gozi | c442edf2f963a0fa28e9525ec63904241dd78f0d1310f770f2f9a2f14b21aece

Analysis

max time kernel
374s
max time network
420s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
21-10-2023 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Downloads.zip
Size

23.1MB
MD5

c680ac48333450b51b7864d21895cc90
SHA1

92870f185c6be6b8d55a294f5de59c98061193d8
SHA256

c442edf2f963a0fa28e9525ec63904241dd78f0d1310f770f2f9a2f14b21aece
SHA512

29d5cb0edc4ce466bf8543305152e1d271d2357c00a688e48e63645742dc8c84ffd75860c809946507ed6ad5a4afa96c278e95916518574b53f6613d5ea9e250
SSDEEP

393216:wBRF+vGbfzxpO829aWD/mttgSwnN4KC3/ARTOTKUNRKLyktlwrSOR:gF66S829n/WwuoRToKU/KLT+J

Score

10^/10

gozi 1000 banker evasion isfb phishing trojan upx

Malware Config

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

1000

repeseparation.ru

Attributes

exe_type
worker
server_id
12

rsa_pubkey.plain

serpent.plain

Signatures

Detected phishing page
phishing
Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Nirsoft 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4340-184-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/4340-185-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/764-419-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 4 IoCs

Processes:

winhlp64.exenircmd.exewinhlp64.exenircmd.exe

pid process

3376 winhlp64.exe
4340 nircmd.exe
4692 winhlp64.exe
764 nircmd.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\nircmd.exe	upx
C:\Windows\nircmd.exe	upx
behavioral1/memory/4340-184-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/4340-185-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2QHBPY3\nircmd[1].exe	upx
C:\Windows\nircmd.exe	upx
C:\Windows\nircmd.exe	upx
behavioral1/memory/764-418-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/764-419-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

26 myexternalip.com
27 myexternalip.com
67 myexternalip.com
68 myexternalip.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

Google.exe

pid process

2724 Google.exe
2724 Google.exe

flow	ioc
26	myexternalip.com
27	myexternalip.com
67	myexternalip.com
68	myexternalip.com

pid	process
2724	Google.exe
2724	Google.exe

Drops file in Program Files directory 2 IoCs

Processes:

winhlp64.exewinhlp64.exe

description	ioc	process
File created	C:\Program Files (x86)\MTA San Andreas 1.6\MTA\basso3pus1-6.dll	winhlp64.exe
File created	C:\Program Files (x86)\MTA San Andreas 1.6\MTA\basso3pus1-6.dll	winhlp64.exe

Drops file in Windows directory 55 IoCs

Processes:

cmd.exewinhlp64.exewinhlp64.exe83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.execmd.exe

description	ioc	process
File created	C:\Windows\winhlp64.exe	cmd.exe
File created	C:\Windows\cguuiM.exe	winhlp64.exe
File created	C:\Windows\twain_64.dll	winhlp64.exe
File created	C:\Windows\zlib1.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\notepad_.dll	winhlp64.exe
File created	C:\Windows\splwow32.exe	winhlp64.exe
File created	C:\Windows\ldplayers.exe	winhlp64.exe
File created	C:\Windows\WinSAT-334.txt	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\libcrypto-1_1.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\AsmResolve2r.PE.dll	winhlp64.exe
File created	C:\Windows\WinSAT-334.txt	winhlp64.exe
File created	C:\Windows\nircmd.exe	winhlp64.exe
File created	C:\Windows\ldplayers.exe	winhlp64.exe
File created	C:\Windows\Tasks\SA.json	winhlp64.exe
File created	C:\Windows\twain_32\winhlp32_x86.exe	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\dpp.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\basswebmss.dll	winhlp64.exe
File created	C:\Windows\Help\Windows\IndexStore\en-US\IndexStores-x86.dll	winhlp64.exe
File created	C:\Windows\libsodium.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\zlib1.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\AsmResolve1-6r.dll	winhlp64.exe
File created	C:\Windows\WinSAT-334.txt	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\AsmResolve1-6r.dll	winhlp64.exe
File created	C:\Windows\opus_32.dll	winhlp64.exe
File created	C:\Windows\basswebmss.dll	winhlp64.exe
File created	C:\Windows\opus.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\hXwarGVhWD.dll	winhlp64.exe
File created	C:\Windows\Help\Windows\IndexStore\en-US\IndexStoreInit.dll	winhlp64.exe
File opened for modification	C:\Windows\Help\Windows\IndexStore\en-US\IndexStoreInit.dll	winhlp64.exe
File created	C:\Windows\opus.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File opened for modification	C:\Windows\winhlp64.exe	cmd.exe
File created	C:\Windows\cguuiM.exe	winhlp64.exe
File created	C:\Windows\nircmd.exe	winhlp64.exe
File created	C:\Windows\libcrypto-1_1.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File opened for modification	C:\Windows\winhlp64.exe	cmd.exe
File created	C:\Windows\Help\Windows\IndexStore\en-US\IndexStores-2.0.dll	winhlp64.exe
File created	C:\Windows\notepad_.dll	winhlp64.exe
File created	C:\Windows\Help\Windows\IndexStore\en-US\IndexStoreInit.dll	winhlp64.exe
File created	C:\Windows\libssl-1_1.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\Help\Windows\IndexStore\en-US\IndexStores-x86.dll	winhlp64.exe
File created	C:\Windows\dpp.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\winhlp32.dll	winhlp64.exe
File created	C:\Windows\twain_32\winhlp32_x86.exe	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\libsodium.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\libssl-1_1.dll	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
File created	C:\Windows\opus_32.dll	winhlp64.exe
File created	C:\Windows\hXwarGVhWD.dll	winhlp64.exe
File created	C:\Windows\AsmResolve2r.PE.dll	winhlp64.exe
File opened for modification	C:\Windows\notepad_.dll	winhlp64.exe
File created	C:\Windows\Tasks\SA.txt	winhlp64.exe
File created	C:\Windows\Help\Windows\IndexStore\en-US\IndexStores-2.0.dll	winhlp64.exe
File created	C:\Windows\Descongic.dll	winhlp64.exe
File opened for modification	C:\Windows\Tasks\SA.txt	winhlp64.exe
File created	C:\Windows\Descongic.dll	winhlp64.exe
File created	C:\Windows\WinSAT-334.txt	winhlp64.exe

