SHA256
450ac7367b33ac0d26ee08c5371ba668d9d3331a8c119520eb5ca4a46f91973c

SHA512
1d2d91625f971f71670a36340092ab9ac0a35a4ac791a46ee8b055894cdf3b7fc7030e4d27f973d738b85295c31a4bfbe5c033b07a5f7ebf10508d75043c1ab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe

Filesize
6.3MB

MD5
02cdcc122a549d0a84e2a1342a57afa4

SHA1
660ec77fdddcb3596e600a3e1e904855e29994c1

SHA256
2b1f016f12fef7124ea7c9898622e650e53814f2d5ff4d76fa712c3e591f9a7f

SHA512
0d25c04f17021e191daa73d746e60ffbe1fd2fd725e7376b5a3ec33f4985c820e52d504b214a191cc3efc45bd58512a5ba38b793e05fccb33d31d215fd79ac38

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe

Filesize
6KB

MD5
c042782226565f89ce3954489075e516

SHA1
256dd5ba42837a33c7aa6cb71cef33d5617117ee

SHA256
a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

SHA512
9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe

Filesize
1.1MB

MD5
ed9393d5765529c845c623e35c1b1a34

SHA1
d3eca07f5ce0df847070d2d7fe5253067f624285

SHA256
53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

SHA512
565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe

Filesize
551KB

MD5
3a0f1fe734b215e85f47816085e425c9

SHA1
30a3ddb576c2f0eeb1bfc718b30266123eb1e474

SHA256
ec189d42b19d842d94772287dd02c5b2a2a6a79fce75f2f132111820646b8fba

SHA512
840546dbba54a94452eaf069dbbb53fd00fdf42dff20ce5722226a1a25b7410731dfd7ad01c04ca97b269aabbd46cead03cd82e52ed49ba6ea1f6c5bdba37189

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000489001\bwapp.exe

Filesize
2.3MB

MD5
17ba78456e2957567beab62867246567

SHA1
214fed374f370b9cf63df553345a5e881fd9fc02

SHA256
898db742c0c5503bc396a53b67b8a86da0722d51907c4be2beb364c2d578023a

SHA512
2165ba2aa0a0214f06bc31402bc2ea170d11032efc7ee56070b6abb0feb322b082ffd5dc5b2ad9841295ea85bd25826ba55fb00ed924fdb5ffd0f9f14d671eba

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe

Filesize
515KB

MD5
a904ae8b26c7d421140be930266ed425

SHA1
c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2

SHA256
9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84

SHA512
2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe

Filesize
12.2MB

MD5
b7f95a6fba7ee898425a69ffd2b6c204

SHA1
d995e2ed97947778c489f6384ba3af0f4343c0bc

SHA256
8b6a0a8d8594fb4f465a8220533a8cbf25fb725220dfc35056c7787b27d89643

SHA512
3b9d35e20161767dabea7bda5ed7db3f63ce738e0934965695dedf1f7487fc092c0e2fe3cf35b9656f521c2ab9e30596cda49d38c7ace360ff2b2b0e52930b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000622001\798c99797c.exe

Filesize
1.8MB

MD5
3ad9490635936dc87e6d1a2f053b4722

SHA1
c020da3fc107e74186e9906973973cd0526052c8

SHA256
a49e5adf2ed3424954c3619704796353ca6c36203dda8c3a3da4f606378af0e9

SHA512
0ca00b5512c44baa1835e2c1dd49152ff7d9dd3ae9fbeaf20ecb27f243c3dbda753f87cadd946517446816318a2d79e00bd4efa22cdad33661adefdbb8d34829

