amadey | 446999d49a6900e5753695ac8582e9eaef812acee88fd908d857073e8e200b8d

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-12-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
Size

3.0MB
MD5

7dc7a8d2e9d44cae10b9b55b65585ddc
SHA1

3e78d38a9ce837926831ea27a0efb1a262877334
SHA256

efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0
SHA512

e33388557fcea27a9d5be98eb2dc308be8d5d8d3afcb0e27d8834a96c95ba41f97c47f59de8227fd13667e8692e9063162b1d60a84161f57e4f8905f6d6483fe
SSDEEP

49152:kp41N/sSySDz5y6RK5swYTz42X2GPc6mz1:K2spSDz5PK51YTEU21fz

Score

10^/10

amadey cryptbot gcleaner lumma 9c9aa5 discovery evasion loader persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

https://pollution-raker.cyou/api

https://hosue-billowy.cyou/api

https://ripe-blade.cyou/api

https://smash-boiling.cyou/api

https://supporse-comment.cyou/api

https://greywe-snotty.cyou/api

https://steppriflej.xyz/api

https://sendypaster.xyz/api

Extracted

Family

cryptbot

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	e35f834a42.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4159d61421.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e35f834a42.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	42830f0675.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	addd5b77f7.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e35f834a42.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e35f834a42.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	42830f0675.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	42830f0675.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	addd5b77f7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4159d61421.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4159d61421.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	addd5b77f7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe

Executes dropped EXE 13 IoCs

pid	Process
2736	skotes.exe
1260	4a622b9e46.exe
1308	Laptops.com
3028	108e1fe190.exe
1756	213588b34a.exe
1940	graph.exe
772	932f2bc0ea.exe
308	c376aea6c6.exe
2932	Sale.com
2016	4159d61421.exe
2248	e35f834a42.exe
2348	42830f0675.exe
1700	addd5b77f7.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	4159d61421.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	e35f834a42.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	42830f0675.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	addd5b77f7.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Wine	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe

Loads dropped DLL 19 IoCs

pid	Process
2096	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
2736	skotes.exe
1260	4a622b9e46.exe
1680	cmd.exe
2736	skotes.exe
2736	skotes.exe
3028	108e1fe190.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
308	c376aea6c6.exe
1664	cmd.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2736	skotes.exe
2348	42830f0675.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Graph = "C:\\Program Files\\Windows Media Player\\graph\\graph.exe"	108e1fe190.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
8	drive.google.com
9	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
18	ipinfo.io
19	ipinfo.io

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
532	tasklist.exe
1228	tasklist.exe
2400	tasklist.exe
1824	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2096	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
2736	skotes.exe
2016	4159d61421.exe
2248	e35f834a42.exe
2348	42830f0675.exe
1700	addd5b77f7.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	108e1fe190.exe
File created	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	108e1fe190.exe
File created	C:\Program Files\Windows Media Player\graph\graph.exe	108e1fe190.exe
File opened for modification	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip	108e1fe190.exe
File opened for modification	C:\Program Files\Windows Media Player\1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f	108e1fe190.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\EmiratesHeads	4a622b9e46.exe
File opened for modification	C:\Windows\RingsAnything	4a622b9e46.exe
File opened for modification	C:\Windows\SimsCoastal	4a622b9e46.exe
File opened for modification	C:\Windows\GradVitamins	c376aea6c6.exe
File opened for modification	C:\Windows\OmissionsEmerald	c376aea6c6.exe
File opened for modification	C:\Windows\BaconTicket	c376aea6c6.exe
File opened for modification	C:\Windows\BuildAid	4a622b9e46.exe
File opened for modification	C:\Windows\BuzzDisorders	4a622b9e46.exe
File opened for modification	C:\Windows\FarmingDesignation	c376aea6c6.exe
File opened for modification	C:\Windows\RenewableProgramme	c376aea6c6.exe
File opened for modification	C:\Windows\SodiumLegend	c376aea6c6.exe
File created	C:\Windows\Tasks\skotes.job	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
File opened for modification	C:\Windows\YuBad	4a622b9e46.exe
File opened for modification	C:\Windows\CouplesWizard	4a622b9e46.exe
File opened for modification	C:\Windows\KrugerPowers	c376aea6c6.exe
File opened for modification	C:\Windows\ScienceCom	c376aea6c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Laptops.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42830f0675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4159d61421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4a622b9e46.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c376aea6c6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sale.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e35f834a42.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	108e1fe190.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	108e1fe190.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Laptops.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Laptops.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Laptops.com
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Sale.com
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Sale.com