Launches sc.exe 19 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	process
4652	sc.exe
2124	sc.exe
1784	sc.exe
2192	sc.exe
3944	sc.exe
5108	sc.exe
8	sc.exe
2656	sc.exe
4324	sc.exe
2812	sc.exe
660	sc.exe
2748	sc.exe
2108	sc.exe
4656	sc.exe
1444	sc.exe
324	sc.exe
600	sc.exe
3584	sc.exe
1232	sc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

winhlp64.exewinhlp64.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winhlp64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winhlp64.exe

Enumerates system info in registry 2 TTPs 20 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

winhlp64.exewinhlp64.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	winhlp64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOSReleaseDate	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOSReleaseDate	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosDate	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	winhlp64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	winhlp64.exe

Kills process with taskkill 14 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1792	taskkill.exe
3628	taskkill.exe
4100	taskkill.exe
2140	taskkill.exe
4872	taskkill.exe
4156	taskkill.exe
4968	taskkill.exe
3036	taskkill.exe
2148	taskkill.exe
3508	taskkill.exe
352	taskkill.exe
1276	taskkill.exe
1428	taskkill.exe
2296	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

winhlp64.exe

pid	process
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe
3376	winhlp64.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

winhlp64.exewinhlp64.exe

pid process

3376 winhlp64.exe
4692 winhlp64.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exeGoogle.exe

pid	process
3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
2724	Google.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.execmd.exewinhlp64.execmd.exe83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.execmd.exewinhlp64.execmd.exe

description	pid	process	target process
PID 3996 wrote to memory of 5116	3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 3996 wrote to memory of 5116	3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 3996 wrote to memory of 5116	3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 3996 wrote to memory of 4152	3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 3996 wrote to memory of 4152	3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 3996 wrote to memory of 4152	3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 3996 wrote to memory of 600	3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 3996 wrote to memory of 600	3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 3996 wrote to memory of 600	3996	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 600 wrote to memory of 3376	600	cmd.exe	winhlp64.exe
PID 600 wrote to memory of 3376	600	cmd.exe	winhlp64.exe
PID 600 wrote to memory of 3376	600	cmd.exe	winhlp64.exe
PID 3376 wrote to memory of 2552	3376	winhlp64.exe	cmd.exe
PID 3376 wrote to memory of 2552	3376	winhlp64.exe	cmd.exe
PID 3376 wrote to memory of 2552	3376	winhlp64.exe	cmd.exe
PID 3376 wrote to memory of 5024	3376	winhlp64.exe	cmd.exe
PID 3376 wrote to memory of 5024	3376	winhlp64.exe	cmd.exe
PID 3376 wrote to memory of 5024	3376	winhlp64.exe	cmd.exe
PID 5024 wrote to memory of 200	5024	cmd.exe	cmd.exe
PID 5024 wrote to memory of 200	5024	cmd.exe	cmd.exe
PID 5024 wrote to memory of 200	5024	cmd.exe	cmd.exe
PID 5024 wrote to memory of 4340	5024	cmd.exe	nircmd.exe
PID 5024 wrote to memory of 4340	5024	cmd.exe	nircmd.exe
PID 5024 wrote to memory of 4340	5024	cmd.exe	nircmd.exe
PID 1816 wrote to memory of 4652	1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 1816 wrote to memory of 4652	1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 1816 wrote to memory of 4652	1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 1816 wrote to memory of 5068	1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 1816 wrote to memory of 5068	1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 1816 wrote to memory of 5068	1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 1816 wrote to memory of 4768	1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 1816 wrote to memory of 4768	1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 1816 wrote to memory of 4768	1816	83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe	cmd.exe
PID 4768 wrote to memory of 4692	4768	cmd.exe	winhlp64.exe
PID 4768 wrote to memory of 4692	4768	cmd.exe	winhlp64.exe
PID 4768 wrote to memory of 4692	4768	cmd.exe	winhlp64.exe
PID 4692 wrote to memory of 3264	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 3264	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 3264	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 668	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 668	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 668	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 2436	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 2436	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 2436	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 652	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 652	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 652	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 4204	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 4204	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 4204	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 4256	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 4256	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 4256	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 524	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 524	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 524	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 1264	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 1264	4692	winhlp64.exe	cmd.exe
PID 4692 wrote to memory of 1264	4692	winhlp64.exe	cmd.exe
PID 1264 wrote to memory of 1236	1264	cmd.exe	cmd.exe
PID 1264 wrote to memory of 1236	1264	cmd.exe	cmd.exe
PID 1264 wrote to memory of 1236	1264	cmd.exe	cmd.exe
PID 1264 wrote to memory of 764	1264	cmd.exe	nircmd.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Downloads.zip
1⤵
PID:4156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Documents\Downloads\gta-sa-famous-landmarks\open_me.bat" "
1⤵
PID:5060

C:\Users\Admin\Documents\Downloads\gta-sa-famous-landmarks\83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
"C:\Users\Admin\Documents\Downloads\gta-sa-famous-landmarks\83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy C:\Windows\twain_32\winhlp32_x86.exe C:\Windows\winhlp64.exe > nul
2⤵
- Drops file in Windows directory
PID:5116

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cd C:\Windows\ > nul
2⤵
PID:4152

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c start winhlp64.exe 4mhhC5a1x4O3r1Qx2vtWWd7GW0xj1M1j5Od3xGlS1ql16n1f11ttG8sz227Mrb1w 3OyO71f216blu522l11l18121vOq1YQ6d1w41f42a0sC5x10480h27n27f12C421 83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe > nul
2⤵
- Suspicious use of WriteProcessMemory
PID:600

C:\Windows\winhlp64.exe
winhlp64.exe 4mhhC5a1x4O3r1Qx2vtWWd7GW0xj1M1j5Od3xGlS1ql16n1f11ttG8sz227Mrb1w 3OyO71f216blu522l11l18121vOq1YQ6d1w41f42a0sC5x10480h27n27f12C421 83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\nircmd.exe nircmd.exe > nul
4⤵
PID:2552