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000623001\567a4d46af.exe

Filesize
2.8MB

MD5
c32f4fcbdd788c04c97460adee6e9cd4

SHA1
231ac816a488a65db5ee5677aafff01e1ddd24ee

SHA256
9ba968e74429e18117d73b6f96cb382f7f16c9f5a7fd67e0e77bc764731fe5e9

SHA512
58bcc13d0e3702a5bcb29a25860a442b5002d583393ba60bd52ff83b7d7f630a73915118f8ec650fd9dea6fa9ca1c10a2eae86833cd2bdac00d525e1ded26c7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6F95.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7072.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp93D8.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Roaming\dNqlEwZtAD.exe

Filesize
340KB

MD5
131d164783db3608e4b2e97428e17028

SHA1
c00064a0f4952f5a37093cd7631f5921f9c00387

SHA256
05053f2a6db0f5352295ce4ca7146618ddb175f1ff4cdcd93a055a039c098e5f

SHA512
020b22527d0e555509897ce2df876bf2a30e3fc976cd86e52335104cf0f9db152caa8b46650a8bd0022b3cbaf3d20e0201322e3617e00eb0f25c6fcba245c505

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
4d8c8e00df7b423ef785ec97502caf68

SHA1
3df9f68f934cbfefd2e49963fa7515690333be2f

SHA256
05a2e2c00ff245ab19d562ac05d5ce2076dd28c07bd16bf4753e2b28e3a011e6

SHA512
43ede6dce79807602efd51edde5ed2706781409d47cec9f60e96f58434c81babb9be8d6ec2d739ff66d0dc53dd4c6634b66656afeaf325bfe622f14ea50932c5

Download Submit
\Users\Admin\AppData\Roaming\vTLCaaa5Dn.exe

Filesize
331KB

MD5
fd381b2627904d8365229d1ddd7e221f

SHA1
d7bcbabb6cd84875cc76f8170833ac679cd7d915

SHA256
ed5ac0c0d07595eb99ccc7346faab8504eb03000da1012abc1009c0cfbd4d4b9

SHA512
2b1e15b539d55b92f31c61cff954dafa61a44f7ccf75d113ab57ad54e9a8cbde304a285d0583663a206f648fd4f3b63257dbedf3df608d0391353ffb4aa78daf

Download Submit
memory/316-108-0x0000000000D10000-0x0000000000D18000-memory.dmp

Filesize
32KB

Download
memory/376-75-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/376-59-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/376-61-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/376-91-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/376-63-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/376-65-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/376-67-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/376-69-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/376-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/376-72-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/376-76-0x0000000000400000-0x00000000004E0000-memory.dmp

Filesize
896KB

Download
memory/812-210-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/812-208-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/812-356-0x0000000076EC0000-0x0000000076FBA000-memory.dmp

Filesize
1000KB

Download
memory/812-355-0x0000000076DA0000-0x0000000076EBF000-memory.dmp

Filesize
1.1MB

Download
memory/812-202-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/812-205-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/812-207-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/812-212-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/812-213-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1036-304-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1036-306-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1036-310-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1036-311-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1036-308-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1036-309-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1036-300-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1036-302-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1332-430-0x00000000002E0000-0x0000000000984000-memory.dmp

Filesize
6.6MB

Download
memory/1332-428-0x00000000002E0000-0x0000000000984000-memory.dmp

Filesize
6.6MB

Download
memory/1360-359-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1360-361-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1360-357-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1788-286-0x0000000000F30000-0x0000000001191000-memory.dmp

Filesize
2.4MB

Download
memory/1788-129-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1788-56-0x0000000000F30000-0x0000000001191000-memory.dmp

