amadey | eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-12-2024 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
Size

3.1MB
MD5

3b7f8ea6d98d68edd65a49c922671468
SHA1

e5d999ecc81a188bfa758af9980ecf55038527b3
SHA256

eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f
SHA512

b1c681a7d50033487b93c5566c77cac6d53650032f9e741e8bbe45d781c6ce2388c211895447d51c7d1f274a4a5863a959980ba24358f634cf2b5e41285f5109
SSDEEP

49152:B4z6DN0EtR+4tYqLs4eaBq9PTX0kpQW3XyuVL:uzQ0EtRjtYqLDeaBc4bYy0

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

fvcxcx

185.81.68.147:1912

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

82.64.156.123:80

Mutex

9mzImB3NUR0Q

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

107.189.17.186:7000

Mutex

1DV67HmcQRTX3PrL

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

redline

Botnet

LiseCloud -- LiveTraffic

107.189.17.186:28269

Extracted

Family

lumma

https://tacitglibbr.biz/api

https://immureprech.biz/api

https://deafeninggeh.biz/api

https://drive-connect.cyou/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00050000000228fe-25826.dat	family_xworm
behavioral2/memory/27320-25840-0x0000000000F80000-0x0000000000F90000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0002000000022188-24147.dat	family_redline
behavioral2/memory/26716-24152-0x0000000000680000-0x00000000006D2000-memory.dmp	family_redline
behavioral2/files/0x0006000000022eb0-25835.dat	family_redline
behavioral2/memory/26844-25842-0x0000000000FA0000-0x0000000000FBE000-memory.dmp	family_redline

Redline family
redline
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
trojan rat sectoprat

SectopRAT payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000022eb0-25835.dat	family_sectoprat
behavioral2/memory/26844-25842-0x0000000000FA0000-0x0000000000FBE000-memory.dmp	family_sectoprat

Sectoprat family
sectoprat

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 5380 created 3524	5380	mail.exe	56
PID 14184 created 3524	14184	Gxtuum.exe	56
PID 29052 created 3524	29052	bluemail.exe	56

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0007000000024590-24182.dat	family_asyncrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Renames multiple (8929) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Blocklisted process makes network request 12 IoCs

flow	pid	Process
655	17204	rundll32.exe
656	17204	rundll32.exe
688	27332	rundll32.exe
689	27332	rundll32.exe
691	21348	rundll32.exe
698	21348	rundll32.exe
718	25596	rundll32.exe
719	25596	rundll32.exe
721	7276	rundll32.exe
722	7276	rundll32.exe
727	13556	rundll32.exe
728	13556	rundll32.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
20416	powershell.exe
17648	powershell.exe
2420	powershell.exe
21172	powershell.exe
20132	powershell.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 6 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
4344	chrome.exe
4332	msedge.exe
2952	chrome.exe
3264	chrome.exe
2900	chrome.exe
3764	msedge.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Gxtuum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	6167a929b0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Bxq1jd2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	mail.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	74DE.tmp.ctx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Gxtuum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	XAzdvQx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	e22e4cd6f3.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hputil.vbs	mail.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe	services.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\services.exe	services.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vmwin.vbs	bluemail.exe

Executes dropped EXE 43 IoCs

pid	Process
3516	skotes.exe
4308	LoaderClient.exe
4664	LoaderClient.exe
4416	4ZD5C3i.exe
5380	mail.exe
2648	Bxq1jd2.exe
13352	skotes.exe
16496	EkmIhQM.exe
4380	K6UAlAU.exe
1672	mail.exe
14184	Gxtuum.exe
26716	6BC5.tmp.fcxcx.exe
17852	74DE.tmp.ctx.exe
18832	Gxtuum.exe
25584	782B.tmp.AsyncClient.exe
26628	9DB5.tmp.Build.exe
25804	update.exe
17124	EkmIhQM.exe
15396	ABFE.tmp.cc.exe
14128	9DB5.tmp.Build.exe
5868	Gxtuum.exe
9896	6167a929b0.exe
28752	7z.exe
28904	7z.exe
29000	7z.exe
29060	7z.exe
29124	7z.exe
29176	7z.exe
29272	7z.exe
29380	7z.exe
29548	in.exe
25060	a27043e351.exe
26816	a27043e351.exe
29052	bluemail.exe
28956	e22e4cd6f3.exe
10940	XAzdvQx.exe
27320	services.exe
26844	windows.exe
7268	226f930c10.exe
20672	skotes.exe
22456	Intel_PTT_EK_Recertification.exe
22404	Gxtuum.exe
11092	bluemail.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe

Loads dropped DLL 61 IoCs

pid	Process
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
17340	rundll32.exe
17204	rundll32.exe
28752	7z.exe
28904	7z.exe
29000	7z.exe
29060	7z.exe
29124	7z.exe
29176	7z.exe
29272	7z.exe
29380	7z.exe
27212	rundll32.exe
27332	rundll32.exe
21348	rundll32.exe
25596	rundll32.exe
7276	rundll32.exe
13556	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Powershell = "\"powershell.exe\" -WindowStyle Hidden -ExecutionPolicy Bypass -File \"C:\\Users\\Admin\\AppData\\Roaming\\dKMakUzjBPHlNuS.ps1\""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\2520BD776873661179348\\2520BD776873661179348.exe"	K6UAlAU.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\2520BD776873661179348\\2520BD776873661179348.exe"	audiodg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\2520BD776873661179348\\2520BD776873661179348.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\2520BD776873661179348\\2520BD776873661179348.exe"	update.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-21-493223053-2004649691-1575712786-1000\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	explorer.exe
File opened (read-only)	\??\F:	4ZD5C3i.exe
File opened (read-only)	\??\Z:	4ZD5C3i.exe
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Looks up external IP address via web service 9 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
349	api.ipify.org
350	api.ipify.org
374	api.ipify.org
641	api.ipify.org
637	api.ipify.org
671	checkip.dyndns.org
679	api.ipify.org
682	api.ipify.org
707	api.ipify.org

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
7416	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4660	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
3516	skotes.exe
4664	LoaderClient.exe
13352	skotes.exe
20672	skotes.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 4380 set thread context of 27948	4380	K6UAlAU.exe	184
PID 4380 set thread context of 27896	4380	K6UAlAU.exe	185
PID 4380 set thread context of 27952	4380	K6UAlAU.exe	186
PID 5380 set thread context of 1672	5380	mail.exe	188
PID 25804 set thread context of 17672	25804	update.exe	220
PID 25804 set thread context of 19592	25804	update.exe	221
PID 25804 set thread context of 19500	25804	update.exe	222
PID 16496 set thread context of 17124	16496	EkmIhQM.exe	226
PID 26628 set thread context of 14128	26628	9DB5.tmp.Build.exe	239
PID 14184 set thread context of 5868	14184	Gxtuum.exe	249
PID 25060 set thread context of 26816	25060	a27043e351.exe	290
PID 22456 set thread context of 22288	22456	Intel_PTT_EK_Recertification.exe	332
PID 29052 set thread context of 11092	29052	bluemail.exe	337