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cmd /c cd C:\Windows && nircmd savescreenshotfull "C:\Users\Admin\AppData\Local\Microsoft\fluency\lm\pt-BR\pooidsa.png" && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\SysWOW64\cmd.exe
cmd /c cd C:\Windows
5⤵
PID:200

C:\Windows\nircmd.exe
nircmd savescreenshotfull "C:\Users\Admin\AppData\Local\Microsoft\fluency\lm\pt-BR\pooidsa.png"
5⤵
- Executes dropped EXE
PID:4340

C:\Users\Admin\Documents\Downloads\gta-sa-famous-landmarks\83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
"C:\Users\Admin\Documents\Downloads\gta-sa-famous-landmarks\83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1816

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c copy C:\Windows\twain_32\winhlp32_x86.exe C:\Windows\winhlp64.exe > nul
2⤵
- Drops file in Windows directory
PID:4652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cd C:\Windows\ > nul
2⤵
PID:5068

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c start winhlp64.exe 4mhhC5a1x4O3r1Qx2vtWWd7GW0xj1M1j5Od3xGlS1ql16n1f11ttG8sz227Mrb1w 3OyO71f216blu522l11l18121vOq1YQ6d1w41f42a0sC5x10480h27n27f12C421 83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe > nul
2⤵
- Suspicious use of WriteProcessMemory
PID:4768

C:\Windows\winhlp64.exe
winhlp64.exe 4mhhC5a1x4O3r1Qx2vtWWd7GW0xj1M1j5Od3xGlS1ql16n1f11ttG8sz227Mrb1w 3OyO71f216blu522l11l18121vOq1YQ6d1w41f42a0sC5x10480h27n27f12C421 83a0720356c6ff0abc3cf203-81b008e67fbe17dafc66132380acc91d3f811f-53713d7ae13d15df6447f6a2ef7a1738.exe
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\splwow32.exe splwow32.exe > nul
4⤵
PID:3264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\Tasks\SA.json SA.json > nul
4⤵
PID:668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\Tasks\SA.json SA.json > nul
4⤵
PID:2436

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\Tasks\SA.json SA.json > nul
4⤵
PID:652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\Tasks\SA.json SA.json > nul
4⤵
PID:4204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\Tasks\SA.json SA.json > nul
4⤵
PID:4256

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\nircmd.exe nircmd.exe > nul
4⤵
PID:524

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cmd /c cd C:\Windows && nircmd savescreenshotfull "C:\Users\Admin\AppData\Local\Microsoft\fluency\lm\pt-BR\pooidsa.png" && exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\SysWOW64\cmd.exe
cmd /c cd C:\Windows
5⤵
PID:1236

C:\Windows\nircmd.exe
nircmd savescreenshotfull "C:\Users\Admin\AppData\Local\Microsoft\fluency\lm\pt-BR\pooidsa.png"
5⤵
- Executes dropped EXE
PID:764

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\twain_64.dll twain_64.dll > nul
4⤵
PID:1280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c rename C:\Windows\winhlp32.dll winhlp32.dll > nul
4⤵
PID:1460

C:\Users\Admin\Documents\Downloads\Google.exe
"C:\Users\Admin\Documents\Downloads\Google.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
2⤵
PID:3084

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:3324

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:3980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
2⤵
PID:1348

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:3544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:4212

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:3420

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:2192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:4696

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:1444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:4480

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
2⤵
PID:3800

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:3944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
2⤵
PID:5060

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:1232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop FACEIT >nul 2>&1
2⤵
PID:4276

C:\Windows\system32\net.exe
net stop FACEIT
3⤵
PID:4144

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop FACEIT
4⤵
PID:4240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c net stop ESEADriver2 >nul 2>&1
2⤵
PID:1796

C:\Windows\system32\net.exe
net stop ESEADriver2
3⤵
PID:1760

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop ESEADriver2
4⤵
PID:4280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:3124

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:5032

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:5108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:4152

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:196

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:4652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
2⤵
PID:1672

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:660

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
2⤵
PID:932

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:2124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerUI.exe >nul 2>&1
2⤵
PID:4208

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerUI.exe
3⤵
- Kills process with taskkill
PID:4968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /f /im HTTPDebuggerSvc.exe >nul 2>&1
2⤵
PID:4884

C:\Windows\system32\taskkill.exe
taskkill /f /im HTTPDebuggerSvc.exe
3⤵
- Kills process with taskkill
PID:1276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:1528

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2748

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
2⤵
PID:2972

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:3628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:2536

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:4100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
2⤵
PID:3040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T >nul 2>&1
2⤵
PID:4576

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq fiddler*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:2140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1
2⤵
PID:4420

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:3508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T >nul 2>&1
2⤵
PID:4244

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq rawshark*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:1428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq charles*" /IM * /F /T >nul 2>&1
2⤵
PID:980

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq charles*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:2148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1
2⤵
PID:3540

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:4872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq ida*" /IM * /F /T >nul 2>&1
2⤵
PID:4668

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq ida*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1
2⤵
PID:5052

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:1792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T >nul 2>&1
2⤵
PID:2980

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
3⤵
- Kills process with taskkill
PID:2296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1
2⤵
PID:4912

C:\Windows\system32\sc.exe
sc stop HTTPDebuggerPro
3⤵
- Launches sc.exe
PID:2108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker3 >nul 2>&1
2⤵
PID:3840

C:\Windows\system32\sc.exe
sc stop KProcessHacker3
3⤵
- Launches sc.exe
PID:4656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker2 >nul 2>&1
2⤵
PID:1664

C:\Windows\system32\sc.exe
sc stop KProcessHacker2
3⤵
- Launches sc.exe
PID:3584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop KProcessHacker1 >nul 2>&1
2⤵
PID:4700

C:\Windows\system32\sc.exe
sc stop KProcessHacker1
3⤵
- Launches sc.exe
PID:8

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop wireshark >nul 2>&1
2⤵
PID:3264

