c371b2ac1e10966cd55614cc9e69564d04674f70bb6a187f73423115961e3216

Analysis

max time kernel
150s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2023 07:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VIP X Tiger King.exe
Size

2.6MB
MD5

e27e22d4d7a69afde5ed6cbea44aa36e
SHA1

ed72881802946c58fa9c258a6d524ffdf6f82d64
SHA256

c371b2ac1e10966cd55614cc9e69564d04674f70bb6a187f73423115961e3216
SHA512

49f4bad3dfa7bd308ec27f44c1e59cb106e5b94cbb37fb9ff10863a95bcb800e4af66a3282891c777107106ac75ace347be8e59169da8b2f34812735125249e9
SSDEEP

49152:suLclBtZBMqDkAfFm75qmbavcQdV5+7nfxf2AJ9MRWxPuJLbpUMIR:1OBtZKqKCjr5+7fx+AJS4x4LbpU9

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
4280	vip x tiger king.exe
4144	icsys.icn.exe
3280	explorer.exe
4004	spoolsv.exe
1620	svchost.exe
4304	spoolsv.exe
3016	CB.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	vip x tiger king.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	VIP X Tiger King.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\CB.exe	vip x tiger king.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
4144	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3280	explorer.exe
1620	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2064	VIP X Tiger King.exe
2064	VIP X Tiger King.exe
4144	icsys.icn.exe
4144	icsys.icn.exe
3280	explorer.exe
3280	explorer.exe
4004	spoolsv.exe
4004	spoolsv.exe
1620	svchost.exe
1620	svchost.exe
4304	spoolsv.exe
4304	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4280	2064	VIP X Tiger King.exe	82
PID 2064 wrote to memory of 4280	2064	VIP X Tiger King.exe	82
PID 2064 wrote to memory of 4280	2064	VIP X Tiger King.exe	82
PID 2064 wrote to memory of 4144	2064	VIP X Tiger King.exe	83
PID 2064 wrote to memory of 4144	2064	VIP X Tiger King.exe	83
PID 2064 wrote to memory of 4144	2064	VIP X Tiger King.exe	83
PID 4144 wrote to memory of 3280	4144	icsys.icn.exe	85
PID 4144 wrote to memory of 3280	4144	icsys.icn.exe	85
PID 4144 wrote to memory of 3280	4144	icsys.icn.exe	85
PID 3280 wrote to memory of 4004	3280	explorer.exe	86
PID 3280 wrote to memory of 4004	3280	explorer.exe	86
PID 3280 wrote to memory of 4004	3280	explorer.exe	86
PID 4280 wrote to memory of 3656	4280	vip x tiger king.exe	88
PID 4280 wrote to memory of 3656	4280	vip x tiger king.exe	88
PID 4280 wrote to memory of 3656	4280	vip x tiger king.exe	88
PID 4004 wrote to memory of 1620	4004	spoolsv.exe	87
PID 4004 wrote to memory of 1620	4004	spoolsv.exe	87
PID 4004 wrote to memory of 1620	4004	spoolsv.exe	87
PID 3656 wrote to memory of 220	3656	cmd.exe	89
PID 3656 wrote to memory of 220	3656	cmd.exe	89
PID 3656 wrote to memory of 220	3656	cmd.exe	89