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000300000000074b-24261.dat	upx
behavioral2/memory/15396-24263-0x0000000000540000-0x0000000000E93000-memory.dmp	upx
behavioral2/memory/15396-24273-0x0000000000540000-0x0000000000E93000-memory.dmp	upx
behavioral2/memory/29548-24528-0x00007FF73C8B0000-0x00007FF73CD40000-memory.dmp	upx
behavioral2/memory/29548-24531-0x00007FF73C8B0000-0x00007FF73CD40000-memory.dmp	upx
behavioral2/memory/22456-26087-0x00007FF64DF60000-0x00007FF64E3F0000-memory.dmp	upx
behavioral2/memory/22456-26101-0x00007FF64DF60000-0x00007FF64E3F0000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\hr-hr\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-ul-oob.xrm-ms	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.scale-100_contrast-white.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-36_altform-unplated.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircle.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\firstrun\startup_background.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-200.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.scale-100.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\176.png	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\sv-se\ui-strings.js	4ZD5C3i.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\README.TXT	4ZD5C3i.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSIRESOURCES.DLL	4ZD5C3i.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\collect_feedback\js\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\resources.pri	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSplash.scale-200.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png	4ZD5C3i.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\README.TXT	4ZD5C3i.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-125.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\classes.jsa	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icucnv40.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-core-synch-l1-2-0.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailWideTile.scale-150.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office15\pidgenx.dll	4ZD5C3i.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ru\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.targetsize-256_altform-unplated.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ca-es\ui-strings.js	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-36.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.bundle	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ProgressControl.xaml	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-30.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\ext\meta-index	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\_Resources\7.rsrc	4ZD5C3i.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ExcelServices.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Aero.dll	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-200.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\SmallTile.scale-100.png	4ZD5C3i.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\pl-pl\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-20_altform-unplated_contrast-white.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-80_altform-unplated.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-125.png	4ZD5C3i.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\LargeTile.scale-125.png	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_anonymoususer_18.svg	4ZD5C3i.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\README.TXT	4ZD5C3i.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\View3d\README.TXT	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png	4ZD5C3i.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-il\ui-strings.js	4ZD5C3i.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	4ZD5C3i.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\management.dll	4ZD5C3i.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
File created	C:\Windows\Tasks\Gxtuum.job	mail.exe
File created	C:\Windows\Tasks\Gxtuum.job	74DE.tmp.ctx.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
11436	2648	WerFault.exe	126
18456	28956	WerFault.exe	311

System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EkmIhQM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9DB5.tmp.Build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a27043e351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	782B.tmp.AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a27043e351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bxq1jd2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9DB5.tmp.Build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6167a929b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74DE.tmp.ctx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ZD5C3i.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6BC5.tmp.fcxcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e22e4cd6f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	226f930c10.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EkmIhQM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bluemail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
13524	PING.EXE
29632	powershell.exe
27136	PING.EXE
18244	powershell.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
13200	netsh.exe
9444	netsh.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	e22e4cd6f3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Bxq1jd2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Bxq1jd2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e22e4cd6f3.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
8212	timeout.exe
23760	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 17 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1080	ipconfig.exe
11556	ipconfig.exe
9388	ipconfig.exe
23340	ipconfig.exe
23452	ipconfig.exe
18704	ipconfig.exe
13956	ipconfig.exe
13124	ipconfig.exe
19008	ipconfig.exe
17640	ipconfig.exe
10768	ipconfig.exe
13028	ipconfig.exe
27716	ipconfig.exe
23588	ipconfig.exe
19492	ipconfig.exe
25432	ipconfig.exe
13052	ipconfig.exe

Gathers system information 1 TTPs 7 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
6604	systeminfo.exe
10944	systeminfo.exe
22912	systeminfo.exe
25832	systeminfo.exe
24500	systeminfo.exe
9344	systeminfo.exe
19788	systeminfo.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5568	taskkill.exe
5924	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Internet Explorer\GPU	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	SearchApp.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - Japanese (Japan)"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Discrete;Continuous"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Female"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR en-US Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - de-DE Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40C"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1036"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Haruka - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\ja-JP\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\en-US\\VoiceActivation_en-US.dat.prev"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "11.0"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\tn1033.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\ja-JP\\M1041Haruka"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "407"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - it-IT Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\lsr1040.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - ja-JP Embedded DNN v11.1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 a 000a e 000b i 000c o 000d u 000e t 000f d 0010 p 0011 b 0012 k 0013 g 0014 ch 0015 jj 0016 f 0017 s 0018 x 0019 m 001a n 001b nj 001c l 001d ll 001e r 001f rr 0020 j 0021 w 0022 th 0023"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft David - English (United States)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\c3082.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR it-IT Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "002D 002D 0021 0021 0026 0026 002C 002C 002E 002E 003F 003F 005F 005F 002B 002B 002A 002A 02C9 02C9 02CA 02CA 02C7 02C7 02CB 02CB 02D9 02D9 3000 3000 3105 3105 3106 3106 3107 3107 3108 3108 3109 3109 310A 310A 310B 310B 310C 310C 310D 310D 310E 310E 310F 310F 3110 3110 3111 3111 3112 3112 3113 3113 3114 3114 3115 3115 3116 3116 3117 3117 3118 3118 3119 3119 3127 3127 3128 3128 3129 3129 311A 311A 311B 311B 311C 311C 311D 311D 311E 311E 311F 311F 3120 3120 3121 3121 3122 3122 3123 3123 3124 3124 3125 3125 3126 3126"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Julie"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1040"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Katja"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "You have selected %1 as the default voice."	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\sidubm.table"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\M1031Hedda"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; message=NativeSupported; computer=NativeSupported"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "11.0.2016.0129"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\c1033.fe"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1040-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ichiro - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Zira"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR es-ES Lookup Lexicon"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "410"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\r3082sr.lxa"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Pablo"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\tn1040.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1041-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ayumi - Japanese (Japan)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "411"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "C0A"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Cosimo - Italian (Italy)"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\de-DE\\MSTTSLocdeDE.dat"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\es-ES\\M3082Laura"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\fr-FR-N\\tn1036.bin"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\r1041sr.lxa"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Spanish Phone Converter"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "1033"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Pablo - Spanish (Spain)"	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\es-ES\\VoiceActivation_es-ES.dat"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "French Phone Converter"	SearchApp.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
27136	PING.EXE
13524	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
29608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4660	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
4660	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
3516	skotes.exe
3516	skotes.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
3892	msedge.exe
3892	msedge.exe
4344	chrome.exe
4344	chrome.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4664	LoaderClient.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe
4416	4ZD5C3i.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4344	chrome.exe
4344	chrome.exe
4344	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	LoaderClient.exe
Token: SeTakeOwnershipPrivilege	4416	4ZD5C3i.exe
Token: SeBackupPrivilege	1908	vssvc.exe
Token: SeRestorePrivilege	1908	vssvc.exe
Token: SeAuditPrivilege	1908	vssvc.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeDebugPrivilege	5380	mail.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeDebugPrivilege	5924	taskkill.exe
Token: SeDebugPrivilege	5568	taskkill.exe
Token: SeShutdownPrivilege	4344	chrome.exe
Token: SeCreatePagefilePrivilege	4344	chrome.exe
Token: SeDebugPrivilege	16496	EkmIhQM.exe
Token: SeDebugPrivilege	17648	powershell.exe
Token: SeDebugPrivilege	20416	powershell.exe
Token: SeDebugPrivilege	7416	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4380	K6UAlAU.exe
Token: SeSecurityPrivilege	4380	K6UAlAU.exe
Token: SeTakeOwnershipPrivilege	4380	K6UAlAU.exe
Token: SeLoadDriverPrivilege	4380	K6UAlAU.exe
Token: SeSystemProfilePrivilege	4380	K6UAlAU.exe
Token: SeSystemtimePrivilege	4380	K6UAlAU.exe
Token: SeProfSingleProcessPrivilege	4380	K6UAlAU.exe
Token: SeIncBasePriorityPrivilege	4380	K6UAlAU.exe
Token: SeCreatePagefilePrivilege	4380	K6UAlAU.exe
Token: SeBackupPrivilege	4380	K6UAlAU.exe
Token: SeRestorePrivilege	4380	K6UAlAU.exe
Token: SeShutdownPrivilege	4380	K6UAlAU.exe
Token: SeDebugPrivilege	4380	K6UAlAU.exe
Token: SeSystemEnvironmentPrivilege	4380	K6UAlAU.exe
Token: SeRemoteShutdownPrivilege	4380	K6UAlAU.exe
Token: SeUndockPrivilege	4380	K6UAlAU.exe
Token: SeManageVolumePrivilege	4380	K6UAlAU.exe
Token: 33	4380	K6UAlAU.exe
Token: 34	4380	K6UAlAU.exe
Token: 35	4380	K6UAlAU.exe
Token: 36	4380	K6UAlAU.exe
Token: SeIncreaseQuotaPrivilege	27948	svchost.exe
Token: SeSecurityPrivilege	27948	svchost.exe
Token: SeTakeOwnershipPrivilege	27948	svchost.exe
Token: SeLoadDriverPrivilege	27948	svchost.exe
Token: SeSystemProfilePrivilege	27948	svchost.exe
Token: SeSystemtimePrivilege	27948	svchost.exe
Token: SeProfSingleProcessPrivilege	27948	svchost.exe
Token: SeIncBasePriorityPrivilege	27948	svchost.exe
Token: SeCreatePagefilePrivilege	27948	svchost.exe
Token: SeBackupPrivilege	27948	svchost.exe
Token: SeRestorePrivilege	27948	svchost.exe
Token: SeShutdownPrivilege	27948	svchost.exe
Token: SeDebugPrivilege	27948	svchost.exe
Token: SeSystemEnvironmentPrivilege	27948	svchost.exe
Token: SeRemoteShutdownPrivilege	27948	svchost.exe
Token: SeUndockPrivilege	27948	svchost.exe
Token: SeManageVolumePrivilege	27948	svchost.exe
Token: 33	27948	svchost.exe
Token: 34	27948	svchost.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
4660	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
4344	chrome.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
3524	Explorer.EXE
3524	Explorer.EXE
3524	Explorer.EXE
3524	Explorer.EXE
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe
9696	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
16656	StartMenuExperienceHost.exe
15684	SearchApp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 3516	4660	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe	83
PID 4660 wrote to memory of 3516	4660	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe	83
PID 4660 wrote to memory of 3516	4660	eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe	83
PID 3516 wrote to memory of 4308	3516	skotes.exe	86
PID 3516 wrote to memory of 4308	3516	skotes.exe	86
PID 4308 wrote to memory of 4664	4308	LoaderClient.exe	87
PID 4308 wrote to memory of 4664	4308	LoaderClient.exe	87
PID 4664 wrote to memory of 4888	4664	LoaderClient.exe	88
PID 4664 wrote to memory of 4888	4664	LoaderClient.exe	88
PID 4664 wrote to memory of 4344	4664	LoaderClient.exe	97
PID 4664 wrote to memory of 4344	4664	LoaderClient.exe	97
PID 4664 wrote to memory of 4332	4664	LoaderClient.exe	98
PID 4664 wrote to memory of 4332	4664	LoaderClient.exe	98
PID 4344 wrote to memory of 3664	4344	chrome.exe	99
PID 4344 wrote to memory of 3664	4344	chrome.exe	99
PID 4332 wrote to memory of 3952	4332	msedge.exe	100
PID 4332 wrote to memory of 3952	4332	msedge.exe	100
PID 3516 wrote to memory of 4416	3516	skotes.exe	101
PID 3516 wrote to memory of 4416	3516	skotes.exe	101
PID 3516 wrote to memory of 4416	3516	skotes.exe	101
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 5112	4332	msedge.exe	102
PID 4332 wrote to memory of 3892	4332	msedge.exe	103
PID 4332 wrote to memory of 3892	4332	msedge.exe	103
PID 4344 wrote to memory of 4092	4344	chrome.exe	104
PID 4344 wrote to memory of 4092	4344	chrome.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
29596	attrib.exe
29504	attrib.exe
29612	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
PID:3524
- C:\Users\Admin\AppData\Local\Temp\eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe
  "C:\Users\Admin\AppData\Local\Temp\eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderClient.exe
      "C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderClient.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderClient.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014759001\LoaderClient.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4664
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:4888
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --restore-last-session --remote-debugging-port=8379 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
        6⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4216cc40,0x7ffb4216cc4c,0x7ffb4216cc58
        7⤵
        