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2096	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
2736	skotes.exe
1308	Laptops.com
1308	Laptops.com
1308	Laptops.com
3028	108e1fe190.exe
3028	108e1fe190.exe
3028	108e1fe190.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
2932	Sale.com
2932	Sale.com
2932	Sale.com
1940	graph.exe
1940	graph.exe
1940	graph.exe
2016	4159d61421.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
2248	e35f834a42.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
2248	e35f834a42.exe
2248	e35f834a42.exe
2248	e35f834a42.exe
2248	e35f834a42.exe
2248	e35f834a42.exe
2348	42830f0675.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1700	addd5b77f7.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe
1940	graph.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	532	tasklist.exe
Token: SeDebugPrivilege	1228	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	1824	tasklist.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2096	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
1308	Laptops.com
1308	Laptops.com
1308	Laptops.com
2932	Sale.com
2932	Sale.com
2932	Sale.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1308	Laptops.com
1308	Laptops.com
1308	Laptops.com
2932	Sale.com
2932	Sale.com
2932	Sale.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2736	2096	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe	30
PID 2096 wrote to memory of 2736	2096	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe	30
PID 2096 wrote to memory of 2736	2096	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe	30
PID 2096 wrote to memory of 2736	2096	efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe	30
PID 2736 wrote to memory of 1260	2736	skotes.exe	32
PID 2736 wrote to memory of 1260	2736	skotes.exe	32
PID 2736 wrote to memory of 1260	2736	skotes.exe	32
PID 2736 wrote to memory of 1260	2736	skotes.exe	32
PID 1260 wrote to memory of 1680	1260	4a622b9e46.exe	33
PID 1260 wrote to memory of 1680	1260	4a622b9e46.exe	33
PID 1260 wrote to memory of 1680	1260	4a622b9e46.exe	33
PID 1260 wrote to memory of 1680	1260	4a622b9e46.exe	33
PID 1680 wrote to memory of 532	1680	cmd.exe	35
PID 1680 wrote to memory of 532	1680	cmd.exe	35
PID 1680 wrote to memory of 532	1680	cmd.exe	35
PID 1680 wrote to memory of 532	1680	cmd.exe	35
PID 1680 wrote to memory of 320	1680	cmd.exe	36
PID 1680 wrote to memory of 320	1680	cmd.exe	36
PID 1680 wrote to memory of 320	1680	cmd.exe	36
PID 1680 wrote to memory of 320	1680	cmd.exe	36
PID 1680 wrote to memory of 1228	1680	cmd.exe	38
PID 1680 wrote to memory of 1228	1680	cmd.exe	38
PID 1680 wrote to memory of 1228	1680	cmd.exe	38
PID 1680 wrote to memory of 1228	1680	cmd.exe	38
PID 1680 wrote to memory of 1588	1680	cmd.exe	39
PID 1680 wrote to memory of 1588	1680	cmd.exe	39
PID 1680 wrote to memory of 1588	1680	cmd.exe	39
PID 1680 wrote to memory of 1588	1680	cmd.exe	39
PID 1680 wrote to memory of 3052	1680	cmd.exe	40
PID 1680 wrote to memory of 3052	1680	cmd.exe	40
PID 1680 wrote to memory of 3052	1680	cmd.exe	40
PID 1680 wrote to memory of 3052	1680	cmd.exe	40
PID 1680 wrote to memory of 2112	1680	cmd.exe	41
PID 1680 wrote to memory of 2112	1680	cmd.exe	41
PID 1680 wrote to memory of 2112	1680	cmd.exe	41
PID 1680 wrote to memory of 2112	1680	cmd.exe	41
PID 1680 wrote to memory of 2996	1680	cmd.exe	42
PID 1680 wrote to memory of 2996	1680	cmd.exe	42
PID 1680 wrote to memory of 2996	1680	cmd.exe	42
PID 1680 wrote to memory of 2996	1680	cmd.exe	42
PID 1680 wrote to memory of 1308	1680	cmd.exe	43
PID 1680 wrote to memory of 1308	1680	cmd.exe	43
PID 1680 wrote to memory of 1308	1680	cmd.exe	43
PID 1680 wrote to memory of 1308	1680	cmd.exe	43
PID 1680 wrote to memory of 748	1680	cmd.exe	44
PID 1680 wrote to memory of 748	1680	cmd.exe	44
PID 1680 wrote to memory of 748	1680	cmd.exe	44
PID 1680 wrote to memory of 748	1680	cmd.exe	44
PID 2736 wrote to memory of 3028	2736	skotes.exe	46
PID 2736 wrote to memory of 3028	2736	skotes.exe	46
PID 2736 wrote to memory of 3028	2736	skotes.exe	46
PID 2736 wrote to memory of 3028	2736	skotes.exe	46
PID 2736 wrote to memory of 1756	2736	skotes.exe	47
PID 2736 wrote to memory of 1756	2736	skotes.exe	47
PID 2736 wrote to memory of 1756	2736	skotes.exe	47
PID 2736 wrote to memory of 1756	2736	skotes.exe	47
PID 3028 wrote to memory of 1940	3028	108e1fe190.exe	49
PID 3028 wrote to memory of 1940	3028	108e1fe190.exe	49
PID 3028 wrote to memory of 1940	3028	108e1fe190.exe	49
PID 2736 wrote to memory of 772	2736	skotes.exe	50
PID 2736 wrote to memory of 772	2736	skotes.exe	50
PID 2736 wrote to memory of 772	2736	skotes.exe	50
PID 2736 wrote to memory of 772	2736	skotes.exe	50
PID 2736 wrote to memory of 308	2736	skotes.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe
"C:\Users\Admin\AppData\Local\Temp\efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\1020600001\4a622b9e46.exe
    "C:\Users\Admin\AppData\Local\Temp\1020600001\4a622b9e46.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Podcasts Podcasts.cmd & Podcasts.cmd
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1680
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:532
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:320
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1228
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 99123
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "follow" Traveller
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Sky + ..\Images + ..\Similarly + ..\Mp + ..\Investigators + ..\Accompanying + ..\Provincial J
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\99123\Laptops.com
        
        Laptops.com J
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1308
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:748
- - C:\Users\Admin\AppData\Local\Temp\1020601001\108e1fe190.exe
    "C:\Users\Admin\AppData\Local\Temp\1020601001\108e1fe190.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Program Files\Windows Media Player\graph\graph.exe
      "C:\Program Files\Windows Media Player\graph\graph.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1940
- - C:\Users\Admin\AppData\Local\Temp\1020602001\213588b34a.exe
    "C:\Users\Admin\AppData\Local\Temp\1020602001\213588b34a.exe"
    3⤵
    - Executes dropped EXE
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\1020603001\932f2bc0ea.exe
    "C:\Users\Admin\AppData\Local\Temp\1020603001\932f2bc0ea.exe"
    3⤵
    - Executes dropped EXE
    PID:772
- - C:\Users\Admin\AppData\Local\Temp\1020604001\c376aea6c6.exe
    "C:\Users\Admin\AppData\Local\Temp\1020604001\c376aea6c6.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:308
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1664
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1724
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 370821
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:788
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Anchor" Veterinary
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:820
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\370821\Sale.com
        
