Overview

overview

10

Static

static

3

8df406919a...72.exe

windows7-x64

10

8df406919a...72.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23-12-2024 18:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8df406919a6e208e397a486056005e280ca13a744631045b0eb295a96a14b572.exe

  • Size

    1.8MB

  • MD5

    230619f751a119a1d428db0e3850fac3

  • SHA1

    06bf7c3deaeb25ebc601dba5f2070255534c2f69

  • SHA256

    8df406919a6e208e397a486056005e280ca13a744631045b0eb295a96a14b572

  • SHA512

    2ce7b9078b52b55da6727200a198c5520aba28820d2da435fa16a90479177635565241e18fa6a4cf8b04fdc955189f3e08b6bae95566188c41a4231ed2fd6cc7

  • SSDEEP

    49152:1FGaLXMeuBsF3egHeJ8uCBbI7ZGIECKRaS:DDQJ8uquZFSRR

Score
10/10
amadeygcleanerlummaredlinestealc1488traffer4bee079c9aa5fed3aastokcredential_accessdiscoveryevasionexecutioninfostealerloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://shineugler.biz/api

https://pollution-raker.cyou/api

https://hosue-billowy.cyou/api

https://ripe-blade.cyou/api

https://smash-boiling.cyou/api

https://supporse-comment.cyou/api

https://greywe-snotty.cyou/api

https://steppriflej.xyz/api

https://sendypaster.xyz/api

Extracted

Family

amadey

Version

5.04

Botnet

4bee07

C2

http://185.215.113.209

Attributes
  • strings_key

    191655f008adc880f91bfc85bc56db54

  • url_paths

    /Fru7Nk9/index.php

rc4.plain

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

redline

Botnet

1488Traffer

C2

147.45.44.224:1912

Extracted

Family

lumma

C2

https://shineugler.biz/api

https://sendypaster.xyz/api

https://steppriflej.xyz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 5 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 23 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 41 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 11 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8df406919a6e208e397a486056005e280ca13a744631045b0eb295a96a14b572.exe
    "C:\Users\Admin\AppData\Local\Temp\8df406919a6e208e397a486056005e280ca13a744631045b0eb295a96a14b572.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\1001527001\legs.exe
        "C:\Users\Admin\AppData\Local\Temp\1001527001\legs.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Users\Admin\AppData\Local\Temp\1001527001\legs.exe
          "C:\Users\Admin\AppData\Local\Temp\1001527001\legs.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          PID:1764
      • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
        "C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
          "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2280
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
            5⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1660
      • C:\Users\Admin\AppData\Local\Temp\1006343001\goldddd123.exe
        "C:\Users\Admin\AppData\Local\Temp\1006343001\goldddd123.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Users\Admin\AppData\Local\Temp\1006343001\goldddd123.exe
          "C:\Users\Admin\AppData\Local\Temp\1006343001\goldddd123.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2116
      • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
        "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2496
        • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
          "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2916
      • C:\Users\Admin\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
        "C:\Users\Admin\AppData\Local\Temp\1008170001\SurveillanceWalls.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2192
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c move Campbell Campbell.cmd & Campbell.cmd
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1348
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2448
          • C:\Windows\SysWOW64\findstr.exe
            findstr /I "opssvc wrsa"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2512
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1524
          • C:\Windows\SysWOW64\findstr.exe
            findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2164
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c md 370821
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1224
          • C:\Windows\SysWOW64\findstr.exe
            findstr /V "Anchor" Veterinary
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1980
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c copy /b ..\Genre + ..\Mj + ..\Discs + ..\Receiving + ..\Mysterious + ..\Aka w
            5⤵
            • System Location Discovery: System Language Discovery
            PID:272
          • C:\Users\Admin\AppData\Local\Temp\370821\Sale.com
            Sale.com w
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1748
          • C:\Windows\SysWOW64\choice.exe
            choice /d y /t 5
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2980
      • C:\Users\Admin\AppData\Local\Temp\1008212001\daw21.exe
        "C:\Users\Admin\AppData\Local\Temp\1008212001\daw21.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1512
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 784
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2188
      • C:\Users\Admin\AppData\Local\Temp\1008409001\a7d72b392e.exe
        "C:\Users\Admin\AppData\Local\Temp\1008409001\a7d72b392e.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2756
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:1604
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef74c9758,0x7fef74c9768,0x7fef74c9778
            5⤵
              PID:1868
            • C:\Windows\system32\ctfmon.exe
              ctfmon.exe
              5⤵
                PID:1588
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=960,i,4111834964820895948,17450962434894006343,131072 /prefetch:2
                5⤵
                  PID:1936
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=960,i,4111834964820895948,17450962434894006343,131072 /prefetch:8
                  5⤵
                    PID:1112
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1564 --field-trial-handle=960,i,4111834964820895948,17450962434894006343,131072 /prefetch:8