        PID:3664
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,15676046811273911395,1575554114611838874,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1924 /prefetch:2
        7⤵
        
        PID:4092
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2148,i,15676046811273911395,1575554114611838874,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:3
        7⤵
        
        PID:4172
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=2248,i,15676046811273911395,1575554114611838874,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2260 /prefetch:8
        7⤵
        
        PID:1588
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8379 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3720,i,15676046811273911395,1575554114611838874,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3784 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3264
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8379 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3760,i,15676046811273911395,1575554114611838874,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3816 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:2952
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --remote-debugging-port=8379 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4508,i,15676046811273911395,1575554114611838874,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:2900
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --field-trial-handle=4668,i,15676046811273911395,1575554114611838874,262144 --disable-features=PaintHolding --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3496 /prefetch:8
        7⤵
        
        PID:2976
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --restore-last-session --remote-debugging-port=8709 --remote-allow-origins=* --headless=new "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
        6⤵
        Uses browser remote debugging
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xec,0x10c,0x7ffb41ca46f8,0x7ffb41ca4708,0x7ffb41ca4718
        7⤵
        
        PID:3952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1512,11580744026594832007,5669328392777875658,131072 --disable-features=PaintHolding --headless=new --headless --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --override-use-software-gl-for-tests --mojo-platform-channel-handle=1516 /prefetch:2
        7⤵
        
        PID:5112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1512,11580744026594832007,5669328392777875658,131072 --disable-features=PaintHolding --lang=en-US --service-sandbox-type=none --use-gl=swiftshader-webgl --headless --mojo-platform-channel-handle=1892 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=8709 --allow-pre-commit-input --field-trial-handle=1512,11580744026594832007,5669328392777875658,131072 --disable-features=PaintHolding --lang=en-US --headless --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2020 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3764
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM chrome.exe"
        6⤵
        
        PID:3476
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5924
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "taskkill /F /IM msedge.exe"
        6⤵
        
        PID:1608
        
        C:\Windows\system32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5568
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command " Add-MpPreference -ExclusionExtension '.ps1', '.tmp', '.py' Add-MpPreference -ExclusionPath \"$env:TEMP\", \"$env:APPDATA\" "
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:17648
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        
        PID:27080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Powershell\Get-Clipboard.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:20416
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2qivrcsv\2qivrcsv.cmdline"
        7⤵
        
        PID:25444
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3803.tmp" "c:\Users\Admin\AppData\Local\Temp\2qivrcsv\CSCDB34E447D44344F885BC3846F33A48C5.TMP"
        8⤵
        
        PID:26196
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        6⤵
        
        PID:27924
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:27716
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        6⤵
        
        PID:27848
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:23340
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:23792
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:25832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        
        PID:11464
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:7416
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        6⤵
        
        PID:6092
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:1080
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        6⤵
        
        PID:14100
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:11556
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        6⤵
        
        PID:23356
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:23452
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        6⤵
        
        PID:23504
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:23588
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:23644
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:24500
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        6⤵
        
        PID:17756
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:18704
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        6⤵
        
        PID:18812
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:19008
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:19004
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:9344
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        6⤵
        
        PID:6232
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:19492
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        6⤵
        
        PID:19520
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:17640
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:19988
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:19788
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        6⤵
        
        PID:15456
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:9388
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        6⤵
        
        PID:13704
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:13956
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:7044
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:6604
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        6⤵
        
        PID:10448
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:25432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        6⤵
        
        PID:10640
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:10768
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:10812
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:10944
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        6⤵
        
        PID:12364
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:13052
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig"
        6⤵
        
        PID:13288
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig
        7⤵
        Gathers network information
        
        PID:13028
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ipconfig /all"
        6⤵
        
        PID:12988
        
        C:\Windows\system32\ipconfig.exe
        
        ipconfig /all
        7⤵
        Gathers network information
        
        PID:13124
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:28632
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:22912
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Missing runtime 140.DLL please download runtime 140 to continue.', 0, 'Missing DLL files', 0+16);close()""
        6⤵
        