        Sale.com w
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2932
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1844
- - C:\Users\Admin\AppData\Local\Temp\1020605001\4159d61421.exe
    "C:\Users\Admin\AppData\Local\Temp\1020605001\4159d61421.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\1020606001\e35f834a42.exe
    "C:\Users\Admin\AppData\Local\Temp\1020606001\e35f834a42.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\1020607001\42830f0675.exe
    "C:\Users\Admin\AppData\Local\Temp\1020607001\42830f0675.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\1020608001\addd5b77f7.exe
    "C:\Users\Admin\AppData\Local\Temp\1020608001\addd5b77f7.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020600001\4a622b9e46.exe

Filesize
1017KB

MD5
af97661ca877fa1c644ead6567388945

SHA1
6ecb6d1a317e72a39a88f86c1f47b4e00427b8fc

SHA256
f88e4323299b2af453ce04ef6f5dc55b753d9210d7e598a0085bf3c21a5a4f0a

SHA512
9f99c8f1f4c343fc920146dd3c8d130d724b838a80ed2b4514172bbdfea2e5bc98fd27d42a2748cfec73a5680861bcf170c70ae9e45a2fed86ad6ec621899713

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020601001\108e1fe190.exe

Filesize
591KB

MD5
3567cb15156760b2f111512ffdbc1451

SHA1
2fdb1f235fc5a9a32477dab4220ece5fda1539d4

SHA256
0285d3a6c1ca2e3a993491c44e9cf2d33dbec0fb85fdbf48989a4e3b14b37630

SHA512
e7a31b016417218387a4702e525d33dd4fe496557539b2ab173cec0cb92052c750cfc4b3e7f02f3c66ac23f19a0c8a4eb6c9d2b590a5e9faeb525e517bc877ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020602001\213588b34a.exe

Filesize
2.5MB

MD5
87330f1877c33a5a6203c49075223b16

SHA1
55b64ee8b2d1302581ab1978e9588191e4e62f81

SHA256
98f2344ed45ff0464769e5b006bf0e831dc3834f0534a23339bb703e50db17e0

SHA512
7c747d3edb04e4e71dce7efa33f5944a191896574fee5227316739a83d423936a523df12f925ee9b460cce23b49271f549c1ee5d77b50a7d7c6e3f31ba120c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020603001\932f2bc0ea.exe

Filesize
758KB

MD5
afd936e441bf5cbdb858e96833cc6ed3

SHA1
3491edd8c7caf9ae169e21fb58bccd29d95aefef

SHA256
c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

SHA512
928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020604001\c376aea6c6.exe

Filesize
1.2MB

MD5
5a909c9769920208ed3d4d7279f08de5

SHA1
656f447088626150e252cbf7df6f8cd0de596fa0

SHA256
5f2c26e780639a76f10c549e7dea1421c4f06093c1facbf4dd8cf0a8b2fee8cb

SHA512
c6038048bd09c8f704246a6ba176ea63b1c8d23f2e127600c50bac50f3032c1b751ea8e405a2fe1ea707f75f21cf6516447345a84751bc677d94874d4b91090b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020605001\4159d61421.exe

Filesize
1.8MB

MD5
8a0feb447f024f32d1ee001a56d7ee23

SHA1
39086a8133462fbbdbaad4a313789d216497e68a

SHA256
b474d829617220d8d949fa58a39d9eafde02ec488f0c7a4330950fefed66bd86

SHA512
09efc757b29341d91d08619e8924b5cbb3acd73f2fe13b1aa21327c4133721102110b17f6717b09e703d1137d4266ab6e563f85bd34e98a1ee03b1b50e7ddbec

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020606001\e35f834a42.exe

Filesize
4.3MB

MD5
e3449d1a8c12d6d9510f67519efc97d5

SHA1
707ca92c9b69ef43a3a567adc42a0882d95377f0

SHA256
1534caaa2fad0ed1beed2ec7e738d77ab8aa6b27807613116cac79580f2cb049

SHA512
d038ed41f48eca30f66400d9e1ac0eeec33c19ac776fcde39fb7b4dabce9c38760017009419c2d8744d17ac29c16c543c7c8cc3e7a82e6b2f171fd3051784c89

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020607001\42830f0675.exe

Filesize
1.8MB

MD5
e1419fb24949befef966b31430ab524f

SHA1
e99fb61766c0e37436fe922a623b21bd3fd9504a

SHA256
0d42c7e6c18ef132d44a20764baf90f3901c51bd4dee407d74ad5db461b1ccda

SHA512
d8ed472ce1e9cae9613d4ea3d5c7d5ff8b618c9514539b0775ac603e354366ae26995c14378855a9e0ad51e2688866f2952363b37c393f9fd49af6914210dfbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020608001\addd5b77f7.exe

Filesize
4.3MB

MD5
075fa1c9ab37da504f2ebc0bdb1c5e8b

SHA1
3f5c22c0f4968ea41941c2a24eea0e025da54b7f

SHA256
4f1587e3998b79e7f9bb6248e401da9e89922ee19f520d5cfff3bae1516ca19d

SHA512
7694940d68a988f95baf515143edb62fdc9faee12c2d18f450848789489903286f4db94ca59863566b0310f60a8baf3411f31660efd1295960b996cedcceb701

