Overview

overview

10

Static

static

3

09bae49e2d...94.exe

windows7-x64

10

09bae49e2d...94.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2024, 02:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    09bae49e2d08d3316490b621a37fa44ec46eb894133664fffb2b6202e7364c94.exe
  • Size 2.8MB
  • Sample241219-cle11sslg1
  • SHA256 09bae49e2d08d3316490b621a37fa44ec46eb894133664fffb2b6202e7364c94
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeycryptbotlummastealc9c9aa5fed3aastokcredential_accessdiscoveryevasionexecutionpersistenceprivilege_escalationspywarestealertrojanupx

Malware Config

Extracted

Family

  • amadey

Version

  • 4.42

Botnet

  • 9c9aa5

C2

  • http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

  • lumma

Extracted

Family

  • amadey

Version

  • 4.41

Botnet

  • fed3aa

C2

  • http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

  • stealc

Botnet

  • stok

C2

  • http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

  • cryptbot

C2

  • http://home.fivetk5vt.top/hLfzXsaqNtoEGyaUtOMJ1734

Extracted

Family

  • lumma

C2

  • https://shineugler.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 19 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Checks BIOS information in registry 2 TTPs 38 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 52 IoCs
  • Identifies Wine through registry keys 2 TTPs 19 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 56 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 22 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 63 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2648
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2744
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:5032
    • C:\Users\Admin\AppData\Local\Temp\09bae49e2d08d3316490b621a37fa44ec46eb894133664fffb2b6202e7364c94.exe
      "C:\Users\Admin\AppData\Local\Temp\09bae49e2d08d3316490b621a37fa44ec46eb894133664fffb2b6202e7364c94.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3896
      • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
        "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3160
        • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
          "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
            "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
            4⤵
            • Executes dropped EXE
            PID:4520
          • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
            "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4392
        • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
          "C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:972
          • C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
            "C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2920
            • C:\Users\Admin\AppData\Local\Temp\is-33UVR.tmp\NordVPNSetup.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-33UVR.tmp\NordVPNSetup.tmp" /SL5="$D0056,15409387,73728,C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:2296
              • C:\Windows\system32\rundll32.exe
                "rundll32.exe " SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
                6⤵
                • Drops file in Drivers directory
                • Adds Run key to start application
                PID:1548
                • C:\Windows\system32\runonce.exe
                  "C:\Windows\system32\runonce.exe" -r
                  7⤵
                  • Checks processor information in registry
                  PID:5008
                  • C:\Windows\System32\grpconv.exe
                    "C:\Windows\System32\grpconv.exe" -o
                    8⤵
                      PID:1036
                • C:\Windows\system32\regsvr32.exe
                  "regsvr32" "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll" /s
                  6⤵
                  • Loads dropped DLL
                  • Modifies system executable filetype association
                  • Modifies registry class
                  PID:1168
                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
                  "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4784
                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                  "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2720
                • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                  "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1160
          • C:\Users\Admin\AppData\Local\Temp\1016974001\883b525fa1.exe
            "C:\Users\Admin\AppData\Local\Temp\1016974001\883b525fa1.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3168
            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
              "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4344
              • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
                "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4976
                • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
                  "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2396
              • C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
                "C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1232
                • C:\Users\Admin\AppData\Local\Temp\onefile_1232_133790478757522716\trunk.exe
                  C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4008
              • C:\Users\Admin\AppData\Local\Temp\1007328001\b9a28c5bec.exe
                "C:\Users\Admin\AppData\Local\Temp\1007328001\b9a28c5bec.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2104
              • C:\Users\Admin\AppData\Local\Temp\1007329001\e3b14d7638.exe
                "C:\Users\Admin\AppData\Local\Temp\1007329001\e3b14d7638.exe"
                5⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4688
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 536
                  6⤵
                  • Program crash
                  PID:3180
              • C:\Users\Admin\AppData\Local\Temp\1007330001\e33b6ffce7.exe
                "C:\Users\Admin\AppData\Local\Temp\1007330001\e33b6ffce7.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:3164
              • C:\Users\Admin\AppData\Local\Temp\1007331001\f5467b8760.exe
                "C:\Users\Admin\AppData\Local\Temp\1007331001\f5467b8760.exe"
                5⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:4872
          • C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
            "C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1884
          • C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
            "C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3012
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\yrqii"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:712
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4212
            • C:\yrqii\b94436bd4d674c0f84526489dfa06b11.exe
              "C:\yrqii\b94436bd4d674c0f84526489dfa06b11.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:976
          • C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
            "C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4024
          • C:\Users\Admin\AppData\Local\Temp\1017253001\83bd6e6b5a.exe
            "C:\Users\Admin\AppData\Local\Temp\1017253001\83bd6e6b5a.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3120
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