                    5⤵
                      PID:2264
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2024 --field-trial-handle=960,i,4111834964820895948,17450962434894006343,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:2092
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2412 --field-trial-handle=960,i,4111834964820895948,17450962434894006343,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:1628
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2420 --field-trial-handle=960,i,4111834964820895948,17450962434894006343,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:3076
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1376 --field-trial-handle=960,i,4111834964820895948,17450962434894006343,131072 /prefetch:2
                      5⤵
                        PID:3628
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
                      4⤵
                      • Uses browser remote debugging
                      • Enumerates system info in registry
                      PID:3968
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef74c9758,0x7fef74c9768,0x7fef74c9778
                        5⤵
                          PID:3980
                        • C:\Windows\system32\ctfmon.exe
                          ctfmon.exe
                          5⤵
                            PID:3196
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1296,i,6230253422776438249,9691904484272807126,131072 /prefetch:2
                            5⤵
                              PID:2328
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1460 --field-trial-handle=1296,i,6230253422776438249,9691904484272807126,131072 /prefetch:8
                              5⤵
                                PID:1156
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\FIEHIIIJDA.exe"
                              4⤵
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              PID:4048
                              • C:\Users\Admin\Documents\FIEHIIIJDA.exe
                                "C:\Users\Admin\Documents\FIEHIIIJDA.exe"
                                5⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3772
                          • C:\Users\Admin\AppData\Local\Temp\1008410001\8e5385a953.exe
                            "C:\Users\Admin\AppData\Local\Temp\1008410001\8e5385a953.exe"
                            3⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Loads dropped DLL
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            PID:1664
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                              4⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Loads dropped DLL
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2320
                              • C:\Users\Admin\AppData\Local\Temp\1020416001\SdVB3P2.exe
                                "C:\Users\Admin\AppData\Local\Temp\1020416001\SdVB3P2.exe"
                                5⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                PID:536
                              • C:\Users\Admin\AppData\Local\Temp\1020826001\I0XmI2t.exe
                                "C:\Users\Admin\AppData\Local\Temp\1020826001\I0XmI2t.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:3484
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "powershell.exe" -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXAByAHAAZQBnAGUAMQBhAGwAdwAxAHYASwBCAE0ARgBSAEwAUQBQACcA
                                  6⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3564
                                • C:\Users\Admin\AppData\Roaming\rpege1alw1vKBMFRLQP\DJj.exe
                                  "C:\Users\Admin\AppData\Roaming\rpege1alw1vKBMFRLQP\DJj.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3332
                              • C:\Users\Admin\AppData\Local\Temp\1020934001\mdjw5me.exe
                                "C:\Users\Admin\AppData\Local\Temp\1020934001\mdjw5me.exe"
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                PID:3772
                                • C:\Users\Admin\AppData\Local\Temp\1020934001\mdjw5me.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1020934001\mdjw5me.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  PID:3120
                          • C:\Users\Admin\AppData\Local\Temp\1008411001\64c7621cc5.exe
                            "C:\Users\Admin\AppData\Local\Temp\1008411001\64c7621cc5.exe"
                            3⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Loads dropped DLL
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1536
                          • C:\Users\Admin\AppData\Local\Temp\1008412001\b5bf69ab60.exe
                            "C:\Users\Admin\AppData\Local\Temp\1008412001\b5bf69ab60.exe"
                            3⤵
                            • Enumerates VirtualBox registry keys
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:896
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1312

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Modify Authentication Process

                        1
                        T1556

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Defense Evasion

                        Modify Authentication Process

                        1
                        T1556

                        Modify Registry

                        2
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Modify Authentication Process

                        1
                        T1556

                        Steal Web Session Cookie

                        1
                        T1539

                        Unsecured Credentials

                        4
                        T1552

                        Credentials In Files

                        4
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Process Discovery

                        1
                        T1057

                        Query Registry

                        7
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        3
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\HIDAKFIJ
                          Filesize