        PID:18856
        
        C:\Windows\system32\mshta.exe
        
        mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('Missing runtime 140.DLL please download runtime 140 to continue.', 0, 'Missing DLL files', 0+16);close()"
        7⤵
        
        PID:19092
  - - C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe
      "C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\1014844001\mail.exe
      "C:\Users\Admin\AppData\Local\Temp\1014844001\mail.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\1015079001\Bxq1jd2.exe
      "C:\Users\Admin\AppData\Local\Temp\1015079001\Bxq1jd2.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:2648
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015079001\Bxq1jd2.exe" & rd /s /q "C:\ProgramData\WT2NOZMOZU3E" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6340
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:8212
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 1944
        5⤵
        Program crash
        
        PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe
      "C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\1015193001\K6UAlAU.exe
      "C:\Users\Admin\AppData\Local\Temp\1015193001\K6UAlAU.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      PID:4380
    - - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:27948
    - - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        5⤵
        Adds Run key to start application
        
        PID:27896
    - - C:\Windows\system32\audiodg.exe
        
        "C:\Windows\system32\audiodg.exe"
        5⤵
        Adds Run key to start application
        
        PID:27952
  - - C:\Users\Admin\AppData\Local\Temp\1015201001\6167a929b0.exe
      "C:\Users\Admin\AppData\Local\Temp\1015201001\6167a929b0.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:9896
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
        5⤵
        
        PID:28464
      - C:\Windows\system32\mode.com
        
        mode 65,10
        6⤵
        
        PID:28704
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:28752
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:28904
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:29000
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:29060
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:29124
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:29176
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:29272
      - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:29380
      - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        6⤵
        Views/modifies file attributes
        
        PID:29504
      - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        6⤵
        Executes dropped EXE
        
        PID:29548
        
        C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:29596
        
        C:\Windows\SYSTEM32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        7⤵
        Views/modifies file attributes
        
        PID:29612
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:29608
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:29632
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:27136
  - - C:\Users\Admin\AppData\Local\Temp\1015202001\a27043e351.exe
      "C:\Users\Admin\AppData\Local\Temp\1015202001\a27043e351.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:25060
    - - C:\Users\Admin\AppData\Local\Temp\1015202001\a27043e351.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1015202001\a27043e351.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:26816
  - - C:\Users\Admin\AppData\Local\Temp\1015206001\e22e4cd6f3.exe
      "C:\Users\Admin\AppData\Local\Temp\1015206001\e22e4cd6f3.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:28956
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015206001\e22e4cd6f3.exe" & rd /s /q "C:\ProgramData\ZCTRQ9R1VKF3" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:26176
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:23760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 28956 -s 1884
        5⤵
        Program crash
        
        PID:18456
  - - C:\Users\Admin\AppData\Local\Temp\1015207001\XAzdvQx.exe
      "C:\Users\Admin\AppData\Local\Temp\1015207001\XAzdvQx.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:10940
    - - C:\Users\Admin\AppData\Roaming\services.exe
        
        "C:\Users\Admin\AppData\Roaming\services.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        
        PID:27320
    - - C:\Users\Admin\AppData\Roaming\windows.exe
        
        "C:\Users\Admin\AppData\Roaming\windows.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:26844
  - - C:\Users\Admin\AppData\Local\Temp\1015208001\226f930c10.exe
      "C:\Users\Admin\AppData\Local\Temp\1015208001\226f930c10.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:7268
- C:\Users\Admin\AppData\Local\Temp\1014844001\mail.exe
  "C:\Users\Admin\AppData\Local\Temp\1014844001\mail.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe
    "C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:14184
- C:\Users\Admin\AppData\Local\Temp\6BC5.tmp.fcxcx.exe
  "C:\Users\Admin\AppData\Local\Temp\6BC5.tmp.fcxcx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:26716
- C:\Users\Admin\AppData\Local\Temp\74DE.tmp.ctx.exe
  "C:\Users\Admin\AppData\Local\Temp\74DE.tmp.ctx.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:17852
- - C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
    "C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:18832
  - - C:\Users\Admin\AppData\Local\Temp\10000850101\update.exe
      "C:\Users\Admin\AppData\Local\Temp\10000850101\update.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      PID:25804
    - - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        5⤵
        
        PID:17672
    - - C:\Windows\system32\msiexec.exe
        
        "C:\Windows\system32\msiexec.exe"
        5⤵
        
        PID:19592
    - - C:\Windows\system32\audiodg.exe
        
        "C:\Windows\system32\audiodg.exe"
        5⤵
        
        PID:19500
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:17340
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main
        5⤵
        Blocklisted process makes network request
        Loads dropped DLL
        
        PID:17204
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:9444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\932230532004_Desktop.zip' -CompressionLevel Optimal
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2420
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:27212
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll, Main
        5⤵
        Blocklisted process makes network request
        Loads dropped DLL
        
        PID:27332
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:13200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\932230532004_Desktop.zip' -CompressionLevel Optimal
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:20132
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:21348
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:25596
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:7276
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll, Main
      4⤵
      Blocklisted process makes network request
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:13556
- C:\Users\Admin\AppData\Local\Temp\782B.tmp.AsyncClient.exe
  "C:\Users\Admin\AppData\Local\Temp\782B.tmp.AsyncClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:25584
- C:\Users\Admin\AppData\Local\Temp\9DB5.tmp.Build.exe
  "C:\Users\Admin\AppData\Local\Temp\9DB5.tmp.Build.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:26628
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Drops desktop.ini file(s)
    - Enumerates connected drives
    - Checks SCSI registry key(s)
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:9696
- - C:\Users\Admin\AppData\Local\Temp\9DB5.tmp.Build.exe
    "C:\Users\Admin\AppData\Local\Temp\9DB5.tmp.Build.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:14128
- C:\Users\Admin\AppData\Local\Temp\ABFE.tmp.cc.exe
  "C:\Users\Admin\AppData\Local\Temp\ABFE.tmp.cc.exe"
  2⤵
  - Executes dropped EXE
  PID:15396
- C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe
  "C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\10000730261\e0bf7b21-dfb9-4a08-829c-d5d5619ab86a.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\10000730261\e0bf7b21-dfb9-4a08-829c-d5d5619ab86a\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:21172
- - C:\Users\Admin\AppData\Local\Temp\10000730261\e0bf7b21-dfb9-4a08-829c-d5d5619ab86a\bluemail.exe
    "C:\Users\Admin\AppData\Local\Temp\10000730261\e0bf7b21-dfb9-4a08-829c-d5d5619ab86a\bluemail.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:29052
- C:\Users\Admin\AppData\Local\Temp\10000730261\e0bf7b21-dfb9-4a08-829c-d5d5619ab86a\bluemail.exe
  "C:\Users\Admin\AppData\Local\Temp\10000730261\e0bf7b21-dfb9-4a08-829c-d5d5619ab86a\bluemail.exe"
  2⤵
  - Executes dropped EXE
  PID:11092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3792

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2508

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:13352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2648 -ip 2648
1⤵
PID:2872

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:16656

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:15684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 28956 -ip 28956
1⤵
PID:26528

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:20672

C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:22456
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:22288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:18244
- - C:\Windows\system32\PING.EXE
    "C:\Windows\system32\PING.EXE" 127.1.10.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:13524

C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\ee29ea508b\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:22404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Crashpad\README.TXT

Filesize
533B

MD5
81d185495b4e6430a87dfd37789bb872

SHA1
b5da653f81a548c74205c7ae3d19f30af1a14271

SHA256
838d654b9cb0360d8b3bb767db8fc1954fc41ba0a56fc34688aad9b50f5ddb40

SHA512
1106c9c2245cbd44effb42e4e1365eb796d3b2390b011fb97205550bf183b097c489194aa001f97f949e9d1ed1c970eea6cbb0477da47511e5bc18e88bf2dfa5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133786588612181546.txt