              4⤵
                PID:3676
                • C:\Windows\system32\mode.com
                  mode 65,10
                  5⤵
                    PID:1972
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1756
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_7.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4704
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_6.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3880
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_5.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4600
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_4.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5112
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_3.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3660
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_2.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3440
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_1.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4120
                  • C:\Windows\system32\attrib.exe
                    attrib +H "in.exe"
                    5⤵
                    • Views/modifies file attributes
                    PID:3360
                  • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                    "in.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:4036
                    • C:\Windows\SYSTEM32\attrib.exe
                      attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      6⤵
                      • Views/modifies file attributes
                      PID:5072
                    • C:\Windows\SYSTEM32\attrib.exe
                      attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      6⤵
                      • Views/modifies file attributes
                      PID:4388
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                      6⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:2440
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell ping 127.0.0.1; del in.exe
                      6⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2552
                      • C:\Windows\system32\PING.EXE
                        "C:\Windows\system32\PING.EXE" 127.0.0.1
                        7⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:2720
              • C:\Users\Admin\AppData\Local\Temp\1017254001\e3b14d7638.exe
                "C:\Users\Admin\AppData\Local\Temp\1017254001\e3b14d7638.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:1424
              • C:\Users\Admin\AppData\Local\Temp\1017255001\167702a417.exe
                "C:\Users\Admin\AppData\Local\Temp\1017255001\167702a417.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:1560
              • C:\Users\Admin\AppData\Local\Temp\1017256001\62a602801c.exe
                "C:\Users\Admin\AppData\Local\Temp\1017256001\62a602801c.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:3136
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\sskxb"
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1928
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3592
                • C:\sskxb\dec60d98cd5d401298ea9666816a0269.exe
                  "C:\sskxb\dec60d98cd5d401298ea9666816a0269.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of SetWindowsHookEx
                  PID:2840
              • C:\Users\Admin\AppData\Local\Temp\1017257001\b31c402173.exe
                "C:\Users\Admin\AppData\Local\Temp\1017257001\b31c402173.exe"
                3⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:4024
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 464
                  4⤵
                  • Program crash
                  PID:2680
              • C:\Users\Admin\AppData\Local\Temp\1017258001\dca1c63251.exe
                "C:\Users\Admin\AppData\Local\Temp\1017258001\dca1c63251.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:3488
                • C:\Users\Admin\AppData\Local\Temp\1017258001\dca1c63251.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017258001\dca1c63251.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3216
              • C:\Users\Admin\AppData\Local\Temp\1017259001\9ac196ab8b.exe
                "C:\Users\Admin\AppData\Local\Temp\1017259001\9ac196ab8b.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4408
              • C:\Users\Admin\AppData\Local\Temp\1017260001\38c3b0c8af.exe
                "C:\Users\Admin\AppData\Local\Temp\1017260001\38c3b0c8af.exe"
                3⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                PID:3696
              • C:\Users\Admin\AppData\Local\Temp\1017261001\543b7c1799.exe
                "C:\Users\Admin\AppData\Local\Temp\1017261001\543b7c1799.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2068
                • C:\Users\Admin\AppData\Local\Temp\1017261001\543b7c1799.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017261001\543b7c1799.exe"
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3096
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:3332
          • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
            C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:792
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:4340
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4688 -ip 4688
            1⤵
              PID:2104
            • C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe
              C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding
              1⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4908
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4024 -ip 4024
              1⤵
                PID:2932
              • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:4688
              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:1948
              • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3256
                • C:\Windows\explorer.exe
                  explorer.exe
                  2⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1920
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                  2⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1924
                  • C:\Windows\system32\PING.EXE
                    "C:\Windows\system32\PING.EXE" 127.1.10.1
                    3⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:116

              Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Event Triggered Execution

                    2
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Event Triggered Execution

                    2
                    T1546

                    Change Default File Association

                    1
                    T1546.001

                    Component Object Model Hijacking

                    1
                    T1546.015

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Hide Artifacts

                    1
                    T1564

                    Hidden Files and Directories

                    1
                    T1564.001

                    Modify Registry

                    2
                    T1112

                    Virtualization/Sandbox Evasion

                    3
                    T1497

                    Credential Access

                    Credentials from Password Stores

                    2
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Windows Credential Manager