                          92KB

                          MD5

                          1a350845293a8dc298bec9db0f4cbf29

                          SHA1

                          c1c7941144c8a2519fa70ec1d2d4323e5426acd0

                          SHA256

                          851a1a712a2c4de7919b81d8bd2a2dccee8a8d67ad502cbf7ce045e3409f0ae7

                          SHA512

                          e69a6ed681f35ef1e426ac9b71d0df5639d7111baa070c314d13d757750fccab961606df8695b638489fd987224c3a26813686ddecd63c632bc6a75330f9d844

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
                          Filesize

                          16B

                          MD5

                          18e723571b00fb1694a3bad6c78e4054

                          SHA1

                          afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                          SHA256

                          8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                          SHA512

                          43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\CURRENT
                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Sync Data\LevelDB\MANIFEST-000001
                          Filesize

                          41B

                          MD5

                          5af87dfd673ba2115e2fcf5cfdb727ab

                          SHA1

                          d5b5bbf396dc291274584ef71f444f420b6056f1

                          SHA256

                          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                          SHA512

                          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Sync Data\LevelDB\000002.dbtmp
                          Filesize

                          16B

                          MD5

                          206702161f94c5cd39fadd03f4014d98

                          SHA1

                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                          SHA256

                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                          SHA512

                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c47c5f4d-34cb-49b0-9213-f9dbfccaa40a.tmp
                          Filesize

                          169KB

                          MD5

                          111757ad041b8a4ae82381f2a5d6fa4a

                          SHA1

                          d26ec3bebe44e31a99947f77426d4d5d3b65bb56

                          SHA256

                          38b60bb81062864411cf857b52ca456919ae79fed68c6dc17c50cad8e907ecbb

                          SHA512

                          3dacb5e6183c59e7615815f02e9d22b975832f611b3fe7b135f69073b20f504e966feadef3aef57fc91002b026cc6447a4161226a4f8162b9a895c4998db03c3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\download[1].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1001527001\legs.exe
                          Filesize

                          758KB

                          MD5

                          75cf470500d65ce4411790e09e650806

                          SHA1

                          91aca1838bc6e3868d25e44308f58124b749167d

                          SHA256

                          f29a920dd390574c50df03e8f909a8f81a1894af912af2d92a9baf4b57cf1c04

                          SHA512

                          1c281fe53742a338becb9aa4efd2a7e418a66949a7f3d156440e02e2351548f6ff0ead5d93aae157509f57d0b4cc3584a9ab623c6446ea389b45b49d0df85c48

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
                          Filesize

                          429KB

                          MD5

                          ce27255f0ef33ce6304e54d171e6547c

                          SHA1

                          e594c6743d869c852bf7a09e7fe8103b25949b6e

                          SHA256

                          82c683a7f6e0b4a99a6d3ab519d539a3b0651953c7a71f5309b9d08e4daa7c3c

                          SHA512

                          96cfafbab9138517532621d0b5f3d4a529806cfdf6191c589e6fb6ebf471e9df0777fb74e9abbfe4e8cd8821944ad02b1f09775195e190ee8ca5d3fd151d20d9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
                          Filesize

                          2.5MB

                          MD5

                          7ff947867bc70055adffa2164a741b01

                          SHA1

                          cff424168c2f6bcef107ebc9bd65590f3ead76ae

                          SHA256

                          b6d6628d2dc7dea808eef05180c27abe10a1af245d624aacdacccc52a1eb7b40

                          SHA512

                          da507d1847056d0dc2c122c45ecbea4901a81c06890bcdbffc2f18ad4b96f0ac2c2fa9ebde1a315828c74a97af653062a8c50ce70c9b6d6966c48871150747ee

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1008170001\SurveillanceWalls.exe
                          Filesize

                          1.2MB

                          MD5

                          5a909c9769920208ed3d4d7279f08de5

                          SHA1

                          656f447088626150e252cbf7df6f8cd0de596fa0

                          SHA256

                          5f2c26e780639a76f10c549e7dea1421c4f06093c1facbf4dd8cf0a8b2fee8cb

                          SHA512

                          c6038048bd09c8f704246a6ba176ea63b1c8d23f2e127600c50bac50f3032c1b751ea8e405a2fe1ea707f75f21cf6516447345a84751bc677d94874d4b91090b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1008212001\daw21.exe
                          Filesize