Filesize
75KB

MD5
32d79f914d86b388a6173933f6b69577

SHA1
745c9a16484540acd87deb31e842b83f543b624f

SHA256
a1a5a55908f4045a4268a44005c0231d4d2c75c49b456d1d6a8d3a63ae244336

SHA512
216d56100d134a242aab407426e25196abc5c519f53abf20938f08bd4acc2b0f0a721a17cd8b55054614f56bb0f42f500588311b85aff261416fc5a7f2c8f657

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000730261\e0bf7b21-dfb9-4a08-829c-d5d5619ab86a.zip

Filesize
953KB

MD5
4f09e602de9e03e0a7877213e7a11d06

SHA1
1ada1f816d1c54cd36592962da67f9c8a71ad8e7

SHA256
5ad31eb768e095725670f7a5622eaad1dd36a5063607afb233e02b0baf92b0c9

SHA512
2baf2920cbfe899c9d2e1a74c61336c5c50b3558aabbfe0973958d827abd57996475cae250746cd67ca29639887d5956cb65d0c6a6f9d388c7ab5f798dfe45ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000850101\update.exe

Filesize
302KB

MD5
2682786590a361f965fb7e07170ebe2b

SHA1
57c2c049997bfebb5fae9d99745941e192e71df1

SHA256
50dcab544d9da89056f9a7dcc28e641b743abe6afef1217ee0dfbd11e962e41d

SHA512
9b1dc6ee05a28ef2dc76b7d1ae97202cadcfafd261cf876bb64f546991311f9a36e46620cce9ae8b58bfc8e4de69840618c90a9a3cab56b6660803691c1ff6dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014798001\4ZD5C3i.exe

Filesize
1.1MB

MD5
42a8588cc82773cd223c42f8fe4be91a

SHA1
e2ed3cda00140ecd445f5f742729d34f2c452c8c

SHA256
d4521c34f489f4a6065dea15634df9bb700c84741f476bde1084d9cdfb373a7b

SHA512
681e4b155ce1015723469bd819618b292844aa00f7dab447d9557e244792efcef5614f753283efe9dd76ea77b838af78a3e69008c380482a4412b1cea75c535d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1014844001\mail.exe

Filesize
1.2MB

MD5
83361dc1c30feb8284824cc808a3954a

SHA1
4a9542ce641e0ef79d5cafc39d0813e0afad8c7d

SHA256
c40b29d380f8af669a98155d58e974cc33a1b73095c4f468c04bbbb007bd356c

SHA512
de2710795df6d4e1b005a122e5cf082942b105828415864296db66f0fc2876d3ea071f4a67f12d98ccc50d321b79a490cfac3711b8d66a32e36c7447dd99e04c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015079001\Bxq1jd2.exe

Filesize
313KB

MD5
876a365bda09b9ef39605e375d677f0a

SHA1
2c12b38ed2d84722cf5dcea8bd45cfa7d7b55ba4

SHA256
ed252fe89ba1243bad21f373c952b16940a0094149b0be50e5c3da9c20a23234

SHA512
2a2df513d61e9b0eeedf099bb6a04962caa5eb31149efc24421bc30236886fc4a60fb7bcabed46069f0a13789ca34d4f21bc02f3c53bd8cf428be399ae63cb7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015130001\EkmIhQM.exe

Filesize
2.1MB

MD5
e48d0435a98834793ce9de1bb80fcf9a

SHA1
f783ad89853913987852c17e950f9697afbc4ede

SHA256
bb6973b370222c70d95255622b354a328809a1116d31c69122b35508e1601831

SHA512
7e3018a7f2741cf8adc3491eea00a2c67b25831f51904a956dc63fc8eac2bac876d4015f5aa0ab554bf45c5a2f93adca0d0810aad758e61d072c3e0b038553a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015193001\K6UAlAU.exe

Filesize
302KB

MD5
a9502d407c7a3e0c43ad669c27638793

SHA1
bf0b7815c6dac82643a5bf7bd397a6aa58a9e803

SHA256
5f3cd8392c045a321ccf0ede6f38a4016a236f257d0a6ab897bf7f3e21868135

SHA512
0dbe8772ded05ba2c67ea7a7e9bc291b76d8b73dbab86a35fca5b1138be41c2ee7a54333fcd7bf58823ab3b5f1f6250b98b829ca0c367cafb2176350f5454d25

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015201001\6167a929b0.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015202001\a27043e351.exe

Filesize
710KB

MD5
28e568616a7b792cac1726deb77d9039

SHA1
39890a418fb391b823ed5084533e2e24dff021e1

SHA256
9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

SHA512
85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015206001\e22e4cd6f3.exe

Filesize
384KB

MD5
dfd5f78a711fa92337010ecc028470b4

SHA1
1a389091178f2be8ce486cd860de16263f8e902e

SHA256
da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

SHA512
a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015207001\XAzdvQx.exe

Filesize
144KB

MD5
eee5d4ba46b5cb7f19f634ce6f291d40

SHA1
387cc77aaca32cb77e45f1eb88acf2b613fd6682

SHA256
66b07cd7495526de65042e088a9c5409745266a4ebbb8413c57190051e6bba30

SHA512
98ab9fa05a554d50950e505deb46db650d5ff77d81a321af63f240020bed81e124a57fdde72fef914e0865eb1fe379c7be94a0542e63f3c9148ab21dd8eb2ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015208001\226f930c10.exe

Filesize
2.5MB

MD5
2a78ce9f3872f5e591d643459cabe476

SHA1
9ac947dfc71a868bc9c2eb2bd78dfb433067682e

SHA256
21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

SHA512
03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\6BC5.tmp.fcxcx.exe

Filesize
300KB

MD5
f0aaf1b673a9316c4b899ccc4e12d33e

SHA1
294b9c038264d052b3c1c6c80e8f1b109590cf36

SHA256
fcc616ecbe31fadf9c30a9baedde66d2ce7ff10c369979fe9c4f8c5f1bff3fc2

SHA512
97d149658e9e7a576dfb095d5f6d8956cb185d35f07dd8e769b3b957f92260b5de727eb2685522923d15cd70c16c596aa6354452ac851b985ab44407734b6f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\74DE.tmp.ctx.exe

Filesize
431KB

MD5
4962575a2378d5c72e7a836ea766e2ad

SHA1
549964178b12017622d3cbdda6dbfdef0904e7e2

SHA256
eff5fad47b9c739b09e760813b2bcbb0788eb35598f72e64ff95c794e72e6676

SHA512
911a59f7a6785dd09a57dcd6d977b8abd5e160bd613786e871a1e92377c9e6f3b85fe3037431754bbdb1212e153776efca5fadac1de6b2ad474253da176e8e53

Download Submit
C:\Users\Admin\AppData\Local\Temp\782B.tmp.AsyncClient.exe

Filesize
47KB

MD5
da0c2ab9e92a4d36b177ae380e91feda

SHA1
44fb185950925ca2fcb469fbedaceee0a451cbca

SHA256
c84a91d4261563b4171103a1d72a3f86f48ec2eaca6e43d7f217bdcbc877124d

SHA512
0fc9a2f7cd1924578ed0840205162c19bcc67ad602321461d74d817344436f778d6fe54cc91f795cbed6decd65dc4d8bbc17ef969af7dd5feafec9bd7fcc1e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\9DB5.tmp.Build.exe

Filesize
701KB

MD5
5890798f97f9144206499433a5db3011

SHA1
1c9c488123a81bf8d2216ac57c089e056f899433

SHA256
69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411

SHA512
964f340060a67abed11d06ac40cb8cb2577f985e8815cc12f306e37a716792ae8edac02645d0cddeea5d81f72ef402363c909b6f510eb2a37c76f1cf56caada9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ABFE.tmp.cc.exe