                    1
                    T1555.004

                    Unsecured Credentials

                    4
                    T1552

                    Credentials In Files

                    4
                    T1552.001

                    Discovery

                    Browser Information Discovery

                    1
                    T1217

                    Query Registry

                    9
                    T1012

                    Remote System Discovery

                    1
                    T1018

                    System Information Discovery

                    5
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Virtualization/Sandbox Evasion

                    3
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    3
                    T1005

                    Command and Control

                    Web Service

                    1
                    T1102

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    RevoUninPro.exe
                    • Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                    • Size 24.2MB
                    • SHA256 f680e0fe00a48f6e3d079c1572682d6664f476b119745d73cb852baba58cc683
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Cq6Id6x.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Cq6Id6x.exe.log
                    • Size 617B
                    • SHA256 40c98b01052cd95102701b71b4fbe0eda48537435898c413239f5f888a614253
                    • MD5 SHA1 SHA512
                    Submit Download

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                    • Size 2KB
                    • SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 18KB
                    • SHA256 4eb8ba2a46515040641247a022d63eccf835fdea491d7aa7e32376c325a010a4
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Out.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
                    • Size 2.5MB
                    • SHA256 b6d6628d2dc7dea808eef05180c27abe10a1af245d624aacdacccc52a1eb7b40
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    trunk.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1007054001\trunk.exe
                    • Size 10.2MB
                    • SHA256 786f1331a0618485b31ba763911b14fcec691bf9897bee8f42680076092b7a2f
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    b9a28c5bec.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1007328001\b9a28c5bec.exe
                    • Size 2.8MB
                    • SHA256 f1fa0545bde183d84cb9b24d6635ffb5ab98bd398659e92adcbb5dc90064531d
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    e3b14d7638.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1007329001\e3b14d7638.exe
                    • Size 1.9MB
                    • SHA256 10b27d9cb387fa4ac371de8767d5204925ca4da9c490ea8e2491b1a60c49fd85
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    e33b6ffce7.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1007330001\e33b6ffce7.exe
                    • Size 2.8MB
                    • SHA256 f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    f5467b8760.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1007331001\f5467b8760.exe
                    • Size 4.3MB
                    • SHA256 dc645ba585c2d41ec553cefd46bd3dab212882cb07097905f9ed071e8882b161
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Cq6Id6x.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
                    • Size 3.1MB
                    • SHA256 5688e9e0becc622c573af2a1af4ee0676ef3907e38a9258a7801b46b7ad64665
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    x0qQ2DH.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
                    • Size 17.6MB
                    • SHA256 64cc7f7906fe1ebf0b6977892abd9aa36f5e525cb241964c3986ee9e1a18312d
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    883b525fa1.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1016974001\883b525fa1.exe
                    • Size 2.8MB
                    • SHA256 ba265a9b0c7cd5c04311a2c739fb40e0f01690bc82a4625c33e42f1388789589
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    VR6f3vF.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
                    • Size 1.8MB
                    • SHA256 e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    kf5cl0F.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
                    • Size 21KB
                    • SHA256 7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    ANEDNjf.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
                    • Size 1.8MB
                    • SHA256 552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    83bd6e6b5a.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1017253001\83bd6e6b5a.exe
                    • Size 4.2MB
                    • SHA256 ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    167702a417.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1017255001\167702a417.exe
                    • Size 4.3MB
                    • SHA256 0200c5657794ccc0916aae772004b7f72a793b77dc807b51b2f88e597813f611
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    dca1c63251.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1017258001\dca1c63251.exe
                    • Size 747KB
                    • SHA256 3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    9ac196ab8b.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1017259001\9ac196ab8b.exe
                    • Size 3.1MB
                    • SHA256 12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    543b7c1799.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1017261001\543b7c1799.exe
                    • Size 758KB
                    • SHA256 c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    NordVPNSetup.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
                    • Size 15.0MB
                    • SHA256 e4561ffd0993938234d207ce56d5fe775c4ddb704f7be63003026d43eae0a337
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    VCRUNTIME140_1.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\VCRUNTIME140_1.dll
                    • Size 48KB
                    • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    _socket.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
                    • Size 81KB
                    • SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    __PSScriptPolicyTest_sg5p3app.rts.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sg5p3app.rts.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512
                    Submit Download