                          240KB

                          MD5

                          08d493bfdfa30242a5846dbdef4c1948

                          SHA1

                          f543aa3ad55c4b4fe176bc610c6d90ff278a8b2f

                          SHA256

                          7dccfe6b2eab06663f0b7dac8406252f4bf222fff85dc75c356be422dab0f46e

                          SHA512

                          8bd248437528fa40cd23fa3240c2378c701c4ede8278ce4ec9bf7e55483c176c42b222ed90bae8252008602de212126cdba69d298de5387ff10a9b319dcb6047

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1008409001\a7d72b392e.exe
                          Filesize

                          2.8MB

                          MD5

                          b28068b312d5325edd989df92fa6d7f0

                          SHA1

                          cf614aa659ee3d2929a8ac6a49348773d0d5efad

                          SHA256

                          b11a88588a27f8453d7fec8a632776c1798beab8a73fd01c0f447d29a0086c7b

                          SHA512

                          ef0135fe7721ae9874dc3d79c3746ad4f9b3058b95e2b851fd4ce0ca08a091129916b45a532b5e7a2870ad54962aca6cab076ba287dc35803dc675f66068e8c7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1008410001\8e5385a953.exe
                          Filesize

                          3.1MB

                          MD5

                          b665d59a212f56c8eafa16b43321dd41

                          SHA1

                          d8999fe3e1ebbbc07650acbc5014a76891efae6d

                          SHA256

                          3b4b8e2afc5dc4b9a407532ef4432a42bac1d572143c960d5787a7d6f9a2f555

                          SHA512

                          436763bb440519f5c8412a97daf5f334475b3473e3156951599f888373127e50aa39dfb1f865e2f2343a2f7a006171b755e95670568aa2509c13488ad1d5dcf9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1008411001\64c7621cc5.exe
                          Filesize

                          1.8MB

                          MD5

                          5d7a95aa53bd137b81f66e1bce4b3dd9

                          SHA1

                          943bc778915f1f301185593bd50d9c0f395a072f

                          SHA256

                          9f3698685360a46f1ff8ee797a7eb63c5d950762886e217587ab363517e9b7f2

                          SHA512

                          7cc67c992775407a5516b00b48fb7774aa38cd76cc4f94153c2fa82b166c346c2dbf6535eb89664c974e5b32fbd6d9e25fe88dbe4f6b7af92844ace060c5fbda

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1008412001\b5bf69ab60.exe
                          Filesize

                          4.2MB

                          MD5

                          ef6018bf916cec9358b260a243e92469

                          SHA1

                          9231767baa77dde01cd6ec06adf48904607d731d

                          SHA256

                          963630b9846e75467f4275f9932259def3f690e0e0909d63d956bf472613f98e

                          SHA512

                          954fe0660511decea1d765f26c953a58fdfbd9d99d6e9456862afdb527ac7cf777d4fe9c5379e718a349228d21031434b1289ee2e311e8330f26011cc16f1c14

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020416001\SdVB3P2.exe
                          Filesize

                          1.8MB

                          MD5

                          8a0feb447f024f32d1ee001a56d7ee23

                          SHA1

                          39086a8133462fbbdbaad4a313789d216497e68a

                          SHA256

                          b474d829617220d8d949fa58a39d9eafde02ec488f0c7a4330950fefed66bd86

                          SHA512

                          09efc757b29341d91d08619e8924b5cbb3acd73f2fe13b1aa21327c4133721102110b17f6717b09e703d1137d4266ab6e563f85bd34e98a1ee03b1b50e7ddbec

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020826001\I0XmI2t.exe
                          Filesize

                          2.9MB

                          MD5

                          75ca34215f6e3916c51c0af34fc17284

                          SHA1

                          3726ba089194df9221b1eed520d62e452d74d509

                          SHA256

                          4d2340448332a51ceafe2cb2562b2441590eff605b7fc0478001ad103f495955

                          SHA512

                          51a8285cd0c989ca4a659fb84f401f81e92bcc9a2b03f3f55da565bc2a9b6fefb115ddb0009d675e265e391c65fb4defc6326037b70b03eb6ed1364f1d7dc679

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1020934001\mdjw5me.exe
                          Filesize

                          520KB

                          MD5

                          81b5e34627858d87520f219c18cc5c7f

                          SHA1

                          f2a58e0cfd375756c799112180deb3770cc55cf8

                          SHA256

                          00297db7c9f2087e3c55b655df030155eedadd141ec2d31e47ff53aa82c43cc7

                          SHA512

                          ceb2bdf9a1396c637bf946592661e816446df56e1ba46275aef10b09e8db385c78f39825153c1b74b37bb7750ba5a7a5afc82bf25b1a19a322fd8eae010eec08