Filesize
2.9MB

MD5
99f996079094ad472d9720b2abd57291

SHA1
1ff6e7cafeaf71a5debbc0bb4db9118a9d9de945

SHA256
833fd615ec3e7576960a872fff5a4459b0c756338068f87341655849d1f7e1af

SHA512
6a6d4034b37f9bb3b4a0b455de7485b990bf3bd3042316d7261bd2973dbe522490654045d579a6df58a4b834e04c377897eea41798e6b1f5fdbc45a2bb0d127f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Credentials.zip

Filesize
494B

MD5
3e13ca28be686b99b6d524b85214c343

SHA1
e3a78e18b3379f78488218a997efb5feae320a1f

SHA256
15dea647d2f2aa611ab97c185ebce0107e7bbf6fc169111c4867a58174e460ec

SHA512
68b5091829d5bdf6c0aad23acea1426dcace4fac16b358e08ab6a494c335288880fac3af26e85cd818679611deb281601caa3eb63ef3b9a221f4c722ecfb8857

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\Cryptodome\Cipher\_raw_cbc.pyd

Filesize
12KB

MD5
73dd025bfa3cfb38e5daad0ed9914679

SHA1
65d141331e8629293146d3398a2f76c52301d682

SHA256
c89f3c0b89cfee35583d6c470d378da0af455ebd9549be341b4179d342353641

SHA512
20569f672f3f2e6439afd714f179a590328a1f9c40c6bc0dc6fcad7581bc620a877282baf7ec7f16aaa79724ba2165f71d79aa5919c8d23214bbd39611c23aed

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\Cryptodome\Cipher\_raw_cfb.pyd

Filesize
13KB

MD5
e87aac7f2a9bf57d6796e5302626ee2f

SHA1
4b633501e76e96c8859436445f38240f877fc6c6

SHA256
97bf9e392d6ad9e1ec94237407887ea3d1dec2d23978891a8174c03af606fd34

SHA512
108663f0700d9e30e259a62c1ae35b23f5f2abd0eff00523aae171d1db803da99488c7395afd3ad54a242f0cb2c66a60e6904d3e3f75bb1193621fd65df4ad5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\Cryptodome\Cipher\_raw_ctr.pyd

Filesize
14KB

MD5
f3f30d72d6d7f4ba94b3c1a9364f1831

SHA1
46705c3a35c84bf15cf434e2607bddd18991e138

SHA256
7820395c44eab26de0312dfc5d08a9a27398f0caa80d8f9a88dee804880996ff

SHA512
01c5ea300a7458efe1b209c56a826df0bf3d6ff4dd512f169d6aee9d540600510c3249866bfb991975ca5e41c77107123e480eda4d55eccb88ed22399ee57912

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\Cryptodome\Cipher\_raw_ecb.pyd

Filesize
10KB

MD5
93da52e6ce73e0c1fc14f7b24dcf4b45

SHA1
0961cfb91bbcee3462954996c422e1a9302a690b

SHA256
ddd427c76f29edd559425b31eee54eb5b1bdd567219ba5023254efde6591faa0

SHA512
49202a13d260473d3281bf7ca375ac1766189b6936c4aa03f524081cc573ee98d236aa9c736ba674ade876b7e29ae9891af50f1a72c49850bb21186f84a3c3ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\Cryptodome\Cipher\_raw_ofb.pyd

Filesize
12KB

MD5
0628dc6d83f4a9dddb0552bd0cc9b54c

SHA1
c73f990b84a126a05f1d32d509b6361dca80bc93

SHA256
f136b963b5ceb60b0f58127a925d68f04c1c8a946970e10c4abc3c45a1942bc7

SHA512
78d005a2fec5d1c67fc2b64936161026f9a0b1756862baf51eaf14edee7739f915d059814c8d6f66797f84a28071c46b567f3392daf4ff7fcdfa94220c965c1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\Cryptodome\Hash\_BLAKE2s.pyd

Filesize
13KB

MD5
4d8230d64493ce217853b4d3b6768674

SHA1
c845366e7c02a2402ba00b9b6735e1fad3f2f1ef

SHA256
06885dc99a7621ba3be3b28cb4bcf972549e23acf62a710f6d6c580aaba1f25a

SHA512
c32d5987a0b1ded7211545cb7d3d7482657ca7d74a9083d37a33f65bbe2e7e075cb52efaeea00f1840ab8f0baf7df1466a4f4e880abf9650a709814bcee2f945

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\Cryptodome\Hash\_SHA1.pyd

Filesize
17KB

MD5
51a01a11848322ac53b07d4d24f97652

SHA1
141097d0f0f1c5432b1f1a571310bd4266e56a6d

SHA256
e549a4fe85759cbfc733ecf190478514b46eca34eda2370f523328f6dc976f30

SHA512
23281be77496af3a6507b610191af5aa005c974f27129073fd70d51e82a5d3e55fb8c7ff28cf1886b55e264b736ab506ee0d97210e764eb1618c74de2b44e64a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\Cryptodome\Util\_strxor.pyd

Filesize
10KB

MD5
3369f9bb8b0ee93e5ad5b201956dc60f

SHA1
a5b75cbd6ce905a179e49888e798cd6ae9e9194d

SHA256
5940e97e687a854e446dc859284a90c64cf6d87912c37172b8823a8c3a7b73df

SHA512
c4e71d683be64a8e6ab533fa4c1c3040b96d0be812ea74c99d2d2b5d52470c24b45d55366a7acb9d8cda759a618cbaf0d0a7ecfef4c0954df89fdb768d9893e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\_bz2.pyd

Filesize
81KB

MD5
a4b636201605067b676cc43784ae5570

SHA1
e9f49d0fc75f25743d04ce23c496eb5f89e72a9a

SHA256
f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c

SHA512
02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\_cffi_backend.cp310-win_amd64.pyd

Filesize
174KB

MD5
2baaa98b744915339ae6c016b17c3763

SHA1
483c11673b73698f20ca2ff0748628c789b4dc68

SHA256
4f1ce205c2be986c9d38b951b6bcb6045eb363e06dacc069a41941f80be9068c

SHA512
2ae8df6e764c0813a4c9f7ac5a08e045b44daac551e8ff5f8aa83286be96aa0714d373b8d58e6d3aa4b821786a919505b74f118013d9fcd1ebc5a9e4876c2b5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\_ctypes.pyd

Filesize
119KB

MD5
87596db63925dbfe4d5f0f36394d7ab0

SHA1
ad1dd48bbc078fe0a2354c28cb33f92a7e64907e

SHA256
92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4

SHA512
e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\_hashlib.pyd

Filesize
60KB

MD5
49ce7a28e1c0eb65a9a583a6ba44fa3b

SHA1
dcfbee380e7d6c88128a807f381a831b6a752f10

SHA256
1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430

SHA512
cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\_lzma.pyd

Filesize
154KB

MD5
b5fbc034ad7c70a2ad1eb34d08b36cf8

SHA1
4efe3f21be36095673d949cceac928e11522b29c

SHA256
80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6

SHA512
e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\_pytransform.dll

Filesize
1.1MB

MD5
e4761848102a6902b8e38f3116a91a41

SHA1
c262973e26bd9d8549d4a9abf4b7ae0ca4db75f0

SHA256
9d03619721c887413315bd674dae694fbd70ef575eb0138f461a34e2dd98a5fd

SHA512
a148640aa6f4b4ef3ae37922d8a11f4def9ecfd595438b9a36b1be0810bfb36abf0e01bee0aa79712af0d70cddce928c0df5057c0418c4ed0d733c6193761e82