                    skotes.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                    • Size 2.8MB
                    • SHA256 09bae49e2d08d3316490b621a37fa44ec46eb894133664fffb2b6202e7364c94
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    NordVPNSetup.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\is-33UVR.tmp\NordVPNSetup.tmp
                    • Size 920KB
                    • SHA256 5bd02d57433581efc6e14f6aefa4d1b5a52051f2ca269bde439b50658fa0bc39
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    _RegDLL.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\is-F37IS.tmp\_isetup\_RegDLL.tmp
                    • Size 4KB
                    • SHA256 4dc09bac0613590f1fac8771d18af5be25a1e1cb8fdbf4031aa364f3057e74a2
                    • MD5 SHA1 SHA512
                    Submit Download

                    _setup64.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\is-F37IS.tmp\_isetup\_setup64.tmp
                    • Size 6KB
                    • SHA256 a4c86fc4836ac728d7bd96e7915090fd59521a9e74f1d06ef8e5a47c8695fd81
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    _shfoldr.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\is-F37IS.tmp\_isetup\_shfoldr.dll
                    • Size 22KB
                    • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    b2p.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\is-F37IS.tmp\b2p.dll
                    • Size 22KB
                    • SHA256 c3729545522fcff70db61046c0efd962df047d40e3b5ccd2272866540fc872b2
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    botva2.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\is-F37IS.tmp\botva2.dll
                    • Size 37KB
                    • SHA256 450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    iswin7logo.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\is-F37IS.tmp\iswin7logo.dll
                    • Size 39KB
                    • SHA256 30eb67bdd71d3a359819a72990029269672d52f597a2d1084d838caae91a6488
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    7z.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    • Size 458KB
                    • SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    VCRUNTIME140.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1232_133790478757522716\VCRUNTIME140.dll
                    • Size 116KB
                    • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    _ssl.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1232_133790478757522716\_ssl.pyd
                    • Size 174KB
                    • SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    _wmi.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1232_133790478757522716\_wmi.pyd
                    • Size 36KB
                    • SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    libcrypto-3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1232_133790478757522716\libcrypto-3.dll
                    • Size 5.0MB
                    • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    libssl-3.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1232_133790478757522716\libssl-3.dll
                    • Size 774KB
                    • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    python312.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1232_133790478757522716\python312.dll
                    • Size 6.6MB
                    • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    select.pyd
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1232_133790478757522716\select.pyd
                    • Size 30KB
                    • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    trunk.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\onefile_1232_133790478757522716\trunk.exe
                    • Size 18.0MB
                    • SHA256 ee045dffee8b48356106a2105803b73776b73bf7462d364b1f82540fcf72f4cf
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    revoflt.sys
                    • Path C:\Windows\System32\drivers\revoflt.sys
                    • Size 37KB
                    • SHA256 25667717bf4691957f07a6363585e2c7eaf22e5fd7229bf32c91ea59ef4a2edd
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    b94436bd4d674c0f84526489dfa06b11.exe
                    • Path C:\yrqii\b94436bd4d674c0f84526489dfa06b11.exe
                    • Size 1.2MB
                    • SHA256 139762e396fb930400fab8faab80cb679abbe642144261cba24973fb23bcd728
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    memory/712-294-0x0000000005450000-0x00000000054B6000-memory.dmp
                    Download

                    memory/712-292-0x0000000004AC0000-0x0000000004AE2000-memory.dmp
                    Download

                    memory/712-318-0x0000000006A20000-0x0000000006A3E000-memory.dmp
                    Download

                    memory/712-307-0x0000000006030000-0x0000000006062000-memory.dmp
                    Download

                    memory/712-308-0x000000006EA90000-0x000000006EADC000-memory.dmp
                    Download

                    memory/712-306-0x0000000005AA0000-0x0000000005AEC000-memory.dmp
                    Download

                    memory/712-305-0x0000000005A60000-0x0000000005A7E000-memory.dmp
                    Download

                    memory/712-304-0x00000000055C0000-0x0000000005914000-memory.dmp
                    Download

                    memory/712-326-0x0000000006FD0000-0x0000000006FE4000-memory.dmp
                    Download

                    memory/712-321-0x0000000006D90000-0x0000000006DAA000-memory.dmp
                    Download

                    memory/712-293-0x00000000053E0000-0x0000000005446000-memory.dmp
                    Download