PID 1620 wrote to memory of 4304	1620	svchost.exe	90
PID 1620 wrote to memory of 4304	1620	svchost.exe	90
PID 1620 wrote to memory of 4304	1620	svchost.exe	90
PID 4280 wrote to memory of 1980	4280	vip x tiger king.exe	91
PID 4280 wrote to memory of 1980	4280	vip x tiger king.exe	91
PID 4280 wrote to memory of 1980	4280	vip x tiger king.exe	91
PID 4280 wrote to memory of 3624	4280	vip x tiger king.exe	92
PID 4280 wrote to memory of 3624	4280	vip x tiger king.exe	92
PID 4280 wrote to memory of 3624	4280	vip x tiger king.exe	92
PID 4280 wrote to memory of 1376	4280	vip x tiger king.exe	93
PID 4280 wrote to memory of 1376	4280	vip x tiger king.exe	93
PID 4280 wrote to memory of 1376	4280	vip x tiger king.exe	93
PID 4280 wrote to memory of 1356	4280	vip x tiger king.exe	94
PID 4280 wrote to memory of 1356	4280	vip x tiger king.exe	94
PID 4280 wrote to memory of 1356	4280	vip x tiger king.exe	94
PID 4280 wrote to memory of 4916	4280	vip x tiger king.exe	95
PID 4280 wrote to memory of 4916	4280	vip x tiger king.exe	95
PID 4280 wrote to memory of 4916	4280	vip x tiger king.exe	95
PID 4280 wrote to memory of 5012	4280	vip x tiger king.exe	96
PID 4280 wrote to memory of 5012	4280	vip x tiger king.exe	96
PID 4280 wrote to memory of 5012	4280	vip x tiger king.exe	96
PID 4280 wrote to memory of 5060	4280	vip x tiger king.exe	97
PID 4280 wrote to memory of 5060	4280	vip x tiger king.exe	97
PID 4280 wrote to memory of 5060	4280	vip x tiger king.exe	97
PID 4280 wrote to memory of 996	4280	vip x tiger king.exe	98
PID 4280 wrote to memory of 996	4280	vip x tiger king.exe	98
PID 4280 wrote to memory of 996	4280	vip x tiger king.exe	98
PID 4280 wrote to memory of 4764	4280	vip x tiger king.exe	99
PID 4280 wrote to memory of 4764	4280	vip x tiger king.exe	99
PID 4280 wrote to memory of 4764	4280	vip x tiger king.exe	99
PID 4280 wrote to memory of 2984	4280	vip x tiger king.exe	100
PID 4280 wrote to memory of 2984	4280	vip x tiger king.exe	100
PID 4280 wrote to memory of 2984	4280	vip x tiger king.exe	100
PID 4280 wrote to memory of 3296	4280	vip x tiger king.exe	101
PID 4280 wrote to memory of 3296	4280	vip x tiger king.exe	101
PID 4280 wrote to memory of 3296	4280	vip x tiger king.exe	101
PID 4280 wrote to memory of 4748	4280	vip x tiger king.exe	102
PID 4280 wrote to memory of 4748	4280	vip x tiger king.exe	102
PID 4280 wrote to memory of 4748	4280	vip x tiger king.exe	102
PID 4280 wrote to memory of 3364	4280	vip x tiger king.exe	103
PID 4280 wrote to memory of 3364	4280	vip x tiger king.exe	103
PID 4280 wrote to memory of 3364	4280	vip x tiger king.exe	103
PID 4280 wrote to memory of 3048	4280	vip x tiger king.exe	104