Download Submit
C:\Users\Admin\AppData\Local\Temp\370821\w

Filesize
445KB

MD5
d02f356cc528bf6eaa89051942a0b1be

SHA1
dfecb4ae80274697f0d86e497cd566020ea23739

SHA256
5ed7e1f92a6bb08458ca99fdc83236095845f5939c6b9f7e423c6db70869b95c

SHA512
91ec78343e91db20edf97f39c293a5a8a45851c510ad6499c85b26738dfd9e918edda14e8710ece22d855d51d1417e722f19530ce3979e491c2b0dccb5198e57

Download Submit
C:\Users\Admin\AppData\Local\Temp\99123\J

Filesize
452KB

MD5
9d5451c35e68d36eae4ebe88777a2703

SHA1
a68074d54baf2f148d6358e86232f02075eb6cce

SHA256
e812fb4a46034951670ae35690a99ccb89ccdd964ce2ec993cc5edbb42b97a7b

SHA512
ccb0a305243532f665974c2c6eedc89a58a960f27d5a86511726319502c4a146bbad3b075a6f2d1e153a17f74580411637cfa4d9fc9de53d0d070a1d0fc56d22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Accompanying

Filesize
51KB

MD5
5301e544069f4abbbc2feba1e75d5839

SHA1
134528e199d21ddae5f17d41ab5ec1148910e8f3

SHA256
fef3f6d3ba309563a0d6fa00821d85267fe5e97d88009a6c9dc2f103ba7b638f

SHA512
ab9db4f66c30f28da1f59d8407191c915f214fce384a7dabe8b1bcc70d54fdc76f03d0a44d6646b5478eeec9caa9df69b58b6c59778034902a46dea0ac14a608

Download Submit
C:\Users\Admin\AppData\Local\Temp\Aka

Filesize
42KB

MD5
14422967d2c4b9a9a8a90e398b24f500

SHA1
7031018af43bcc5550a8b0a55680596d693334dc

SHA256
93db8e88945b7de88e98a7c50d64bffa8b73c3b002c744c8d62c2eadf767cf6f

SHA512
4b5795f15774a7768a42aa3a2308b9366f47b30c92babf688a67d2abeca0037b63762f3e21154212dc5c8a31bcdd69f029e849e1d4def5676a04b64e2ae90c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Anybody

Filesize
121KB

MD5
c89fd1314a2184d5d7b4a66de377d5b2

SHA1
f0ebbc2c8c6f9ebadc6ace713aec1b06f3f841e8

SHA256
9d1e82e2e430b87b28867ff9745a74e53a128671e9d300f111b1904786c2f856

SHA512
4b0b16e99d0cacab0b7af1d65cbf9226988752d8fa020b955bf54c634d9d64a05bb036ef590fa0d852d513621a84f4c3dc3c341aa8feffdf350dd8a5dbc75778

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C93.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Campbell

Filesize
11KB

MD5
e7567ec4057933fa6e06322b7c08b72a

SHA1
4e733e77915c7dfb7d25e31738e9d596962d4177

SHA256
1896ef25a6223f19f770da125a4b1bc7c90815ccb682ec7ca780d231a01c28b0

SHA512
d8a14e5c8225ad8bdbb45317fd41588c12e9e60f1c9ff819d0d15cbc35801b82e7c7981b7dbc815666354950a7f5362fc00765f8a67c9478bd95dc5a31b12c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\Conferencing

Filesize
130KB

MD5
638e7812c5e9c55c5f339cc64d197b28

SHA1
5ef8a953ef65ab7d0620a5d144f2c410e2a77a2f

SHA256
347a3459dd74aea0a6b2f62955d1bc9bdb091bb66ca8a42274f7ebf310527fd8

SHA512
194b0d8799a83210968746c4d3e364ee512669e6080c6b3d215d97c141e8ef7f09152ea524691efcd2276acb1dc158ffd484e3f595ddf2cceb690bd1996c8266

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cooling

Filesize
86KB

MD5
3e203e6316f562d31cde3c9c3c416bdd

SHA1
c77d7fc854662f8b5051dfef8118cd20438de6ca

SHA256
8e3db2b70a0e30eacb80191bef9ccf3625a2c12a2784837f7b7c83cc6f8a0e0a

SHA512
08f4598c0c55238069bbaf3b6fc36920a5556aeb1da354e17a834c6bbe5a8253e5f1f3d6b8d16de13e5dff9052044b48bf05b555fde36cc0d5ba8786bb84a99e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cradle

Filesize
65KB

MD5
4b991fcc2b73b98f1450ec87c1e39643

SHA1
51b13446dbbf3658f5a4c97fef9757de7d1bb8e9

SHA256
e940ddb06d156cb37e95dbf088a8e762247393ef96b9f025b8d44e786dc932a6

SHA512
5060225eb979a6779c6e706eba924013ea1a63bdacd5cbd8469500c4d3efa2b5d4ddaef30533a8770199e261482e5f8740d9b8c20dfef8f32b7b8d461dbc9a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Debug

Filesize
112KB

MD5
d9daf89d86b32df3d7da7ec1cfbf7212

SHA1
59e1ba3dd32168a3d79a9da2626c99c52970a53e

SHA256
06f48747a4acb2ee437d03a9e8331cca5c76ee5684e118f491e4faf7799adcc4

SHA512
24d26b6112417d75915f08562af53eb1bb7ddef2e89e779db52ae0f674ea8ce102984fa2628cee5588c7dc34df00a32497e49ee18f7259c51e4d1c855ab69a6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Discs