                    memory/712-319-0x0000000006A50000-0x0000000006AF3000-memory.dmp
                    Download

                    memory/712-290-0x0000000004D40000-0x0000000005368000-memory.dmp
                    Download

                    memory/712-325-0x0000000006FC0000-0x0000000006FCE000-memory.dmp
                    Download

                    memory/712-289-0x0000000002130000-0x0000000002166000-memory.dmp
                    Download

                    memory/712-327-0x00000000070D0000-0x00000000070EA000-memory.dmp
                    Download

                    memory/712-328-0x00000000070B0000-0x00000000070B8000-memory.dmp
                    Download

                    memory/712-324-0x0000000006F90000-0x0000000006FA1000-memory.dmp
                    Download

                    memory/712-320-0x00000000073D0000-0x0000000007A4A000-memory.dmp
                    Download

                    memory/712-322-0x0000000006E00000-0x0000000006E0A000-memory.dmp
                    Download

                    memory/712-323-0x0000000007010000-0x00000000070A6000-memory.dmp
                    Download

                    memory/792-222-0x00000000000F0000-0x0000000000400000-memory.dmp
                    Download

                    memory/792-244-0x00000000000F0000-0x0000000000400000-memory.dmp
                    Download

                    memory/972-116-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-111-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-156-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-155-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-95-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-100-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-99-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-94-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-171-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-169-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-98-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-97-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-193-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-190-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-206-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-101-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-96-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-85-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-157-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-109-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-112-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-125-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-114-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-113-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-110-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-108-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-118-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/972-119-0x0000000000400000-0x000000000064F000-memory.dmp
                    Download

                    memory/976-394-0x00000000006D0000-0x0000000000A8B000-memory.dmp
                    Download

                    memory/976-637-0x00000000006D0000-0x0000000000A8B000-memory.dmp
                    Download

                    memory/1424-779-0x0000000000320000-0x00000000007C6000-memory.dmp
                    Download

                    memory/1424-814-0x0000000000320000-0x00000000007C6000-memory.dmp
                    Download

                    memory/1560-833-0x0000000000DA0000-0x0000000001985000-memory.dmp
                    Download

                    memory/1560-831-0x0000000000DA0000-0x0000000001985000-memory.dmp
                    Download

                    memory/1884-262-0x0000000000D10000-0x00000000011B6000-memory.dmp
                    Download

                    memory/1884-382-0x0000000000D10000-0x00000000011B6000-memory.dmp
                    Download

                    memory/1884-362-0x0000000000D10000-0x00000000011B6000-memory.dmp
                    Download

                    memory/1928-883-0x000000006F310000-0x000000006F35C000-memory.dmp
                    Download

                    memory/1928-878-0x0000000005B60000-0x0000000005EB4000-memory.dmp
                    Download

                    memory/1928-908-0x0000000007500000-0x0000000007514000-memory.dmp
                    Download

                    memory/1928-906-0x00000000074C0000-0x00000000074D1000-memory.dmp
                    Download

                    memory/1928-879-0x0000000006030000-0x000000000607C000-memory.dmp
                    Download

                    memory/1928-893-0x00000000071B0000-0x0000000007253000-memory.dmp
                    Download

                    memory/2104-663-0x0000000000E50000-0x0000000001352000-memory.dmp
                    Download

                    memory/2104-665-0x0000000000E50000-0x0000000001352000-memory.dmp
                    Download

                    memory/2296-164-0x00000000071D0000-0x00000000071DF000-memory.dmp
                    Download

                    memory/2296-160-0x0000000072CF0000-0x0000000072D01000-memory.dmp
                    Download

                    memory/2296-138-0x0000000073040000-0x000000007305B000-memory.dmp
                    Download

                    memory/2552-727-0x0000020A48420000-0x0000020A48442000-memory.dmp
                    Download

                    memory/2920-104-0x0000000000400000-0x0000000000419000-memory.dmp
                    Download

                    memory/3012-287-0x0000000000380000-0x000000000038C000-memory.dmp
                    Download

                    memory/3160-19-0x0000000000E11000-0x0000000000E3F000-memory.dmp
                    Download

                    memory/3160-69-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-24-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-18-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-20-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-21-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-57-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-22-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-25-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-26-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-56-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-23-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-53-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-67-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3160-68-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3164-795-0x00000000003B0000-0x00000000006C2000-memory.dmp
                    Download

                    memory/3164-793-0x00000000003B0000-0x00000000006C2000-memory.dmp
                    Download