C:\Windows\system32\sc.exe
sc stop wireshark
3⤵
- Launches sc.exe
PID:2656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop npf >nul 2>&1
2⤵
PID:668

C:\Windows\system32\sc.exe
sc stop npf
3⤵
- Launches sc.exe
PID:4324

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Documents\Downloads\Google.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
2⤵
PID:5040

C:\Windows\system32\certutil.exe
certutil -hashfile "C:\Users\Admin\Documents\Downloads\Google.exe" MD5
3⤵
PID:5080

C:\Windows\system32\find.exe
find /i /v "md5"
3⤵
PID:652

C:\Windows\system32\find.exe
find /i /v "certutil"
3⤵
PID:5024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c taskkill /IM Taskmgr.exe
2⤵
PID:3136

C:\Windows\system32\taskkill.exe
taskkill /IM Taskmgr.exe
3⤵
- Kills process with taskkill
PID:4156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c MODE CON COLS=55 LINES=12
2⤵
PID:2172

C:\Windows\system32\mode.com
MODE CON COLS=55 LINES=12
3⤵
PID:228

C:\Windows\system32\taskkill.exe
taskkill /FI "IMAGENAME eq processhacker*" /IM * /F /T
1⤵
- Kills process with taskkill
PID:3036

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Filesize
717B

MD5
60fe01df86be2e5331b0cdbe86165686

SHA1
2a79f9713c3f192862ff80508062e64e8e0b29bd

SHA256
c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

SHA512
ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
1KB

MD5
872cd6d2df25153bf3d13e5e244cf8eb

SHA1
a3f69cc53f9e24ad39cd2b65a1073d2f63d45ba7

SHA256
e94505546bb05e20786906d5b91a3a226b6165c463477872ae45e6ace6e6b0de

SHA512
f5925c88f82d7a0045c4fd94d188283502947da3ff70f99981e20f265362138a12bb60410e31decabe90529c0453ac466463041f2d7be884ddcaebd0e9315563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\737472DF998DFE19B5441B884791F700
Filesize
503B

MD5
6da0d765725eedd8655d1bbac56266f4

SHA1
ed69dc61b929aa3da5cde83befbd27a7dccc45ef

SHA256
cc8132cc515dad2b059d0fb0309539c70752a75fea2978565bd4cd606b51667e

SHA512
8023bef253c298e12245181d0e0228529233cd44ac8ba8537041d597b5d0a733a8e4d1f99372288731a3d3ebe09c1a836067c4ce993a8e26ee9744ce9290a4d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize
192B

MD5
ee9bf188e8f024a03906b64909dc0ca9

SHA1
565cacc15725109199548f48834af97b570c5bb0

SHA256
271ce6b2ed116b52b7914d7717111ff1660aeda77761ecbc62d15fb42c445b14

SHA512
a13ed59dd874e580cf0b2956ed2b792ccccc05e760bef32e55abd52119b56f88417a524c127aaf1d33148fdd17c4ad434c061e56950dfd2322ae501c51f5ea64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Filesize
408B

MD5
624536edcc4ce48b192146d749bdba30

SHA1
3aecb880677be08d0824e153192993a5e4c0d311

SHA256
5b376bb2edb458bd8aa5e4ccd30a0b379cd79861ad5029e72077e6c4318d89b3

SHA512
47fa4097ba3f9021728134b0d306771d151f3a47485eea89c2b2de00d28e5805788d5c1b7d78a16135538ef495e382430eec4ee26205e4feda10875a30b90c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\737472DF998DFE19B5441B884791F700
Filesize
556B

MD5
0515cd8fc60dfdf1d5d9a2e55575cb77

SHA1
d2e7a2eb0d692ce8c0e079b91953a3103fa815ca

SHA256
b661fec75f03571f4959356311cde99299e0abcb641df1a0ac38d4cfa15ea9e9

SHA512
8aca3d5e040630cc453adf769676c4bfc011c60baa3d26638775ffcd98729e071b9a36c67f7a3ed2b8c4f67cf7a3cc96e2604c085fee6c5ed9e1690fa756fbe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1CWA04S8\1AfG3j1iztbjf72I1W400bAxrC5Y1vgwbrQ2dC4pI22toxta1lexw8yp1112218s[1].json
Filesize
41KB

MD5
132b4040abebea9317878acace855518

SHA1
964c9a9a7ef2a5af1936cb15895f08f215b7d956

SHA256
f5017565e0fb2c8d4f23f7ffc8043d18354a0146c8b2dc464cb42cdd7d81a8af

SHA512
29e92e64fb1d23e0f91918d358ad533e1bc8498a51429769999af1b5d95f12c6b0c4f177facde42895031368596a8a035a0576526cee957f30ef6e0a43138889

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1CWA04S8\appack[1].exe
Filesize
82KB

MD5
390a7337b163b819cb99eabe0e8825a4

SHA1
f34cc80fff864ffaa367be573420d8f5a8e2d341

SHA256
6b29a1de3d3d2cacd1200c3c1bd6fe5a7afdb4724aaba76b77965ae2a82836de

SHA512
d4502bb4ce045e350f814fc16445f4cf03adda5640a9dcfd1c1ea647fed724cf1540ac96d6e6b91de09e9bee78e5f86ea942a8852a9b8840511dd1808b900f4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O99FRDQU\DETTAMROFNIW[1].exe
Filesize
125KB

MD5
1c06063c8b264df1d6ad2b14ae7e5309

SHA1
77538cbb4e684dbe891cac50d811dbb7d3c26cec

SHA256
0c9b2b222cdd42a185f5abcff1e6672f981ed2a01c9149ea49f0cef0813ce864

SHA512
a2d8b01d0a63bdea2be7abd1080ac4a070457d637b081fdec91237284cac9e61fa7753b0a5637dc53ae96f694161e5437f52cbffbfea3df9357cf9572a7ab56a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O99FRDQU\ULTIMATE[1].dll
Filesize
286KB