C:\Users\Admin\AppData\Local\Temp\VIP X Tiger King.exe
"C:\Users\Admin\AppData\Local\Temp\VIP X Tiger King.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- \??\c:\users\admin\appdata\local\temp\vip x tiger king.exe
  "c:\users\admin\appdata\local\temp\vip x tiger king.exe "
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c MODE CON COLS=19 LINES=2
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3656
  - - C:\Windows\SysWOW64\mode.com
      MODE CON COLS=19 LINES=2
      4⤵
      PID:220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3296
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3364
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4424
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4120
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:5016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:540
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3928
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:5112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4684
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3756
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4148
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3836
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:480
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:5020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4456
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:5036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3788
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3092
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3324
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:880
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1692
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:8
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3544
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4128
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:956
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4520
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4568
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2164
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2096
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:444
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2676
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:936
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4740
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4388
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3088
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:3136
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c Color B
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c CLS
    3⤵
    PID:3424
- - C:\Windows\CB.exe
    "C:\Windows\CB.exe"
    3⤵
    - Executes dropped EXE
    PID:3016
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c MODE CON COLS=215 LINES=22
      4⤵
      PID:2492
    - - C:\Windows\SysWOW64\mode.com
        
        MODE CON COLS=215 LINES=22
        5⤵
        
        PID:2976
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c Color A
      4⤵
      PID:3592
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4144
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4004
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1620
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\vip x tiger king.exe

Filesize
2.5MB

MD5
82f6956b19929bdd329eb1bd3e82737b

SHA1
f82a8612f0f1f4450dbccdab384752b92cbd49d3

SHA256
9cf18172ea095ac7bb1453e9f4a0ba21af67147d38fd7ef837ea8a26a8cef1b8

SHA512
995d1d62b8d0744d1c7fbb00607bf52a552dff589205a1f239f9a0a794103bd76eb7b78c48a4069183eb4bec36177a94c8e2a5b3b608e384d1028bab47110bd1

Download Submit
C:\Windows\CB.exe

Filesize
2.7MB

MD5
901401fae956333e7bbae211510984dc

SHA1
21fd2f262d362534f6ca4eb7b1dacebc97e5f2f7

SHA256
77d071a3200427d6b849fc8dae5274e9b4ee11c606c6f249e51c8c9b5e3a8319

SHA512
3bcda43421f8701d1222f67be9afeaecc70d95db0123834a3378c9168dd953ceebc58a472130df68e4d1d50351de613f4091a668f80f3842a208f6ecec2249db

Download Submit
C:\Windows\CB.exe

Filesize
2.7MB

MD5
901401fae956333e7bbae211510984dc

SHA1
21fd2f262d362534f6ca4eb7b1dacebc97e5f2f7

SHA256
77d071a3200427d6b849fc8dae5274e9b4ee11c606c6f249e51c8c9b5e3a8319

SHA512
3bcda43421f8701d1222f67be9afeaecc70d95db0123834a3378c9168dd953ceebc58a472130df68e4d1d50351de613f4091a668f80f3842a208f6ecec2249db

Download Submit
C:\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
97a8833ba3973129106638dccf63b3d9

SHA1
dd636ad54d621ca9e6cc43e30a0378173b2ce283

SHA256
2de405006423010cb64f28eb16b91a6a00b194fc23818a81b1e3596a9e6abea6

SHA512
bc1379a0e568fac4e0c9182408d8e3d37bcb395250576746e7165699d658b918dfdf2ddec42eaaddd5b76b56370bc890289485883c3a0dc6337ebebe0fb3c57f

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
cad6a6d9413a8b0fd6b40b7e6fc119ac

SHA1
dd786df2e2340d5e7b1a4ec25117dba831b06aba

SHA256
b400cc5d28f0c2a9ea6b9bcd64e913eff785e1f1723378be039307b4dc69d3fc

SHA512
7f14e608b2fee96426cf879faddf66c61be2e74c6c048b19cd3d6e79f6856a50f71589df124c4f95efc85ca1468b7c99cf662cf199edc7ce2c09632917a92d7b

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
cad6a6d9413a8b0fd6b40b7e6fc119ac

SHA1
dd786df2e2340d5e7b1a4ec25117dba831b06aba

SHA256
b400cc5d28f0c2a9ea6b9bcd64e913eff785e1f1723378be039307b4dc69d3fc

SHA512
7f14e608b2fee96426cf879faddf66c61be2e74c6c048b19cd3d6e79f6856a50f71589df124c4f95efc85ca1468b7c99cf662cf199edc7ce2c09632917a92d7b

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
26fa17c9ab48a7e8dc0e0ec3dae40c94

SHA1
113b59e896058d79780d8c5efbd8e4736311f45d

SHA256
b22939dfacb23443fc5dfd2b15446b6a52f994a6cdcf983f94a10b444b9dd6e2

SHA512
a25dd138ca7e58208d3c8b384a91941f7cf90ffd20f60927af3fab83aa6b6cc39283cda3f48ad966b957c0e3e19c5066266a08d0a8a194ca53bcdafd2ca31ef7