                    memory/3168-187-0x0000000000D80000-0x0000000001090000-memory.dmp
                    Download

                    memory/3168-217-0x0000000000D80000-0x0000000001090000-memory.dmp
                    Download

                    memory/3332-52-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3332-51-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/3592-915-0x00000000057C0000-0x0000000005B14000-memory.dmp
                    Download

                    memory/3896-0-0x0000000000500000-0x000000000080F000-memory.dmp
                    Download

                    memory/3896-3-0x0000000000500000-0x000000000080F000-memory.dmp
                    Download

                    memory/3896-2-0x0000000000501000-0x000000000052F000-memory.dmp
                    Download

                    memory/3896-4-0x0000000000500000-0x000000000080F000-memory.dmp
                    Download

                    memory/3896-17-0x0000000000500000-0x000000000080F000-memory.dmp
                    Download

                    memory/3896-1-0x0000000077504000-0x0000000077506000-memory.dmp
                    Download

                    memory/4024-907-0x0000000000580000-0x0000000000A42000-memory.dmp
                    Download

                    memory/4024-616-0x0000000000570000-0x0000000000A1B000-memory.dmp
                    Download

                    memory/4024-378-0x0000000000570000-0x0000000000A1B000-memory.dmp
                    Download

                    memory/4024-645-0x0000000000570000-0x0000000000A1B000-memory.dmp
                    Download

                    memory/4024-868-0x0000000000580000-0x0000000000A42000-memory.dmp
                    Download

                    memory/4036-715-0x00007FF79E890000-0x00007FF79ED20000-memory.dmp
                    Download

                    memory/4036-717-0x00007FF79E890000-0x00007FF79ED20000-memory.dmp
                    Download

                    memory/4212-347-0x0000000073970000-0x00000000739BC000-memory.dmp
                    Download

                    memory/4212-358-0x0000000007440000-0x0000000007451000-memory.dmp
                    Download

                    memory/4212-346-0x0000000006410000-0x000000000645C000-memory.dmp
                    Download

                    memory/4212-334-0x0000000005870000-0x0000000005BC4000-memory.dmp
                    Download

                    memory/4212-359-0x0000000007480000-0x0000000007494000-memory.dmp
                    Download

                    memory/4340-224-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/4340-234-0x0000000000E10000-0x000000000111F000-memory.dmp
                    Download

                    memory/4344-288-0x00000000000F0000-0x0000000000400000-memory.dmp
                    Download

                    memory/4344-220-0x00000000000F0000-0x0000000000400000-memory.dmp
                    Download

                    memory/4392-65-0x0000000000400000-0x0000000000456000-memory.dmp
                    Download

                    memory/4392-62-0x0000000000400000-0x0000000000456000-memory.dmp
                    Download

                    memory/4444-45-0x000000007311E000-0x000000007311F000-memory.dmp
                    Download

                    memory/4444-46-0x0000000000030000-0x0000000000350000-memory.dmp
                    Download

                    memory/4444-54-0x000000007311E000-0x000000007311F000-memory.dmp
                    Download

                    memory/4444-58-0x0000000004F80000-0x00000000050D6000-memory.dmp
                    Download

                    memory/4444-66-0x0000000073110000-0x00000000738C0000-memory.dmp
                    Download

                    memory/4444-49-0x0000000073110000-0x00000000738C0000-memory.dmp
                    Download

                    memory/4444-55-0x0000000073110000-0x00000000738C0000-memory.dmp
                    Download

                    memory/4444-59-0x0000000005680000-0x0000000005C24000-memory.dmp
                    Download

                    memory/4444-47-0x0000000004C50000-0x0000000004CEC000-memory.dmp
                    Download

                    memory/4444-60-0x0000000004B30000-0x0000000004B52000-memory.dmp
                    Download

                    memory/4444-48-0x0000000073110000-0x00000000738C0000-memory.dmp
                    Download

                    memory/4688-749-0x0000000000D90000-0x0000000001252000-memory.dmp
                    Download

                    memory/4688-726-0x0000000000D90000-0x0000000001252000-memory.dmp
                    Download

                    memory/4872-811-0x00000000006D0000-0x0000000001231000-memory.dmp
                    Download

                    memory/4872-882-0x00000000006D0000-0x0000000001231000-memory.dmp
                    Download

                    memory/4872-835-0x00000000006D0000-0x0000000001231000-memory.dmp
                    Download