MD5
5e1b9da94f975bd47d039ee4c89b932d

SHA1
18d9235f18f3a52e365eea12231f5431d39a1d97

SHA256
be0d22f38b55e614e4721b12999f66b26e6ff23cbefd5e3235ba2b4cd4d8cca6

SHA512
1b13bd635103689e37a01f9896c3d323ea61a763761b8c1bbcacb4780b687610484bd9d30687881539d05d3c8798469c3c0705358cf8ecc6fc405c6794257a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\O99FRDQU\installer[1].dll
Filesize
198KB

MD5
30abd72a6d7ec19ce9d76a176728e039

SHA1
d50f09e30fb2f8e953f1322aa39d70a6fff9e418

SHA256
ac62d72d9c27bf2371c1faf44f622083162eeca362ba54748f793b74cc1cadcd

SHA512
b384a0f3b0c02bf7769bc5ef47667e21a03c22a641ae050567712303309bdce46816cb94b4aac50cfb6227712019fd311e67ba3deba5c8a374accce2f189ec2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2QHBPY3\nircmd[1].exe
Filesize
44KB

MD5
a1cd6a64e8f8ad5d4b6c07dc4113c7ec

SHA1
60e2f48a51c061bba72a08f34be781354f87aa49

SHA256
b994ae5cbfb5ad308656e9a8bf7a4a866fdeb9e23699f89f048d7f92e6bb8577

SHA512
87a42901a63793653d49f1c6d410a429cabb470b4c340c4553cbd9eccacb38d8543f85455465e0a432d737e950c590175dad744094861f7c3e575446a65b41e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2QHBPY3\testador[1].dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\M0Z5DH4F.cookie
Filesize
218B

MD5
a903971262a231986b1216fd9d433fb7

SHA1
1de3f151dd812dcbf31cd2f2cab46cfc8453ab5b

SHA256
34c841023a97a2f332d91da6d8e647f1ff39149ea3c329a87244329f0741b890

SHA512
4915e10dd2a91447db25ead8fbf668e7bfc3c5e5ce2d8fb5f545fce5cbb75b02530a613f5235d3ab7172dedcf4c88ea11e740d6bba6632c242cb212e01de5f10

Download Submit
C:\Users\Public\Documents\DED0TTAMROs1FNSIW.exe
Filesize
125KB

MD5
1c06063c8b264df1d6ad2b14ae7e5309

SHA1
77538cbb4e684dbe891cac50d811dbb7d3c26cec

SHA256
0c9b2b222cdd42a185f5abcff1e6672f981ed2a01c9149ea49f0cef0813ce864

SHA512
a2d8b01d0a63bdea2be7abd1080ac4a070457d637b081fdec91237284cac9e61fa7753b0a5637dc53ae96f694161e5437f52cbffbfea3df9357cf9572a7ab56a

Download Submit
C:\Windows\AsmResolve1-6r.dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Windows\AsmResolve2r.PE.dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Windows\Descongic.dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Windows\Help\Windows\IndexStore\en-US\IndexStoreInit.dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Windows\Help\Windows\IndexStore\en-US\IndexStores-2.0.dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Windows\Help\Windows\IndexStore\en-US\IndexStores-x86.dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Windows\Tasks\SA.json
Filesize
40KB

MD5
9aea224aafa12834cc2a8f8d09d49ace

SHA1
fb4a00577a26ab40887b30717cd2116734c1ad98

SHA256
a20a0e44ee81f10dc303ecd70e0669856254ea6665ed444c651683b530f037cd

SHA512
d4d79eb39e2b69c011ef007bdb8b9a730892bd3840861a4d0ca368e82abe86d10c6d7362bc60150955bfa18e24e5874ed10733ad8ecb72e9cd18a60567226c8d

Download Submit
C:\Windows\Tasks\SA.json
Filesize
41KB

MD5
132b4040abebea9317878acace855518

SHA1
964c9a9a7ef2a5af1936cb15895f08f215b7d956

SHA256
f5017565e0fb2c8d4f23f7ffc8043d18354a0146c8b2dc464cb42cdd7d81a8af

SHA512
29e92e64fb1d23e0f91918d358ad533e1bc8498a51429769999af1b5d95f12c6b0c4f177facde42895031368596a8a035a0576526cee957f30ef6e0a43138889

Download Submit
C:\Windows\Tasks\SA.json
Filesize
41KB

MD5
132b4040abebea9317878acace855518

SHA1
964c9a9a7ef2a5af1936cb15895f08f215b7d956

SHA256
f5017565e0fb2c8d4f23f7ffc8043d18354a0146c8b2dc464cb42cdd7d81a8af

SHA512
29e92e64fb1d23e0f91918d358ad533e1bc8498a51429769999af1b5d95f12c6b0c4f177facde42895031368596a8a035a0576526cee957f30ef6e0a43138889

Download Submit
C:\Windows\Tasks\SA.json
Filesize
41KB

MD5
132b4040abebea9317878acace855518

SHA1
964c9a9a7ef2a5af1936cb15895f08f215b7d956

SHA256
f5017565e0fb2c8d4f23f7ffc8043d18354a0146c8b2dc464cb42cdd7d81a8af

SHA512
29e92e64fb1d23e0f91918d358ad533e1bc8498a51429769999af1b5d95f12c6b0c4f177facde42895031368596a8a035a0576526cee957f30ef6e0a43138889

Download Submit
C:\Windows\Tasks\SA.txt
Filesize
7KB

MD5
9d8db74d7cb5fb490648481793881136

SHA1
3905ff8231f72dd0a1d39e97c96830edb487d13b

SHA256
ee64232277a0529a14e3d6478e6c26b9239912d8b703ac85a3d107b9974690f6

SHA512
eccfc5fca2af5be1f30e4830ff588b82cc4ddfc1121664ba10b86611e057d6bc16919ba8f222a726c44d859e9c6e510c6a242aa8dcee5610437e0670c46e8770

Download Submit
C:\Windows\Tasks\SA.txt
Filesize
7KB

MD5
763440a27914b2007c4e66c63e438178

SHA1
76201a4605e3022ca4777ee8175e63266c29bc0a

SHA256
c67e9a6410791d5e723678f9e07164d829407cde279d0e6393ea692102b2489d

SHA512
9ff52ba64e5d19f20d60c3fe94170eb8760f94f511bbe10c036302d3a9bd5eb30a1863ef9a031573d302c9dc62a8308d0f237f0c5dde3f7be5f8e52aae36df62