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\370821\w
                          Filesize

                          445KB

                          MD5

                          d02f356cc528bf6eaa89051942a0b1be

                          SHA1

                          dfecb4ae80274697f0d86e497cd566020ea23739

                          SHA256

                          5ed7e1f92a6bb08458ca99fdc83236095845f5939c6b9f7e423c6db70869b95c

                          SHA512

                          91ec78343e91db20edf97f39c293a5a8a45851c510ad6499c85b26738dfd9e918edda14e8710ece22d855d51d1417e722f19530ce3979e491c2b0dccb5198e57

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Aka
                          Filesize

                          42KB

                          MD5

                          14422967d2c4b9a9a8a90e398b24f500

                          SHA1

                          7031018af43bcc5550a8b0a55680596d693334dc

                          SHA256

                          93db8e88945b7de88e98a7c50d64bffa8b73c3b002c744c8d62c2eadf767cf6f

                          SHA512

                          4b5795f15774a7768a42aa3a2308b9366f47b30c92babf688a67d2abeca0037b63762f3e21154212dc5c8a31bcdd69f029e849e1d4def5676a04b64e2ae90c75

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Anybody
                          Filesize

                          121KB

                          MD5

                          c89fd1314a2184d5d7b4a66de377d5b2

                          SHA1

                          f0ebbc2c8c6f9ebadc6ace713aec1b06f3f841e8

                          SHA256

                          9d1e82e2e430b87b28867ff9745a74e53a128671e9d300f111b1904786c2f856

                          SHA512

                          4b0b16e99d0cacab0b7af1d65cbf9226988752d8fa020b955bf54c634d9d64a05bb036ef590fa0d852d513621a84f4c3dc3c341aa8feffdf350dd8a5dbc75778

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Cab22BF.tmp
                          Filesize

                          70KB

                          MD5

                          49aebf8cbd62d92ac215b2923fb1b9f5

                          SHA1

                          1723be06719828dda65ad804298d0431f6aff976

                          SHA256

                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                          SHA512

                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Campbell
                          Filesize

                          11KB

                          MD5

                          e7567ec4057933fa6e06322b7c08b72a

                          SHA1

                          4e733e77915c7dfb7d25e31738e9d596962d4177

                          SHA256

                          1896ef25a6223f19f770da125a4b1bc7c90815ccb682ec7ca780d231a01c28b0

                          SHA512

                          d8a14e5c8225ad8bdbb45317fd41588c12e9e60f1c9ff819d0d15cbc35801b82e7c7981b7dbc815666354950a7f5362fc00765f8a67c9478bd95dc5a31b12c83

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Conferencing
                          Filesize

                          130KB

                          MD5

                          638e7812c5e9c55c5f339cc64d197b28

                          SHA1

                          5ef8a953ef65ab7d0620a5d144f2c410e2a77a2f

                          SHA256

                          347a3459dd74aea0a6b2f62955d1bc9bdb091bb66ca8a42274f7ebf310527fd8

                          SHA512

                          194b0d8799a83210968746c4d3e364ee512669e6080c6b3d215d97c141e8ef7f09152ea524691efcd2276acb1dc158ffd484e3f595ddf2cceb690bd1996c8266

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Debug
                          Filesize

                          112KB

                          MD5

                          d9daf89d86b32df3d7da7ec1cfbf7212

                          SHA1

                          59e1ba3dd32168a3d79a9da2626c99c52970a53e

                          SHA256

                          06f48747a4acb2ee437d03a9e8331cca5c76ee5684e118f491e4faf7799adcc4

                          SHA512

                          24d26b6112417d75915f08562af53eb1bb7ddef2e89e779db52ae0f674ea8ce102984fa2628cee5588c7dc34df00a32497e49ee18f7259c51e4d1c855ab69a6c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Discs
                          Filesize

                          68KB

                          MD5

                          00646a2066d51d9790f52bae3c446c87

                          SHA1

                          ebda2b25b5a46cc6d9d5494050cc4b3a0bf81984

                          SHA256

                          57afab1cec987da27f5e92baa6dc21d83f8c83edf734fc590313102e75844c3a

                          SHA512

                          a74c02ed1b704912a8945e60cacc892f7e832e5cf15c87632b0fd3cbf9ddd8f36b01a5ba87fd7ef87d6becbb297161bb69dc750b8dac6f952892d45cd95f46f0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Dod
                          Filesize