Filesize
68KB

MD5
00646a2066d51d9790f52bae3c446c87

SHA1
ebda2b25b5a46cc6d9d5494050cc4b3a0bf81984

SHA256
57afab1cec987da27f5e92baa6dc21d83f8c83edf734fc590313102e75844c3a

SHA512
a74c02ed1b704912a8945e60cacc892f7e832e5cf15c87632b0fd3cbf9ddd8f36b01a5ba87fd7ef87d6becbb297161bb69dc750b8dac6f952892d45cd95f46f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dod

Filesize
3KB

MD5
682d77b5a6d22691a869ab4bea11ad53

SHA1
f56fab8959a05c77570652f5f8e9e4103489e676

SHA256
c269725998f8f5acdab6a0067457065cc9059326ee0a38ff353c2939a0190c1b

SHA512
c42d04178ed59683fc4597b83496d7b3c61c1a075b4542abb491c9639531f9737d70ae4172186fd6a3450c26701d794496bd4ae0f5e50db8a3818cd78ed7fd27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Draws

Filesize
90KB

MD5
44951d98b49859e4785cb033fcd69dfc

SHA1
ec472265152d7030d26536eff22c5ee4cda39601

SHA256
9f14969cb5a7c30e265939a12cc0000034fb59dd25167a1ce0a7f68ef5ab1c9a

SHA512
eaca2ea6193708e5e96d7acc66f22568bfab61d1ef8b97d02aace105fd5b0485a55c64b521828af28c043f2bb6d5dcf400880adbd80a716d92c759e6e20d6d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ejaculation

Filesize
148KB

MD5
2e9e29f8ed97f2de8ebb1652bdbd545a

SHA1
5577d360b25daffa0af907fc5d852894b784f81d

SHA256
aeb399054cff321f752d4f93143815ff1a2cc2398668c2e1110065a2c6f502f1

SHA512
f4f925daf3f576441d2b7a0e250a51400b23e714d76870a640734912da783d83ac113586f121161d96d7f06eb70b8d89eb4e0524d591232b0b2a342063e8bcb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Execution

Filesize
112KB

MD5
42fb34ddb94507c5a125bf02c2983904

SHA1
4e400c020121235e3de490f5cbb38c4a25e686dc

SHA256
d59efea25d1e316b8a9248f52081ab14113c97603f3e90d533f4f373f743b3c7

SHA512
639d90cd1cd451ebcb9e5e1c165f7eebb62b30d6bf24c596990ca40e08bce5d0b5864e7a4f0a83624c7cf9ac4ec5c1e7385f59602b206f3346554d62721cd71d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Genre

Filesize
88KB

MD5
5ce4409c4aaa9fd5a27ec4974734f1df

SHA1
bf7ee5465ef96ee0186388b5b0685ad727ed9493

SHA256
a401b4cd0afbaee57d8025bf4fce12583c825cbc2e3d3f308eb0627cd5bba412

SHA512
1155b1c58221ba1c809d9d60cd440ebd8788dcd3169ee87bda72fb7061b1e2f849f8bc79ac7053df5de8bc7955db088df778af66900d6f303bde6d61925014e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hydrocodone

Filesize
61KB

MD5
1e356494658efcd99f6240a5243924f5

SHA1
0fe6e730cf03e0cade72ceb459fa5756c2fb1757

SHA256
9f29364243c72d66d3977e7d6f2c44ad95bdb835e7aef2ea4df56746a63145af

SHA512
acfd4f95a56e179b2b97a0a55aea201e570c5ddf99c52b6de9b740e670803b17cc90a757c4b82e1e041f4bc7724126d4534d509198873a985fd02fc9770b9102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Images

Filesize
71KB

MD5
805da0b25e5659b2090c9b59ed0c7100

SHA1
94d0fbf1e8d9b856a899012bc9b99a5b4cea0a66

SHA256
f2b4db508c5d89fa3acf03f7387d547fa365af9e4b0cc6c3d6398bfc964e2ef9

SHA512
e760d76f033158e848bd3e3fea0bc49ccf8f235e851ee66981314073cf8bdf8a457b2a996635cf5929e205878678e388d1e93013e7a7b5fd5fd3fb66232a7679

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intent

Filesize
92KB

MD5
b4094aca25b2abdc05d69604783dba5e

SHA1
0dfdbc2c2376df2be8980940052ca6950565b76d

SHA256
838c88e7e1b851813d41731e5817e318732191667d2de05d06fbb0583ae00838

SHA512
5abfa7d12a17a04b12d8191d4c5a03ff94a2faddaa34f778714e25a46299e6f25e60acdd49230936b9e8809349f88dc55334991120fa036e6653565427320d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Investigators

Filesize
93KB

MD5
a4e4656e273804d0f852a899c72b8ac8

SHA1
052e483b2ad90917fb0edb6ee864a45dd304d149

SHA256
9e75061906cf194ba753c0e5da129c76746353de036fcdad88215d186bc07142

SHA512
865ab23ad5d0b833c46d8ca5e50c1e4313fabee3aa4e846a8ddd150be92120daa2fd182d302179b6c4d18ca69cd724d82f31b9ac15410ace57b2c19f77e4ba62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Making

Filesize
52KB

MD5
e34dad8abc86ddec0b36739e14998200

SHA1
7ca425845b3ad0f610e4e97920361ade864a1321

SHA256
0ee35aa05a54819055b686be31c6fe0c0d6d918ce54e7994f648b13e95f5a539

SHA512
9f488f76466e8a13f187aa8d7d6b217682248a33b179f8c3bcb70858c64b74d5bc7af9e4ef3ea5b2d7255cb260d21fa5a4c09c2bf0cc0f06c459b8e87b4e1d7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Marijuana