Filesize
2.4MB

Download
memory/2144-448-0x0000000001220000-0x0000000001531000-memory.dmp

Filesize
3.1MB

Download
memory/2144-516-0x0000000001220000-0x0000000001531000-memory.dmp

Filesize
3.1MB

Download
memory/2224-110-0x00000000010E0000-0x000000000113A000-memory.dmp

Filesize
360KB

Download
memory/2332-16-0x0000000000B10000-0x0000000000FC5000-memory.dmp

Filesize
4.7MB

Download
memory/2332-5-0x0000000000B10000-0x0000000000FC5000-memory.dmp

Filesize
4.7MB

Download
memory/2332-3-0x0000000000B10000-0x0000000000FC5000-memory.dmp

Filesize
4.7MB

Download
memory/2332-0-0x0000000000B10000-0x0000000000FC5000-memory.dmp

Filesize
4.7MB

Download
memory/2332-13-0x00000000072B0000-0x0000000007765000-memory.dmp

Filesize
4.7MB

Download
memory/2332-1-0x00000000771B0000-0x00000000771B2000-memory.dmp

Filesize
8KB

Download
memory/2332-2-0x0000000000B11000-0x0000000000B3F000-memory.dmp

Filesize
184KB

Download
memory/2384-109-0x0000000001210000-0x0000000001268000-memory.dmp

Filesize
352KB

Download
memory/2516-350-0x0000000000070000-0x0000000000188000-memory.dmp

Filesize
1.1MB

Download
memory/2516-351-0x0000000009F30000-0x0000000009FB4000-memory.dmp

Filesize
528KB

Download
memory/2780-54-0x0000000006C80000-0x0000000006EE1000-memory.dmp

Filesize
2.4MB

Download
memory/2780-447-0x0000000006480000-0x0000000006791000-memory.dmp

Filesize
3.1MB

Download
memory/2780-17-0x0000000000F40000-0x00000000013F5000-memory.dmp

Filesize
4.7MB

Download
memory/2780-18-0x0000000000F41000-0x0000000000F6F000-memory.dmp

Filesize
184KB

Download
memory/2780-19-0x0000000000F40000-0x00000000013F5000-memory.dmp

Filesize
4.7MB

Download
memory/2780-426-0x0000000006C80000-0x0000000007324000-memory.dmp

Filesize
6.6MB

Download
memory/2780-427-0x0000000006C80000-0x0000000007324000-memory.dmp

Filesize
6.6MB

Download
memory/2780-20-0x0000000000F40000-0x00000000013F5000-memory.dmp

Filesize
4.7MB

Download
memory/2780-22-0x0000000000F40000-0x00000000013F5000-memory.dmp

Filesize
4.7MB

Download
memory/2780-55-0x0000000006C80000-0x0000000006EE1000-memory.dmp

Filesize
2.4MB

Download
memory/2780-248-0x0000000000F40000-0x00000000013F5000-memory.dmp

Filesize
4.7MB

Download
memory/2780-346-0x0000000000F40000-0x00000000013F5000-memory.dmp

Filesize
4.7MB

Download
memory/2780-446-0x0000000006480000-0x0000000006791000-memory.dmp

Filesize
3.1MB

Download
memory/2780-128-0x0000000000F40000-0x00000000013F5000-memory.dmp

Filesize
4.7MB

Download
memory/2780-111-0x0000000000F40000-0x00000000013F5000-memory.dmp

Filesize
4.7MB

Download
memory/2780-495-0x0000000006C80000-0x0000000007324000-memory.dmp

Filesize
6.6MB

Download
memory/2780-512-0x0000000006C80000-0x0000000007324000-memory.dmp

Filesize
6.6MB

Download
memory/2780-199-0x0000000000F40000-0x00000000013F5000-memory.dmp

Filesize
4.7MB

Download
memory/2780-517-0x0000000006480000-0x0000000006791000-memory.dmp

Filesize
3.1MB

Download
memory/2780-518-0x0000000006480000-0x0000000006791000-memory.dmp

Filesize
3.1MB

Download
memory/2780-533-0x0000000006C80000-0x0000000006EE1000-memory.dmp

Filesize
2.4MB

Download
memory/2948-126-0x0000000000260000-0x0000000000378000-memory.dmp

Filesize
1.1MB

Download
memory/2948-127-0x0000000009F80000-0x000000000A004000-memory.dmp

Filesize
528KB

Download
memory/2992-74-0x000000000138B000-0x000000000138D000-memory.dmp

Filesize
8KB

Download