                          3KB

                          MD5

                          682d77b5a6d22691a869ab4bea11ad53

                          SHA1

                          f56fab8959a05c77570652f5f8e9e4103489e676

                          SHA256

                          c269725998f8f5acdab6a0067457065cc9059326ee0a38ff353c2939a0190c1b

                          SHA512

                          c42d04178ed59683fc4597b83496d7b3c61c1a075b4542abb491c9639531f9737d70ae4172186fd6a3450c26701d794496bd4ae0f5e50db8a3818cd78ed7fd27

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Ejaculation
                          Filesize

                          148KB

                          MD5

                          2e9e29f8ed97f2de8ebb1652bdbd545a

                          SHA1

                          5577d360b25daffa0af907fc5d852894b784f81d

                          SHA256

                          aeb399054cff321f752d4f93143815ff1a2cc2398668c2e1110065a2c6f502f1

                          SHA512

                          f4f925daf3f576441d2b7a0e250a51400b23e714d76870a640734912da783d83ac113586f121161d96d7f06eb70b8d89eb4e0524d591232b0b2a342063e8bcb6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Execution
                          Filesize

                          112KB

                          MD5

                          42fb34ddb94507c5a125bf02c2983904

                          SHA1

                          4e400c020121235e3de490f5cbb38c4a25e686dc

                          SHA256

                          d59efea25d1e316b8a9248f52081ab14113c97603f3e90d533f4f373f743b3c7

                          SHA512

                          639d90cd1cd451ebcb9e5e1c165f7eebb62b30d6bf24c596990ca40e08bce5d0b5864e7a4f0a83624c7cf9ac4ec5c1e7385f59602b206f3346554d62721cd71d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Genre
                          Filesize

                          88KB

                          MD5

                          5ce4409c4aaa9fd5a27ec4974734f1df

                          SHA1

                          bf7ee5465ef96ee0186388b5b0685ad727ed9493

                          SHA256

                          a401b4cd0afbaee57d8025bf4fce12583c825cbc2e3d3f308eb0627cd5bba412

                          SHA512

                          1155b1c58221ba1c809d9d60cd440ebd8788dcd3169ee87bda72fb7061b1e2f849f8bc79ac7053df5de8bc7955db088df778af66900d6f303bde6d61925014e6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Marijuana
                          Filesize

                          58KB

                          MD5

                          d830821fe60d6cd810fb9ec7102838f3

                          SHA1

                          9264b78903fa373e0a1b697cc056decc1dfafb5f

                          SHA256

                          00a96ac0e8600a9fa0a00ef1f939b58be93618c4fe4e3be9d0bfab0a4a0ff57d

                          SHA512

                          2a8e2bb9d599964ca112aacbb0fda37c01466898a7af5d7c8543013949b0bc6e5665402692a1072845b1a72211d350963c608a81a7c3450c19a56a948ced5d4d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Mj
                          Filesize

                          97KB

                          MD5

                          ff77a17e4cade79760f0f8b87c857c6c

                          SHA1

                          b05075d65229af0063e6e85da14ab940062818dd

                          SHA256

                          cc8a9523b67f764e447cd5042751e1de77b04ffc5664e6f5c41d1c3cce0ec60d

                          SHA512

                          6df97dcb14736d2f0ce9762b7246050b488e054375c78f42294119d80cacedcf53f4b3868b7a4c948dd7b1f9545b4135f5bd5ed69611424129cae63a372994d0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Mysterious
                          Filesize

                          89KB

                          MD5

                          beef30c9a0c6a41985e081cd4ff23049

                          SHA1

                          4e09ffaf608baf3a98cd94794cb7cc23e41c3086

                          SHA256

                          fc64f325cdd473adb5b7c15221f7b2773a064395612eff9ad1c76fa973a6738a

                          SHA512

                          ec71cdb716b684b241a2fa2bca84cbced9aa86ba0954009dc003ef1f80640c01d49911ec6e031e9f8e8139d30bf5a77d7a79ee38f66b8fd43a6e4f957cb8e1ca

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Producing
                          Filesize