Download Submit
C:\Windows\basswebmss.dll
Filesize
198KB

MD5
30abd72a6d7ec19ce9d76a176728e039

SHA1
d50f09e30fb2f8e953f1322aa39d70a6fff9e418

SHA256
ac62d72d9c27bf2371c1faf44f622083162eeca362ba54748f793b74cc1cadcd

SHA512
b384a0f3b0c02bf7769bc5ef47667e21a03c22a641ae050567712303309bdce46816cb94b4aac50cfb6227712019fd311e67ba3deba5c8a374accce2f189ec2b

Download Submit
C:\Windows\cguuiM.exe
Filesize
82KB

MD5
390a7337b163b819cb99eabe0e8825a4

SHA1
f34cc80fff864ffaa367be573420d8f5a8e2d341

SHA256
6b29a1de3d3d2cacd1200c3c1bd6fe5a7afdb4724aaba76b77965ae2a82836de

SHA512
d4502bb4ce045e350f814fc16445f4cf03adda5640a9dcfd1c1ea647fed724cf1540ac96d6e6b91de09e9bee78e5f86ea942a8852a9b8840511dd1808b900f4d

Download Submit
C:\Windows\dpp.dll
Filesize
1.9MB

MD5
692026ff118997f30b9c314df54bce25

SHA1
a09c770f410ad4df8e78c6d0723f70521cfb63f1

SHA256
75c5725344092eb7a9f0c2c74c85a98f73d7d4c8201a677b206c35655c2e33d8

SHA512
60d5b1b29e19150636a0b7c593e95bac2bc42c0cc2dd6335cc45794f64fc5f64044f64365a9ef742616ffc025e121f2455425808a44add02bb28173394b87e36

Download Submit
C:\Windows\dpp.dll
Filesize
1.9MB

MD5
692026ff118997f30b9c314df54bce25

SHA1
a09c770f410ad4df8e78c6d0723f70521cfb63f1

SHA256
75c5725344092eb7a9f0c2c74c85a98f73d7d4c8201a677b206c35655c2e33d8

SHA512
60d5b1b29e19150636a0b7c593e95bac2bc42c0cc2dd6335cc45794f64fc5f64044f64365a9ef742616ffc025e121f2455425808a44add02bb28173394b87e36

Download Submit
C:\Windows\hXwarGVhWD.dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Windows\ldplayers.exe
Filesize
125KB

MD5
1c06063c8b264df1d6ad2b14ae7e5309

SHA1
77538cbb4e684dbe891cac50d811dbb7d3c26cec

SHA256
0c9b2b222cdd42a185f5abcff1e6672f981ed2a01c9149ea49f0cef0813ce864

SHA512
a2d8b01d0a63bdea2be7abd1080ac4a070457d637b081fdec91237284cac9e61fa7753b0a5637dc53ae96f694161e5437f52cbffbfea3df9357cf9572a7ab56a

Download Submit
C:\Windows\libcrypto-1_1.dll
Filesize
2.5MB

MD5
31643a6540ba24cf98a97cef42634048

SHA1
0206d691eaa40885713327c11e000cb771a21703

SHA256
e36557189986f864b35c4f3d66b3356ce242c73217ec9ec5c3d66453c480633f

SHA512
5f5c74fecacb723126ff099ad7303af500b5125ecef2966fb3104d3668d07e836266680a7628a63a5a26200f6139bed77e7f5c7533a9934cb81be9857800de41

Download Submit
C:\Windows\libcrypto-1_1.dll
Filesize
2.5MB

MD5
31643a6540ba24cf98a97cef42634048

SHA1
0206d691eaa40885713327c11e000cb771a21703

SHA256
e36557189986f864b35c4f3d66b3356ce242c73217ec9ec5c3d66453c480633f

SHA512
5f5c74fecacb723126ff099ad7303af500b5125ecef2966fb3104d3668d07e836266680a7628a63a5a26200f6139bed77e7f5c7533a9934cb81be9857800de41

Download Submit
C:\Windows\libsodium.dll
Filesize
329KB

MD5
be8a4636d7dd224ef4774065189ce7ff

SHA1
6aadb8d601333a3136647cb8a96480e277798d9e

SHA256
84fa23e1bd52d64265d6eb31b72fb40bb539856110633a6e0583003290e5f61a

SHA512
2fe3b94f473f81e6e8834455789d9401dcd4650b66a24a57d9f923ca9487e3cccbaf9caeb9033ef63bbb287a4c41776587776b2acf3281fa99d7f285d0bf27a9

Download Submit
C:\Windows\libsodium.dll
Filesize
329KB

MD5
be8a4636d7dd224ef4774065189ce7ff

SHA1
6aadb8d601333a3136647cb8a96480e277798d9e

SHA256
84fa23e1bd52d64265d6eb31b72fb40bb539856110633a6e0583003290e5f61a

SHA512
2fe3b94f473f81e6e8834455789d9401dcd4650b66a24a57d9f923ca9487e3cccbaf9caeb9033ef63bbb287a4c41776587776b2acf3281fa99d7f285d0bf27a9

Download Submit
C:\Windows\libssl-1_1.dll
Filesize
523KB

MD5
46c50a365a8a11627137ad52e4ab2f94

SHA1
6d02dc794a756c077233f074bd85c4b8241c24df

SHA256
187b33ab7a95d4722ff7dc6e2a0e6f121f68fd034b708a946b76748ec2a39b83

SHA512
3e2bdb912e77c249950d3dac3d3937d716e982fa9dfa3aeb48760219e53e99e70292294cc80992095bb18ee62329aac69c253dea2ae6037c9e80e1500a32b1c0

Download Submit
C:\Windows\libssl-1_1.dll
Filesize
523KB

MD5
46c50a365a8a11627137ad52e4ab2f94

SHA1
6d02dc794a756c077233f074bd85c4b8241c24df

SHA256
187b33ab7a95d4722ff7dc6e2a0e6f121f68fd034b708a946b76748ec2a39b83

SHA512
3e2bdb912e77c249950d3dac3d3937d716e982fa9dfa3aeb48760219e53e99e70292294cc80992095bb18ee62329aac69c253dea2ae6037c9e80e1500a32b1c0