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\_queue.pyd

Filesize
29KB

MD5
23f4becf6a1df36aee468bb0949ac2bc

SHA1
a0e027d79a281981f97343f2d0e7322b9fe9b441

SHA256
09c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66

SHA512
3ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\_socket.pyd

Filesize
75KB

MD5
e137df498c120d6ac64ea1281bcab600

SHA1
b515e09868e9023d43991a05c113b2b662183cfe

SHA256
8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a

SHA512
cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\_ssl.pyd

Filesize
155KB

MD5
35f66ad429cd636bcad858238c596828

SHA1
ad4534a266f77a9cdce7b97818531ce20364cb65

SHA256
58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc

SHA512
1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\base_library.zip

Filesize
812KB

MD5
5b401d1566b6fa639fd2aff2a881ea1f

SHA1
4df0849556ef7c82d39c7ea4c34a0188677a03ac

SHA256
0ddff00fec783e3ddb1b425ce741a9e1564acd57ae95ea5123bd642fb758dc2c

SHA512
5f666ba89fd86847aa53aa7b51d135f820a348c1f722049b6ca2374eb1726a3255ba9b0ca7d3c8f7c1621eb3ae813abda20dc3f8be33c3e47a38240721412b13

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\jaraco\text\Lorem ipsum.txt

Filesize
1KB

MD5
4ce7501f6608f6ce4011d627979e1ae4

SHA1
78363672264d9cd3f72d5c1d3665e1657b1a5071

SHA256
37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b

SHA512
a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\libcrypto-1_1.dll

Filesize
3.3MB

MD5
ab01c808bed8164133e5279595437d3d

SHA1
0f512756a8db22576ec2e20cf0cafec7786fb12b

SHA256
9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55

SHA512
4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\libssl-1_1.dll

Filesize
682KB

MD5
de72697933d7673279fb85fd48d1a4dd

SHA1
085fd4c6fb6d89ffcc9b2741947b74f0766fc383

SHA256
ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f

SHA512
0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\pyexpat.pyd

Filesize
193KB

MD5
6bc89ebc4014a8db39e468f54aaafa5e

SHA1
68d04e760365f18b20f50a78c60ccfde52f7fcd8

SHA256
dbe6e7be3a7418811bd5987b0766d8d660190d867cd42f8ed79e70d868e8aa43

SHA512
b7a6a383eb131deb83eee7cc134307f8545fb7d043130777a8a9a37311b64342e5a774898edd73d80230ab871c4d0aa0b776187fa4edec0ccde5b9486dbaa626

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\python3.DLL

Filesize
63KB

MD5
07bd9f1e651ad2409fd0b7d706be6071

SHA1
dfeb2221527474a681d6d8b16a5c378847c59d33

SHA256
5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5

SHA512
def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\python310.dll

Filesize
4.3MB

MD5
c80b5cb43e5fe7948c3562c1fff1254e

SHA1
f73cb1fb9445c96ecd56b984a1822e502e71ab9d

SHA256
058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

SHA512
faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\pythoncom310.dll

Filesize
543KB

MD5
b7acfad9f0f36e7cf8bfb0dd58360ffe

SHA1
8fa816d403f126f3326cb6c73b83032bb0590107

SHA256
461328c988d4c53f84579fc0880c4a9382e14b0c8b830403100a2fa3df0fd9a9

SHA512
4fed8a9162a9a2ebc113ea44d461fb498f9f586730218d9c1cddcd7c8c803cad6dea0f563b8d7533321ecb25f6153ca7c5777c314e7cb76d159e39e74c72d1b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\pywintypes310.dll

Filesize
139KB

MD5
f200ca466bf3b8b56a272460e0ee4abc

SHA1
ca18e04f143424b06e0df8d00d995c2873aa268d

SHA256
a6700ca2bee84c1a051ba4b22c0cde5a6a5d3e35d4764656cfdc64639c2f6b77

SHA512
29bf2425b665af9d2f9fd7795bf2ab012aa96faed9a1a023c86afa0d2036cc6014b48116940fad93b7de1e8f4f93eb709cc9319439d7609b79fd8b92669b377d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\select.pyd

Filesize
28KB

MD5
adc412384b7e1254d11e62e451def8e9

SHA1
04e6dff4a65234406b9bc9d9f2dcfe8e30481829

SHA256
68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1

SHA512
f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI43082\win32api.cp310-win_amd64.pyd

Filesize
131KB

MD5
ec7c48ea92d9ff0c32c6d87ee8358bd0

SHA1
a67a417fdb36c84871d0e61bfb1015cb30c9898a

SHA256
a0f3cc0e98bea5a598e0d4367272e4c65bf446f21932dc2a051546b098d6ce62

SHA512
c06e3c0260b918509947a89518d55f0cb03cb19fc28d9e7ed9e3f837d71df31154f0093929446a93a7c7da1293ffd0cc69547e2540f15e3055fe1d12d837f935

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_llbr5yxz.rh5.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.1MB

MD5
3b7f8ea6d98d68edd65a49c922671468

SHA1
e5d999ecc81a188bfa758af9980ecf55038527b3

SHA256
eadbad94a4ef1b106f1309fdde748c49d606fc04589fc079853292b0c4ee136f

SHA512
b1c681a7d50033487b93c5566c77cac6d53650032f9e741e8bbe45d781c6ce2388c211895447d51c7d1f274a4a5863a959980ba24358f634cf2b5e41285f5109

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\prysmax_games.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAB9.tmp

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpADF.tmp

Filesize
114KB

MD5
ab87d892a202f83f7e925c5e294069e8

SHA1
0b86361ff41417a38ce3f5b5250bb6ecd166a6a1

SHA256
bdc61a1c60fe8c08fe7a5256e9c8d7ad1ba4dd0963a54357c484256fc8834130

SHA512
f9a03eaae52d7fb544047fea3ffa7d8c6f7debdbb907348adfc46545e7b6c3783427983f16885ae138e43e51eec6ce73520c38581e4d9bb7140beeae2137de41

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB29.tmp

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB30.tmp

Filesize
20KB

MD5
49693267e0adbcd119f9f5e02adf3a80

SHA1
3ba3d7f89b8ad195ca82c92737e960e1f2b349df

SHA256
d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

SHA512
b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB45.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB52.tmp

Filesize
96KB

MD5
40f3eb83cc9d4cdb0ad82bd5ff2fb824

SHA1
d6582ba879235049134fa9a351ca8f0f785d8835

SHA256
cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

SHA512
cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

Download Submit
C:\Users\Admin\AppData\Roaming\43266f2abbf198\clip64.dll

Filesize
124KB

MD5
c2f3fbbbe6d5f48a71b6b168b1485866

SHA1
1cd56cfc2dc07880b65bd8a1f5b7147633f5d553

SHA256
c7ed512058bc924045144daa16701da10f244ac12a5ea2de901e59dce6470839

SHA512
e211f18c2850987529336e0d20aa894533c1f6a8ae6745e320fd394a9481d3a956c719ac29627afd783e36e5429c0325b98e60aee2a830e75323c276c72f845a

Download Submit
C:\Users\Admin\AppData\Roaming\43266f2abbf198\cred64.dll

Filesize
1.2MB

MD5
c6aabb27450f1a9939a417e86bf53217

SHA1
b8ef3bb7575139fd6997379415d7119e452b5fc4

SHA256
b91a3743c7399aee454491862e015ef6fc668a25d1aa2816e065a86a03f6be35

SHA512
e5fe205cb0f419e0a320488d6fa4a70e5ed58f25b570b41412ebd4f32bbe504ff75acb20bfea22513102630cf653a41e5090051f20af2ed3aadb53ce16a05944

Download Submit
C:\Users\Admin\AppData\Roaming\services.exe

Filesize
40KB

MD5
d7b2262e1936af8d821a0ac9aa0d2a4e

SHA1
40a4f0fcc20ba786eed36a55a472fa4629c2843e

SHA256
02c00cbbcc461361703152b37761e53eed43546879da166c6d53cce6f49cec48

SHA512
b7cac22c8d09fc3fab9909fe8955f2d464adc7dc23c14f142da5be3ab892c019f9ab0f4631edddc4612743d1e76ff8d666e8011867fe42c81c8ac2e8227140b0