                          71KB

                          MD5

                          aa4d881ea35979e4eab13c982d3d0898

                          SHA1

                          cf301086d6e43e603571762fbc7d754f0246fb74

                          SHA256

                          31d85bebe7949c9b7b40af007fbbe61c8cd6c25f8e4fc7dcfe9b7dcd8a1d79e7

                          SHA512

                          f64491753f2cf57b72740ca91f10c2bd677219bc89bf86d2476a8567cf83955f986a481c92d19bef9c466438af97d071686ea2fc496c5e477c900568f129b5f6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Receiving
                          Filesize

                          61KB

                          MD5

                          8d5cf0056a8be7ca1485969fc23f72a5

                          SHA1

                          5727bc17cd958d06b1e7d52c8d38a761a1ae2bf2

                          SHA256

                          bd1b00dea1cddb3345443a35ae3b71883443722edbb48016f829ac500f5f505b

                          SHA512

                          b0f5fb69a565fc9690f307175c606ce9f9484bc309ac00b8a359cb6b77d19a938052ec584919a256fdb7c0b1557e155b414090b771432acb9419102f794b61ec

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Solely
                          Filesize

                          105KB

                          MD5

                          2fadd2bf6f3cdc055416baa1528652e9

                          SHA1

                          342d96c7ce7b431e76c15c9a7386c2a75e3dc511

                          SHA256

                          8df18d17c715e689b9cb222beb699120b592464460fd407dbb14f59ccec5fdb3

                          SHA512

                          08bc19703dad1441e1da8fb011c42241a4c90d8355575b7f41d465e3e84d797ecac7d6bf9af6163e6f4ef506cd98561f62d06446f861aeba2d7644beb7f6abb8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Sunrise
                          Filesize

                          62KB

                          MD5

                          9e4fe1f2538c08f75ae16a3e349c9ef2

                          SHA1

                          559879228568b2f405400b34dfb19e59f139fa2c

                          SHA256

                          22ce756672aca3a4ba015903b4c36e7667e15c73157759e5a2212e7d4e727cc0

                          SHA512

                          a1f6bf183c590cc62000dddb0fea63bae2bdc30fce8ebfa24286b9fb8b2415c67b2363f739d36b32cc7b477e608397efbe45173173aa3f27ed44e9b75448b9ec

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar22D1.tmp
                          Filesize

                          181KB

                          MD5

                          4ea6026cf93ec6338144661bf1202cd1

                          SHA1

                          a1dec9044f750ad887935a01430bf49322fbdcb7

                          SHA256

                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                          SHA512

                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Veterinary
                          Filesize

                          2KB

                          MD5

                          6f07c56590cb57e03b68f9e2f994390c

                          SHA1

                          aee254034b1f3394a97304c8dfbae1911440e2c0

                          SHA256

                          1772cfd25c5deb74dacc6fc88aa8793a74c89a81452b27e886ca49557ba32d84

                          SHA512

                          0af18e6d07c161a5088cec9a56654c9f661ac003f0e22b68b6dbfe2920bb344f4d9a1326c261957c2309bb44dcb39453630f33068a057a1a6c2960edfbd39001

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                          Filesize

                          124KB

                          MD5

                          0d3418372c854ee228b78e16ea7059be

                          SHA1

                          c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1

                          SHA256

                          885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7

                          SHA512

                          e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\1006343001\goldddd123.exe
                          Filesize

                          758KB

                          MD5

                          2d6f91549d53930821ea4cf0fbd54b29

                          SHA1

                          8d22716e08327026fd0e0693eb4607008f189a79

                          SHA256

                          5601bb520ce3526f6a6e23646183e822d531e402ba174225ce8541d57a8b8630

                          SHA512

                          d8cc636347ddb97e596625a3ea61a6f3ad9083eedc3421f9e8d19b03c824a3bb2f582b689e341bfd951ec6ce13cf8fe3218325f97b337ed4e3314e23f1ef94c0

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\370821\Sale.com
                          Filesize

                          925KB

                          MD5

                          62d09f076e6e0240548c2f837536a46a

                          SHA1

                          26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

                          SHA256

                          1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

                          SHA512

                          32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                          Filesize

                          1.8MB

                          MD5

                          230619f751a119a1d428db0e3850fac3

                          SHA1

                          06bf7c3deaeb25ebc601dba5f2070255534c2f69

                          SHA256

                          8df406919a6e208e397a486056005e280ca13a744631045b0eb295a96a14b572

                          SHA512

                          2ce7b9078b52b55da6727200a198c5520aba28820d2da435fa16a90479177635565241e18fa6a4cf8b04fdc955189f3e08b6bae95566188c41a4231ed2fd6cc7