Download Submit
C:\Windows\nircmd.exe
Filesize
44KB

MD5
a1cd6a64e8f8ad5d4b6c07dc4113c7ec

SHA1
60e2f48a51c061bba72a08f34be781354f87aa49

SHA256
b994ae5cbfb5ad308656e9a8bf7a4a866fdeb9e23699f89f048d7f92e6bb8577

SHA512
87a42901a63793653d49f1c6d410a429cabb470b4c340c4553cbd9eccacb38d8543f85455465e0a432d737e950c590175dad744094861f7c3e575446a65b41e8

Download Submit
C:\Windows\nircmd.exe
Filesize
44KB

MD5
a1cd6a64e8f8ad5d4b6c07dc4113c7ec

SHA1
60e2f48a51c061bba72a08f34be781354f87aa49

SHA256
b994ae5cbfb5ad308656e9a8bf7a4a866fdeb9e23699f89f048d7f92e6bb8577

SHA512
87a42901a63793653d49f1c6d410a429cabb470b4c340c4553cbd9eccacb38d8543f85455465e0a432d737e950c590175dad744094861f7c3e575446a65b41e8

Download Submit
C:\Windows\nircmd.exe
Filesize
44KB

MD5
a1cd6a64e8f8ad5d4b6c07dc4113c7ec

SHA1
60e2f48a51c061bba72a08f34be781354f87aa49

SHA256
b994ae5cbfb5ad308656e9a8bf7a4a866fdeb9e23699f89f048d7f92e6bb8577

SHA512
87a42901a63793653d49f1c6d410a429cabb470b4c340c4553cbd9eccacb38d8543f85455465e0a432d737e950c590175dad744094861f7c3e575446a65b41e8

Download Submit
C:\Windows\nircmd.exe
Filesize
44KB

MD5
a1cd6a64e8f8ad5d4b6c07dc4113c7ec

SHA1
60e2f48a51c061bba72a08f34be781354f87aa49

SHA256
b994ae5cbfb5ad308656e9a8bf7a4a866fdeb9e23699f89f048d7f92e6bb8577

SHA512
87a42901a63793653d49f1c6d410a429cabb470b4c340c4553cbd9eccacb38d8543f85455465e0a432d737e950c590175dad744094861f7c3e575446a65b41e8

Download Submit
C:\Windows\notepad_.dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Windows\opus.dll
Filesize
307KB

MD5
a4c7c50ebed6a72ead1baa4cb3057c81

SHA1
21ae7d92ce5f6684c2bb091a780830fb7e2263c0

SHA256
0d518b2def8d3e2d6a1d221ddc6d66a338ab1ba6068461d1cf5f3b7d39c97793

SHA512
1d679f5d0805907ada13a79b5d673ff1262334fbed6bdda2812a4c183aea7dd1d775f847048d5c5d06aa920b76936b61ad7426e77502807935a93ec953e03071

Download Submit
C:\Windows\opus.dll
Filesize
307KB

MD5
a4c7c50ebed6a72ead1baa4cb3057c81

SHA1
21ae7d92ce5f6684c2bb091a780830fb7e2263c0

SHA256
0d518b2def8d3e2d6a1d221ddc6d66a338ab1ba6068461d1cf5f3b7d39c97793

SHA512
1d679f5d0805907ada13a79b5d673ff1262334fbed6bdda2812a4c183aea7dd1d775f847048d5c5d06aa920b76936b61ad7426e77502807935a93ec953e03071

Download Submit
C:\Windows\opus_32.dll
Filesize
1015KB

MD5
c4dfbbd29f479ff9d9fc482022fbc43a

SHA1
b41a7f08625508a15c1ac085fe9fa136a04f0ed3

SHA256
afbdedbe1ab06a4161fcf7b97de98862b7f7f553812eabb4c4566487511b6634

SHA512
13217a44961ffaf4d1ca1f956a579b2806c474a4552b8ae4f27b78ac48bf87804641647cc11506a2e9b5edc7f362de732070931fa44d1f6b997925c3a6860d0e

Download Submit
C:\Windows\splwow32.exe
Filesize
767KB

MD5
ba7fe97a0a39f8b149d71c36ffe58ce2

SHA1
05e87ed72b9fd93181005dbab228492ce0d6e605

SHA256
9bcee8d1caac27e3098e35eaea32facc982ba546591e3c22a5f43bcaf1be27d9

SHA512
78253b8af83302e158b6c9ef133f7150ca9a24a0c9ea5d522dafa5f3f19aaf19e5f07aaf2b3dd18131a6082ec29a2c7cf71cee356c382c78163eb3c7459c60e3

Download Submit
C:\Windows\twain_32\winhlp32_x86.exe
Filesize
1.3MB

MD5
7b820d80b81a8b75872dcd74169172c7

SHA1
42cdbdb11918c85d8286627909bef52021a3e0c7

SHA256
05ec33fbb5348ce080e1fc4c25c1bd9a2238df62e29a927ab4bb9e2094c8d1a6

SHA512
ad98991731d2ca3046365148516ed2e0beb36a540992193b1652f934ee8e807a8462555c108c1df06756d94aea1bf98e8b0bc0837d99bd820d0e6454594e4094

Download Submit
C:\Windows\twain_32\winhlp32_x86.exe
Filesize
1.3MB

MD5
7b820d80b81a8b75872dcd74169172c7

SHA1
42cdbdb11918c85d8286627909bef52021a3e0c7

SHA256
05ec33fbb5348ce080e1fc4c25c1bd9a2238df62e29a927ab4bb9e2094c8d1a6

SHA512
ad98991731d2ca3046365148516ed2e0beb36a540992193b1652f934ee8e807a8462555c108c1df06756d94aea1bf98e8b0bc0837d99bd820d0e6454594e4094