Download Submit
C:\Users\Admin\AppData\Roaming\windows.exe

Filesize
95KB

MD5
34f1172b124be266b5189a98d7ba6fcd

SHA1
8f0be9a995de173420e00a1b38461fc875215c90

SHA256
7f2288ebe5d4a3ef29e2c1c2a385d9cf92d1891a4a0311236ae1bcda8d8f15ab

SHA512
6d719e0d6c44604439ca97975f0e463b348c9ca324580e8c96b627110c4fafc72e94fc155464a280985da038e14d5da9b092133fc8915d17e3370cd48c66e4a9

Download Submit
memory/2420-24445-0x00000274C73A0000-0x00000274C73B2000-memory.dmp

Filesize
72KB

Download
memory/2420-24446-0x00000274C7380000-0x00000274C738A000-memory.dmp

Filesize
40KB

Download
memory/3516-45-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/3516-20-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/3516-31-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/3516-30-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/3516-23-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/3516-22-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/3516-21-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/3516-32-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/3516-16-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/4660-19-0x0000000000B91000-0x0000000000BF9000-memory.dmp

Filesize
416KB

Download
memory/4660-18-0x0000000000B90000-0x0000000000EB2000-memory.dmp

Filesize
3.1MB

Download
memory/4660-0-0x0000000000B90000-0x0000000000EB2000-memory.dmp

Filesize
3.1MB

Download
memory/4660-4-0x0000000000B90000-0x0000000000EB2000-memory.dmp

Filesize
3.1MB

Download
memory/4660-3-0x0000000000B90000-0x0000000000EB2000-memory.dmp

Filesize
3.1MB

Download
memory/4660-2-0x0000000000B91000-0x0000000000BF9000-memory.dmp

Filesize
416KB

Download
memory/4660-1-0x0000000077254000-0x0000000077256000-memory.dmp

Filesize
8KB

Download
memory/4664-238-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-206-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-220-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-218-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-216-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-214-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-212-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-179-0x000002D64D260000-0x000002D64D261000-memory.dmp

Filesize
4KB

Download
memory/4664-224-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-226-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-210-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-180-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-228-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-182-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-230-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-184-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-208-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-222-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-186-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-188-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-204-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-202-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-200-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-196-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-194-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-198-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-240-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-236-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-190-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-192-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-232-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/4664-234-0x000002D64D270000-0x000002D64D271000-memory.dmp

Filesize
4KB

Download
memory/5380-1517-0x0000000005010000-0x0000000005128000-memory.dmp

Filesize
1.1MB

Download
memory/5380-2696-0x0000000005240000-0x00000000052CA000-memory.dmp

Filesize
552KB

Download
memory/5380-2697-0x00000000051E0000-0x000000000522C000-memory.dmp

Filesize
304KB

Download
memory/5380-1516-0x0000000004D20000-0x0000000004E38000-memory.dmp

Filesize
1.1MB

Download
memory/5380-1515-0x0000000000440000-0x000000000056C000-memory.dmp

Filesize
1.2MB

Download
memory/5380-22938-0x0000000005C20000-0x00000000061C4000-memory.dmp

Filesize
5.6MB

Download
memory/5380-22939-0x00000000054C0000-0x0000000005514000-memory.dmp

Filesize
336KB

Download
memory/10940-25821-0x0000000000CA0000-0x0000000000CCA000-memory.dmp

Filesize
168KB

Download
memory/13352-22797-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/13352-22198-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/14128-24395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/15396-24273-0x0000000000540000-0x0000000000E93000-memory.dmp

Filesize
9.3MB

Download
memory/15396-24263-0x0000000000540000-0x0000000000E93000-memory.dmp

Filesize
9.3MB

Download
memory/16496-24252-0x0000000005C90000-0x0000000005DDA000-memory.dmp

Filesize
1.3MB

Download
memory/16496-22807-0x00000000059B0000-0x0000000005A4C000-memory.dmp

Filesize
624KB

Download
memory/16496-22806-0x0000000000E70000-0x0000000001086000-memory.dmp

Filesize
2.1MB

Download
memory/16496-24253-0x00000000058A0000-0x00000000058C2000-memory.dmp

Filesize
136KB

Download
memory/17648-22847-0x000001EEE3630000-0x000001EEE3652000-memory.dmp

Filesize
136KB

Download
memory/20416-22882-0x000001DE823A0000-0x000001DE823A8000-memory.dmp

Filesize
32KB

Download
memory/20672-26083-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/20672-26081-0x0000000000B20000-0x0000000000E42000-memory.dmp

Filesize
3.1MB

Download
memory/22456-26087-0x00007FF64DF60000-0x00007FF64E3F0000-memory.dmp

Filesize
4.6MB

Download
memory/22456-26101-0x00007FF64DF60000-0x00007FF64E3F0000-memory.dmp

Filesize
4.6MB

Download
memory/25584-24187-0x0000000000A30000-0x0000000000A42000-memory.dmp

Filesize
72KB

Download
memory/26628-24206-0x0000000000920000-0x00000000009D6000-memory.dmp

Filesize
728KB

Download
memory/26716-24152-0x0000000000680000-0x00000000006D2000-memory.dmp

Filesize
328KB

Download
memory/26716-24468-0x0000000006D40000-0x0000000006F02000-memory.dmp

Filesize
1.8MB

Download
memory/26716-24153-0x0000000004F90000-0x0000000005022000-memory.dmp

Filesize
584KB

Download
memory/26716-24154-0x0000000005140000-0x000000000514A000-memory.dmp

Filesize
40KB

Download
memory/26716-24155-0x00000000061D0000-0x00000000067E8000-memory.dmp

Filesize
6.1MB

Download
memory/26716-24156-0x0000000005300000-0x000000000540A000-memory.dmp

Filesize
1.0MB

Download
memory/26716-24157-0x0000000005230000-0x0000000005242000-memory.dmp

Filesize
72KB

Download
memory/26716-24158-0x0000000005290000-0x00000000052CC000-memory.dmp

Filesize
240KB

Download
memory/26716-24159-0x0000000005410000-0x000000000545C000-memory.dmp

Filesize
304KB

Download
memory/26716-24193-0x0000000005590000-0x00000000055F6000-memory.dmp

Filesize
408KB

Download
memory/26716-24469-0x0000000007C50000-0x000000000817C000-memory.dmp

Filesize
5.2MB

Download
memory/26716-24194-0x0000000006940000-0x0000000006990000-memory.dmp

Filesize
320KB

Download
memory/26844-25910-0x0000000007080000-0x00000000070F6000-memory.dmp

Filesize
472KB

Download
memory/26844-25911-0x00000000073E0000-0x00000000073FE000-memory.dmp

Filesize
120KB

Download
memory/26844-25843-0x00000000058E0000-0x000000000592C000-memory.dmp

Filesize
304KB

Download
memory/26844-25842-0x0000000000FA0000-0x0000000000FBE000-memory.dmp

Filesize
120KB

Download
memory/27320-25840-0x0000000000F80000-0x0000000000F90000-memory.dmp

Filesize
64KB

Download
memory/29052-24625-0x0000000005160000-0x0000000005248000-memory.dmp

Filesize
928KB

Download
memory/29052-24620-0x00000000006F0000-0x00000000007EA000-memory.dmp

Filesize
1000KB

Download
memory/29052-24623-0x0000000005070000-0x0000000005156000-memory.dmp

Filesize
920KB

Download
memory/29052-25802-0x00000000053E0000-0x0000000005438000-memory.dmp

Filesize
352KB

Download
memory/29548-24528-0x00007FF73C8B0000-0x00007FF73CD40000-memory.dmp

Filesize
4.6MB

Download
memory/29548-24531-0x00007FF73C8B0000-0x00007FF73CD40000-memory.dmp

Filesize
4.6MB

Download