                          Download Submit

                        • memory/536-764-0x0000000000360000-0x0000000000806000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/896-765-0x0000000000240000-0x0000000000EAC000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/896-500-0x0000000000240000-0x0000000000EAC000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/896-888-0x0000000000240000-0x0000000000EAC000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/896-777-0x0000000000240000-0x0000000000EAC000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/1536-480-0x0000000000400000-0x0000000000C3F000-memory.dmp

                          Filesize

                          8.2MB

                          Download

                        • memory/1536-926-0x0000000000400000-0x0000000000C3F000-memory.dmp

                          Filesize

                          8.2MB

                          Download

                        • memory/1536-505-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/1536-526-0x0000000000400000-0x0000000000C3F000-memory.dmp

                          Filesize

                          8.2MB

                          Download

                        • memory/1536-574-0x0000000000400000-0x0000000000C3F000-memory.dmp

                          Filesize

                          8.2MB

                          Download

                        • memory/1664-457-0x0000000000A20000-0x0000000000D32000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/1664-475-0x0000000000A20000-0x0000000000D32000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/1764-52-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1764-43-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1764-56-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1764-55-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1764-45-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1764-48-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1764-50-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1764-49-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/1764-47-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/2116-106-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/2116-110-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2116-113-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/2116-111-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/2116-108-0x0000000000400000-0x0000000000456000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/2232-0-0x0000000000880000-0x0000000000D33000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2232-1-0x0000000077E20000-0x0000000077E22000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2232-2-0x0000000000881000-0x00000000008AF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2232-3-0x0000000000880000-0x0000000000D33000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2232-5-0x0000000000880000-0x0000000000D33000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2232-17-0x0000000000880000-0x0000000000D33000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2232-20-0x0000000006CF0000-0x00000000071A3000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2320-808-0x0000000006C10000-0x00000000070B6000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2320-476-0x0000000000970000-0x0000000000C82000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2320-524-0x0000000006C10000-0x00000000070B6000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2320-525-0x0000000006C10000-0x00000000070B6000-memory.dmp

                          Filesize

                          4.6MB

                          Download

                        • memory/2320-503-0x0000000000970000-0x0000000000C82000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2320-573-0x0000000000970000-0x0000000000C82000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2756-483-0x0000000001350000-0x000000000184C000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/2756-486-0x0000000001350000-0x000000000184C000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/2756-945-0x0000000001350000-0x000000000184C000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/2756-528-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                          Filesize

                          972KB

                          Download

                        • memory/2756-424-0x0000000001350000-0x000000000184C000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/2756-776-0x0000000001350000-0x000000000184C000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/2916-439-0x00000000000B0000-0x0000000000106000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/2916-437-0x00000000000B0000-0x0000000000106000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/2916-436-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2916-484-0x00000000000B0000-0x0000000000106000-memory.dmp

                          Filesize

                          344KB

                          Download

                        • memory/3036-641-0x0000000007210000-0x0000000007E7C000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/3036-423-0x0000000007310000-0x000000000780C000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/3036-289-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-479-0x00000000073D0000-0x0000000007C0F000-memory.dmp

                          Filesize

                          8.2MB

                          Download

                        • memory/3036-422-0x0000000007310000-0x000000000780C000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/3036-114-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-510-0x00000000073D0000-0x0000000007C0F000-memory.dmp

                          Filesize

                          8.2MB

                          Download

                        • memory/3036-481-0x0000000007310000-0x000000000780C000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/3036-98-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-23-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-22-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-21-0x0000000000B91000-0x0000000000BBF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/3036-509-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-19-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-781-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-482-0x0000000007310000-0x000000000780C000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/3036-131-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-182-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-498-0x0000000007350000-0x0000000007662000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3036-183-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-441-0x0000000000B90000-0x0000000001043000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3036-499-0x0000000007210000-0x0000000007E7C000-memory.dmp

                          Filesize

                          12.4MB

                          Download

                        • memory/3036-456-0x0000000007350000-0x0000000007662000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/3120-842-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/3120-844-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/3120-840-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                          Download

                        • memory/3332-879-0x0000000000F30000-0x0000000000F82000-memory.dmp

                          Filesize

                          328KB

                          Download

                        • memory/3564-814-0x00000000020F0000-0x00000000020F8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/3564-813-0x000000001B510000-0x000000001B7F2000-memory.dmp

                          Filesize

                          2.9MB

                          Download