Download Submit
C:\Windows\twain_64.dll
Filesize
822KB

MD5
c99115c12a464b547c98e4b135d46059

SHA1
b2a57fde8c9434dcf5e3bbbc48a7e3b4463bedea

SHA256
3e164fd39a92942fa2551daecac729bf4309e3d1f45422da38a053953958f262

SHA512
40e94fc6110ea3b1158ae7e7faeaf3322c9ef1ab069aa4f5088d1eaa345abac2c4b7b9cde7ea89e32141f46c389aea10bbd698ebf1d06a7a6782e64204f06378

Download Submit
C:\Windows\winhlp32.dll
Filesize
943KB

MD5
f856f6e09479113addda5e5c18e0b201

SHA1
5e13907027f1d93a6b43d1398e924a7a87d73a25

SHA256
4410fae84e7270dd87f52073ce82d7521136bed3779e0e8a05040cddcc46ee1f

SHA512
2499e01e9e731c7988da687a04f78e98451acea4c940b0948135d942f7c165970bcc596a3d436e6116b045af9b83956dcdebb646c461afca925ed5df6f486eac

Download Submit
C:\Windows\winhlp64.exe
Filesize
1.3MB

MD5
7b820d80b81a8b75872dcd74169172c7

SHA1
42cdbdb11918c85d8286627909bef52021a3e0c7

SHA256
05ec33fbb5348ce080e1fc4c25c1bd9a2238df62e29a927ab4bb9e2094c8d1a6

SHA512
ad98991731d2ca3046365148516ed2e0beb36a540992193b1652f934ee8e807a8462555c108c1df06756d94aea1bf98e8b0bc0837d99bd820d0e6454594e4094

Download Submit
C:\Windows\winhlp64.exe
Filesize
1.3MB

MD5
7b820d80b81a8b75872dcd74169172c7

SHA1
42cdbdb11918c85d8286627909bef52021a3e0c7

SHA256
05ec33fbb5348ce080e1fc4c25c1bd9a2238df62e29a927ab4bb9e2094c8d1a6

SHA512
ad98991731d2ca3046365148516ed2e0beb36a540992193b1652f934ee8e807a8462555c108c1df06756d94aea1bf98e8b0bc0837d99bd820d0e6454594e4094

Download Submit
C:\Windows\winhlp64.exe
Filesize
1.3MB

MD5
7b820d80b81a8b75872dcd74169172c7

SHA1
42cdbdb11918c85d8286627909bef52021a3e0c7

SHA256
05ec33fbb5348ce080e1fc4c25c1bd9a2238df62e29a927ab4bb9e2094c8d1a6

SHA512
ad98991731d2ca3046365148516ed2e0beb36a540992193b1652f934ee8e807a8462555c108c1df06756d94aea1bf98e8b0bc0837d99bd820d0e6454594e4094

Download Submit
C:\Windows\winhlp64.exe
Filesize
1.3MB

MD5
7b820d80b81a8b75872dcd74169172c7

SHA1
42cdbdb11918c85d8286627909bef52021a3e0c7

SHA256
05ec33fbb5348ce080e1fc4c25c1bd9a2238df62e29a927ab4bb9e2094c8d1a6

SHA512
ad98991731d2ca3046365148516ed2e0beb36a540992193b1652f934ee8e807a8462555c108c1df06756d94aea1bf98e8b0bc0837d99bd820d0e6454594e4094

Download Submit
C:\Windows\winhlp64.exe
Filesize
1.3MB

MD5
7b820d80b81a8b75872dcd74169172c7

SHA1
42cdbdb11918c85d8286627909bef52021a3e0c7

SHA256
05ec33fbb5348ce080e1fc4c25c1bd9a2238df62e29a927ab4bb9e2094c8d1a6

SHA512
ad98991731d2ca3046365148516ed2e0beb36a540992193b1652f934ee8e807a8462555c108c1df06756d94aea1bf98e8b0bc0837d99bd820d0e6454594e4094

Download Submit
C:\Windows\zlib1.dll
Filesize
73KB

MD5
05bf83777d5b6c7bf74a512f51f34a7b

SHA1
5c177218220a9c1df6eff2fc46bf3dd512986222

SHA256
0d2a785476bf5ab1906f4738e92df18a2c438e27225c1c1cac9afe77417c0b46

SHA512
0249ac76f843b3d46120da665ebe3b361f120477997f3809b88188d1afeffa2a789f5a990930441f54729d1e806c2ce005893ac77a88dd87d302e2ee49eba941

Download Submit
C:\Windows\zlib1.dll
Filesize
73KB

MD5
05bf83777d5b6c7bf74a512f51f34a7b

SHA1
5c177218220a9c1df6eff2fc46bf3dd512986222

SHA256
0d2a785476bf5ab1906f4738e92df18a2c438e27225c1c1cac9afe77417c0b46

SHA512
0249ac76f843b3d46120da665ebe3b361f120477997f3809b88188d1afeffa2a789f5a990930441f54729d1e806c2ce005893ac77a88dd87d302e2ee49eba941

Download Submit
memory/764-419-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/764-418-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1816-224-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/1816-203-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/2724-438-0x00007FF6457A0000-0x00007FF64839E000-memory.dmp

Filesize
44.0MB

Download
memory/2724-437-0x00007FF6457A0000-0x00007FF64839E000-memory.dmp

Filesize
44.0MB

Download
memory/2724-432-0x00007FF6457A0000-0x00007FF64839E000-memory.dmp

Filesize
44.0MB

Download
memory/2724-433-0x00007FF6457A0000-0x00007FF64839E000-memory.dmp

Filesize
44.0MB

Download
memory/2724-431-0x00007FFF79870000-0x00007FFF79872000-memory.dmp

Filesize
8KB

Download
memory/2724-430-0x00007FFF79860000-0x00007FFF79862000-memory.dmp

Filesize
8KB

Download
memory/3996-0-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/3996-35-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/3996-1-0x0000000077E12000-0x0000000077E13000-memory.dmp

Filesize
4KB

Download
memory/3996-2-0x0000000077E12000-0x0000000077E13000-memory.dmp

Filesize
4KB

Download
memory/3996-16-0x0000000000400000-0x0000000000503000-memory.dmp

Filesize
1.0MB

Download
memory/4340-185-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4340-184-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download