Download Submit
C:\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
26fa17c9ab48a7e8dc0e0ec3dae40c94

SHA1
113b59e896058d79780d8c5efbd8e4736311f45d

SHA256
b22939dfacb23443fc5dfd2b15446b6a52f994a6cdcf983f94a10b444b9dd6e2

SHA512
a25dd138ca7e58208d3c8b384a91941f7cf90ffd20f60927af3fab83aa6b6cc39283cda3f48ad966b957c0e3e19c5066266a08d0a8a194ca53bcdafd2ca31ef7

Download Submit
C:\Windows\Resources\svchost.exe

Filesize
135KB

MD5
f872e8e2c7fdf7a9923fac5917c97fd2

SHA1
5027aad21f4f5b0cccd709bf3cba0122f0a0d54d

SHA256
e53e83744d6ba92b5f5be510303513052f9733b1d388ac29ebf7a0aaec336060

SHA512
5fd327cc4be561784204deed9a437944ac1f803640f91c75ce152d668b9cf6c837e3fed9e7da53371d4882ccca8ec0fbb7a0ce75df1ba4ad1a21f1000becce0f

Download Submit
\??\c:\users\admin\appdata\local\temp\vip x tiger king.exe

Filesize
2.5MB

MD5
82f6956b19929bdd329eb1bd3e82737b

SHA1
f82a8612f0f1f4450dbccdab384752b92cbd49d3

SHA256
9cf18172ea095ac7bb1453e9f4a0ba21af67147d38fd7ef837ea8a26a8cef1b8

SHA512
995d1d62b8d0744d1c7fbb00607bf52a552dff589205a1f239f9a0a794103bd76eb7b78c48a4069183eb4bec36177a94c8e2a5b3b608e384d1028bab47110bd1

Download Submit
\??\c:\windows\resources\spoolsv.exe

Filesize
135KB

MD5
26fa17c9ab48a7e8dc0e0ec3dae40c94

SHA1
113b59e896058d79780d8c5efbd8e4736311f45d

SHA256
b22939dfacb23443fc5dfd2b15446b6a52f994a6cdcf983f94a10b444b9dd6e2

SHA512
a25dd138ca7e58208d3c8b384a91941f7cf90ffd20f60927af3fab83aa6b6cc39283cda3f48ad966b957c0e3e19c5066266a08d0a8a194ca53bcdafd2ca31ef7

Download Submit
\??\c:\windows\resources\svchost.exe

Filesize
135KB

MD5
f872e8e2c7fdf7a9923fac5917c97fd2

SHA1
5027aad21f4f5b0cccd709bf3cba0122f0a0d54d

SHA256
e53e83744d6ba92b5f5be510303513052f9733b1d388ac29ebf7a0aaec336060

SHA512
5fd327cc4be561784204deed9a437944ac1f803640f91c75ce152d668b9cf6c837e3fed9e7da53371d4882ccca8ec0fbb7a0ce75df1ba4ad1a21f1000becce0f

Download Submit
\??\c:\windows\resources\themes\explorer.exe

Filesize
135KB

MD5
97a8833ba3973129106638dccf63b3d9

SHA1
dd636ad54d621ca9e6cc43e30a0378173b2ce283

SHA256
2de405006423010cb64f28eb16b91a6a00b194fc23818a81b1e3596a9e6abea6

SHA512
bc1379a0e568fac4e0c9182408d8e3d37bcb395250576746e7165699d658b918dfdf2ddec42eaaddd5b76b56370bc890289485883c3a0dc6337ebebe0fb3c57f

Download Submit
memory/1620-169-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1620-237-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2064-177-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2064-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3280-236-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3280-167-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4004-168-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4004-175-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4144-176-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4144-145-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4304-174-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download