Filesize
58KB

MD5
d830821fe60d6cd810fb9ec7102838f3

SHA1
9264b78903fa373e0a1b697cc056decc1dfafb5f

SHA256
00a96ac0e8600a9fa0a00ef1f939b58be93618c4fe4e3be9d0bfab0a4a0ff57d

SHA512
2a8e2bb9d599964ca112aacbb0fda37c01466898a7af5d7c8543013949b0bc6e5665402692a1072845b1a72211d350963c608a81a7c3450c19a56a948ced5d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mj

Filesize
97KB

MD5
ff77a17e4cade79760f0f8b87c857c6c

SHA1
b05075d65229af0063e6e85da14ab940062818dd

SHA256
cc8a9523b67f764e447cd5042751e1de77b04ffc5664e6f5c41d1c3cce0ec60d

SHA512
6df97dcb14736d2f0ce9762b7246050b488e054375c78f42294119d80cacedcf53f4b3868b7a4c948dd7b1f9545b4135f5bd5ed69611424129cae63a372994d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mp

Filesize
62KB

MD5
6bdc450c376beeb2315627124f2cceea

SHA1
6b5ff983669677bd6e58d34511cf2bb42e4ded7e

SHA256
20e5f6e77d1a252cc4b1050f373d5a8d93c05dd5ae0fbd92514595406cbf88f4

SHA512
7321a2e930133590114041b4cd6e693e03dc284923e54f7db96822d6bce1fc86a87423868ac7ba8d87f35be8632ce4dcc82b4b7e8545f76067bcbf8d4fdbf4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mysterious

Filesize
89KB

MD5
beef30c9a0c6a41985e081cd4ff23049

SHA1
4e09ffaf608baf3a98cd94794cb7cc23e41c3086

SHA256
fc64f325cdd473adb5b7c15221f7b2773a064395612eff9ad1c76fa973a6738a

SHA512
ec71cdb716b684b241a2fa2bca84cbced9aa86ba0954009dc003ef1f80640c01d49911ec6e031e9f8e8139d30bf5a77d7a79ee38f66b8fd43a6e4f957cb8e1ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Non

Filesize
73KB

MD5
d487bb0be6a5dfc11120e16415eaf254

SHA1
e688decd45d311d7c441a86238a340ec8a4e2c12

SHA256
e90c0c5ab08b586b8e5c148f9fff879c9d664a8d50d2fcda8e518555c5a29d04

SHA512
082e262ce56cb7321dcbdae18c1caac261e1cbe29c1924822e454fae5a5d57ac53dfd4f357649c43afb99a338b6dcfb1bedac56f206cd61963765c850ea8967a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Podcasts

Filesize
19KB

MD5
270e797dcc891238ecb4753b12ad9740

SHA1
2714eaaf585411ca91ee2ffb905d6271bfee6d9e

SHA256
2b87d3a5678436374f66000bc263763f35d1662b675f004b55002cb4f473a3d0

SHA512
409f2d91ea614e28a6a966cc52769bedd8786d1e655629da544d93a9d0547c8d151798f3f5010e11cd4308d58a419616dc35a4273df17afb94022a29f6f26a64

Download Submit
C:\Users\Admin\AppData\Local\Temp\Producing

Filesize
71KB

MD5
aa4d881ea35979e4eab13c982d3d0898

SHA1
cf301086d6e43e603571762fbc7d754f0246fb74

SHA256
31d85bebe7949c9b7b40af007fbbe61c8cd6c25f8e4fc7dcfe9b7dcd8a1d79e7

SHA512
f64491753f2cf57b72740ca91f10c2bd677219bc89bf86d2476a8567cf83955f986a481c92d19bef9c466438af97d071686ea2fc496c5e477c900568f129b5f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Provincial

Filesize
21KB

MD5
b3ba8505107e9d073a550ccba98eb968

SHA1
7c2b8d580417b0ac00c72742e7f2a3dadba2037c

SHA256
962591c18363189e560b8c270d622211b8816d682ff198c85175bda20dfd936d

SHA512
1ffda708e501e4d2290d1f823c98a616c60d5703da8d8dd1933a262169d061bbcecb88b1905a50ad6e431e0b65f0bf9af337cd8319bdce30d087b5cf9cf19024

Download Submit
C:\Users\Admin\AppData\Local\Temp\Reality

Filesize
138KB

MD5
2f19bb4cd5c2064eff5481daab21998b

SHA1
b90e3a2c59845bf9db96290892c3ffc0931d0660

SHA256
cef09842dd65e03840d74a9b99f480bce506833a64761e4685e4ce911b77967d

SHA512
7515b6da13ae4cd6cac7693a9120984a22cc851a24726f01cd92282bdeb8b8c48126bae69795edd1eb261f4df83bf344d1a6be7e2e33b8408cc00badec3adb53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Receiving

Filesize
61KB

MD5
8d5cf0056a8be7ca1485969fc23f72a5

SHA1
5727bc17cd958d06b1e7d52c8d38a761a1ae2bf2

SHA256
bd1b00dea1cddb3345443a35ae3b71883443722edbb48016f829ac500f5f505b

SHA512
b0f5fb69a565fc9690f307175c606ce9f9484bc309ac00b8a359cb6b77d19a938052ec584919a256fdb7c0b1557e155b414090b771432acb9419102f794b61ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Similarly

Filesize
85KB

MD5
2a0a1ee171590176fe15f4642b8a760d

SHA1
4aa9f7a03075b102216671f2317a1ffe255d3711

SHA256
72e64f8c258c2187da2a8668a6cdaaf9e00d0231f4dd53962bec9ea2c4361192

SHA512
b948bbe8b1b96652fb7d86de4af5ba74e3665da02b51d81e1ec7ae2a3888bc2be540bfd38b5eccf69f37daf59cf8bf3e2f3f226fb0ae2609fa0c5f850b6ada99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sky

Filesize
69KB

MD5
4932c3ce2af6353e67c7c5f350aa4d78

SHA1
bfc9ad2b57cf1889da29df3bf890dc3ccf47052c

SHA256
66f710bd4b6c369c0c5cd62d20fc74d01d728567ec3e27bccc6878632c9b32ac

SHA512
204ee6621b85e96592fc4633bb26d6ea60a49041cc4b3aca4344fde6ba72ea2d828864ce5af4f7ac263eaab6b8237fc8586b4d6dbf7d6b906932737264e3fe92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solely

Filesize
105KB

MD5
2fadd2bf6f3cdc055416baa1528652e9

SHA1
342d96c7ce7b431e76c15c9a7386c2a75e3dc511

SHA256
8df18d17c715e689b9cb222beb699120b592464460fd407dbb14f59ccec5fdb3

SHA512
08bc19703dad1441e1da8fb011c42241a4c90d8355575b7f41d465e3e84d797ecac7d6bf9af6163e6f4ef506cd98561f62d06446f861aeba2d7644beb7f6abb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Steven

Filesize
144KB

MD5
d48116c78de0b7a19a42a803f1c7bc10

SHA1
a7e478e2987746c4aad980b87be2b6e34366d790

SHA256
645449e2fa6cb0460ddcb955cca87bcfaf3bad4d2c13df5192ede5b15f91e1c8

SHA512
17468a6e770545bf81c35c7f6c892e02a4b0704bf4990700acf5041e801ccae651e404712f40ac05f4f2d628854f2f9eae9050fb8d24ffd48b7305fdcc6243dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sunrise

Filesize
62KB

MD5
9e4fe1f2538c08f75ae16a3e349c9ef2

SHA1
559879228568b2f405400b34dfb19e59f139fa2c

SHA256
22ce756672aca3a4ba015903b4c36e7667e15c73157759e5a2212e7d4e727cc0

SHA512
a1f6bf183c590cc62000dddb0fea63bae2bdc30fce8ebfa24286b9fb8b2415c67b2363f739d36b32cc7b477e608397efbe45173173aa3f27ed44e9b75448b9ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46A4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Titanium

Filesize
123KB

MD5
54e8846da2e826944aeb7af79d077db8

SHA1
4b3f32b33d7479c08b1af98fea297e66b0fbbbbb

SHA256
31512137663462a5bf630869af643c9ac3d44a354b3c442bbb90292d4aad9e38

SHA512
1c78464b7954de3732243adcfeb7584a3454f4536b52a40463d692f4851e73679b05c1b5e16374f471e0a9a2f8134cb87282b8e889d52bf2c50174a4630ead06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Traveller

Filesize
148B

MD5
34399bad11f65167027ba746bf5173be

SHA1
adeb8efcedd109ff1de4dffaccb61f3a4f8bf207

SHA256
3aa351a4f2dee96e357418948fe5f017987d8e7dde3def2eb06b5cb0a3a7eae4

SHA512
a054b103d05bbcfccbd1d3087f5f6226713b8002ca8bba63f4e1f4de7c97b017d8d5b729ef9f5461a781d4b42b78c869d16366949ee7e43477109c7848385430

Download Submit
C:\Users\Admin\AppData\Local\Temp\Veterinary

Filesize
2KB

MD5
6f07c56590cb57e03b68f9e2f994390c

SHA1
aee254034b1f3394a97304c8dfbae1911440e2c0

SHA256
1772cfd25c5deb74dacc6fc88aa8793a74c89a81452b27e886ca49557ba32d84

SHA512
0af18e6d07c161a5088cec9a56654c9f661ac003f0e22b68b6dbfe2920bb344f4d9a1326c261957c2309bb44dcb39453630f33068a057a1a6c2960edfbd39001

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.0MB

MD5
7dc7a8d2e9d44cae10b9b55b65585ddc

SHA1
3e78d38a9ce837926831ea27a0efb1a262877334

SHA256
efbfd7a968dc584c166551f171937da09dd94178b8c27e09f5eab73d1641d0d0

SHA512
e33388557fcea27a9d5be98eb2dc308be8d5d8d3afcb0e27d8834a96c95ba41f97c47f59de8227fd13667e8692e9063162b1d60a84161f57e4f8905f6d6483fe

Download Submit
\Program Files\Windows Media Player\graph\graph.exe

Filesize
245KB

MD5
7d254439af7b1caaa765420bea7fbd3f

SHA1
7bd1d979de4a86cb0d8c2ad9e1945bd351339ad0

SHA256
d6e7ceb5b05634efbd06c3e28233e92f1bd362a36473688fbaf952504b76d394

SHA512
c3164b2f09dc914066201562be6483f61d3c368675ac5d3466c2d5b754813b8b23fd09af86b1f15ab8cc91be8a52b3488323e7a65198e5b104f9c635ec5ed5cc

Download Submit
\Users\Admin\AppData\Local\Temp\99123\Laptops.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
memory/1308-575-0x0000000003500000-0x0000000003556000-memory.dmp

Filesize
344KB

Download
memory/1308-576-0x0000000003500000-0x0000000003556000-memory.dmp

Filesize
344KB

Download
memory/1308-577-0x0000000003500000-0x0000000003556000-memory.dmp

Filesize
344KB

Download
memory/1308-574-0x0000000003500000-0x0000000003556000-memory.dmp

Filesize
344KB

Download
memory/1308-573-0x0000000003500000-0x0000000003556000-memory.dmp

Filesize
344KB

Download
memory/1700-741-0x00000000000C0000-0x0000000000D27000-memory.dmp

Filesize
12.4MB

Download
memory/1756-792-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2016-772-0x0000000000040000-0x00000000004E6000-memory.dmp

Filesize
4.6MB

Download
memory/2016-684-0x0000000000040000-0x00000000004E6000-memory.dmp

Filesize
4.6MB

Download
memory/2016-764-0x0000000000040000-0x00000000004E6000-memory.dmp

Filesize
4.6MB

Download
memory/2016-745-0x0000000000040000-0x00000000004E6000-memory.dmp

Filesize
4.6MB

Download
memory/2016-782-0x0000000000040000-0x00000000004E6000-memory.dmp

Filesize
4.6MB

Download
memory/2016-672-0x0000000000040000-0x00000000004E6000-memory.dmp

Filesize
4.6MB

Download
memory/2016-655-0x0000000000040000-0x00000000004E6000-memory.dmp

Filesize
4.6MB

Download
memory/2096-0-0x0000000001100000-0x000000000140D000-memory.dmp

Filesize
3.1MB

Download
memory/2096-3-0x0000000001100000-0x000000000140D000-memory.dmp

Filesize
3.1MB

Download
memory/2096-17-0x0000000001101000-0x0000000001169000-memory.dmp

Filesize
416KB

Download
memory/2096-15-0x0000000001100000-0x000000000140D000-memory.dmp

Filesize
3.1MB

Download
memory/2096-1-0x0000000077B30000-0x0000000077B32000-memory.dmp

Filesize
8KB

Download
memory/2096-5-0x0000000001100000-0x000000000140D000-memory.dmp

Filesize
3.1MB

Download
memory/2096-2-0x0000000001101000-0x0000000001169000-memory.dmp

Filesize
416KB

Download
memory/2248-761-0x0000000000BD0000-0x000000000183F000-memory.dmp

Filesize
12.4MB

Download
memory/2248-669-0x0000000000BD0000-0x000000000183F000-memory.dmp

Filesize
12.4MB

Download
memory/2248-716-0x0000000000BD0000-0x000000000183F000-memory.dmp

Filesize
12.4MB

Download
memory/2248-713-0x0000000000BD0000-0x000000000183F000-memory.dmp

Filesize
12.4MB

Download
memory/2248-770-0x0000000000BD0000-0x000000000183F000-memory.dmp

Filesize
12.4MB

Download
memory/2248-778-0x0000000000BD0000-0x000000000183F000-memory.dmp

Filesize
12.4MB

Download
memory/2348-749-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2348-686-0x0000000000400000-0x0000000000C3C000-memory.dmp

Filesize
8.2MB

Download
memory/2348-743-0x0000000000400000-0x0000000000C3C000-memory.dmp

Filesize
8.2MB

Download
memory/2348-773-0x0000000000400000-0x0000000000C3C000-memory.dmp

Filesize
8.2MB

Download
memory/2348-789-0x0000000000400000-0x0000000000C3C000-memory.dmp

Filesize
8.2MB

Download
memory/2348-746-0x0000000000400000-0x0000000000C3C000-memory.dmp

Filesize
8.2MB

Download
memory/2348-765-0x0000000000400000-0x0000000000C3C000-memory.dmp

Filesize
8.2MB

Download
memory/2736-670-0x0000000006690000-0x0000000006B36000-memory.dmp

Filesize
4.6MB

Download
memory/2736-44-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-739-0x0000000006690000-0x00000000072F7000-memory.dmp

Filesize
12.4MB

Download
memory/2736-694-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-742-0x0000000006690000-0x0000000006ECC000-memory.dmp

Filesize
8.2MB

Download
memory/2736-695-0x0000000006690000-0x00000000072FF000-memory.dmp

Filesize
12.4MB

Download
memory/2736-685-0x0000000006690000-0x0000000006ECC000-memory.dmp

Filesize
8.2MB

Download
memory/2736-671-0x0000000006690000-0x0000000006B36000-memory.dmp

Filesize
4.6MB

Download
memory/2736-668-0x0000000006690000-0x00000000072FF000-memory.dmp

Filesize
12.4MB

Download
memory/2736-801-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-800-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-799-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-798-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-797-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-759-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-656-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-653-0x0000000006690000-0x0000000006B36000-memory.dmp

Filesize
4.6MB

Download
memory/2736-654-0x0000000006690000-0x0000000006B36000-memory.dmp

Filesize
4.6MB

Download
memory/2736-16-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-767-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-18-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-19-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-21-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-776-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-22-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-740-0x0000000006690000-0x00000000072F7000-memory.dmp

Filesize
12.4MB

Download
memory/2736-353-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-790-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-791-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2736-572-0x0000000001070000-0x000000000137D000-memory.dmp

Filesize
3.1MB

Download
memory/2932-753-0x0000000003630000-0x0000000003685000-memory.dmp

Filesize
340KB

Download
memory/2932-754-0x0000000003630000-0x0000000003685000-memory.dmp

Filesize
340KB

Download
memory/2932-755-0x0000000003630000-0x0000000003685000-memory.dmp

Filesize
340KB

Download
memory/2932-756-0x0000000003630000-0x0000000003685000-memory.dmp

Filesize
340KB

Download
memory/2932-757-0x0000000003630000-0x0000000003685000-memory.dmp

Filesize
340KB

Download