Overview

overview

10

Static

static

3

explorhe.exe

windows7-x64

10

explorhe.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/01/2024, 18:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    explorhe.exe
  • Size 790KB
  • Sample240120-xend2afba6
  • SHA256 3954d6aa2f5fdf62fd9ee50c08eb85a4a3efc7393f7c9ef930bc38dac4ab7366
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeygluptebaredlinestealcxmrigzgrat2024@pixelscloud@rlreborn cloud tg: @fatherofcarders)legaalivetrafficdiscoverydropperevasioninfostealerloaderminerpersistenceratrootkitspywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.15

C2

  • http://185.215.113.68

Attributes
  • install_dir

    d887ceb89d

  • install_file

    explorhe.exe

  • strings_key

    7cadc181267fafff9df8503e730d60e1

  • url_paths

    /theme/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • LiveTraffic

C2

  • 20.79.30.95:33223

Extracted

Family

  • redline

Botnet

  • @Pixelscloud

C2

  • 94.156.65.198:13781

Extracted

Family

  • redline

Botnet

  • Legaa

C2

  • 185.172.128.33:38294

Extracted

Family

  • redline

Botnet

  • 2024

C2

  • 195.20.16.103:20440

Extracted

Family

  • amadey

C2

  • http://185.215.113.68

Attributes
  • strings_key

    7cadc181267fafff9df8503e730d60e1

  • url_paths

    /theme/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • @RLREBORN Cloud TG: @FATHEROFCARDERS)

C2

  • 141.95.211.148:46011

Extracted

Family

  • stealc

C2

  • http://185.172.128.79

Attributes
  • url_path

    /3886d2276f6914c4.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 1 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 12 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 3 IoCs
    miner
  • Blocklisted process makes network request 3 IoCs
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 32 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\explorhe.exe
    "C:\Users\Admin\AppData\Local\Temp\explorhe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
      "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explorhe.exe /TR "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:4996
      • C:\Users\Admin\AppData\Local\Temp\1000486001\322321.exe
        "C:\Users\Admin\AppData\Local\Temp\1000486001\322321.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:864
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2324
      • C:\Users\Admin\AppData\Local\Temp\1000487001\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\1000487001\crypted.exe"
        3⤵
          PID:2324
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4976
        • C:\Users\Admin\AppData\Local\Temp\1000488001\legnew.exe
          "C:\Users\Admin\AppData\Local\Temp\1000488001\legnew.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4004
          • C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exe
            "C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exe"
            4⤵
            • Executes dropped EXE
            PID:4856
        • C:\Users\Admin\AppData\Local\Temp\1000489001\newbuild.exe
          "C:\Users\Admin\AppData\Local\Temp\1000489001\newbuild.exe"
          3⤵
            PID:3716
            • C:\Users\Admin\AppData\Roaming\ms_updater.exe
              "C:\Users\Admin\AppData\Roaming\ms_updater.exe"
              4⤵
              • Executes dropped EXE
              PID:3176
          • C:\Users\Admin\AppData\Local\Temp\1000490001\data.exe
            "C:\Users\Admin\AppData\Local\Temp\1000490001\data.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            PID:4704
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
              4⤵
                PID:2452
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                4⤵
                  PID:5040
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                  4⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2936
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
                  4⤵
                    PID:4304
                • C:\Users\Admin\AppData\Local\Temp\1000491001\2024.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000491001\2024.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4384
                • C:\Users\Admin\AppData\Local\Temp\1000492001\crypteddaisy.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000492001\crypteddaisy.exe"
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:3012
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1048
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                  3⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  PID:2196
                • C:\Users\Admin\AppData\Local\Temp\1000493001\latestrocki.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000493001\latestrocki.exe"
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4008
                  • C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
                    "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
                    4⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3212
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 352
                      5⤵
                      • Program crash
                      PID:3024
                  • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                    4⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3716
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      5⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4944
                    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
                      5⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Checks for VirtualBox DLLs, possible anti-VM trick
                      • Drops file in Windows directory
                      • Modifies data under HKEY_USERS
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3632
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        6⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:624
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                        6⤵
                          PID:2708
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          6⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2300
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          6⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3640
                        • C:\Windows\rss\csrss.exe
                          C:\Windows\rss\csrss.exe
                          6⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Manipulates WinMonFS driver.
                          • Drops file in Windows directory
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3312
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            7⤵
                              PID:2936
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              7⤵
                                PID:4972
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /delete /tn ScheduledUpdate /f
                                7⤵
                                  PID:3016
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  7⤵
                                  • Creates scheduled task(s)
                                  PID:4840
                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                  powershell -nologo -noprofile
                                  7⤵
                                  • Drops file in System32 directory
                                  • Modifies data under HKEY_USERS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:620
                                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                  7⤵
                                  • Executes dropped EXE
                                  PID:3740
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                  7⤵
                                  • Creates scheduled task(s)
                                  PID:924
                                • C:\Windows\windefender.exe
                                  "C:\Windows\windefender.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:464
                          • C:\Users\Admin\AppData\Local\Temp\rty25.exe
                            "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
                            4⤵
                            • Executes dropped EXE
                            PID:4396
                          • C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
                            "C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe"
                            4⤵
                              PID:1276
                              • C:\Users\Admin\AppData\Local\Temp\nszAA1E.tmp
                                C:\Users\Admin\AppData\Local\Temp\nszAA1E.tmp
                                5⤵
                                • Checks computer location settings
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Checks processor information in registry
                                • Suspicious behavior: EnumeratesProcesses
                                PID:1504
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 2312
                                  6⤵
                                  • Program crash
                                  PID:2900
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nszAA1E.tmp" & del "C:\ProgramData\*.dll"" & exit
                                  6⤵
                                    PID:2068
                                • C:\Windows\system32\choice.exe
                                  choice /C Y /N /D Y /T 3
                                  5⤵
                                    PID:2480
                              • C:\Users\Admin\AppData\Local\Temp\1000494001\rdx1122.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000494001\rdx1122.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:5088
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  4⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3656
                              • C:\Users\Admin\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:4444
                                • C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe
                                  "C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe"
                                  4⤵
                                    PID:2092
                                  • C:\Windows\SysWOW64\calc.exe
                                    C:\Windows\SysWOW64\calc.exe
                                    4⤵
                                      PID:1328
                                  • C:\Users\Admin\AppData\Local\Temp\1000496001\Miner-XMR1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000496001\Miner-XMR1.exe"
                                    3⤵
                                    • Checks BIOS information in registry
                                    • Executes dropped EXE
                                    PID:3236
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
                                      4⤵
                                      • Launches sc.exe
                                      PID:3468
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\1000496001\Miner-XMR1.exe"
                                      4⤵
                                      • Blocklisted process makes network request
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:1276
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe start "FLWCUERA"
                                      4⤵
                                      • Launches sc.exe
                                      PID:380
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe stop eventlog
                                      4⤵
                                      • Launches sc.exe
                                      PID:1244
                                    • C:\Windows\system32\sc.exe
                                      C:\Windows\system32\sc.exe delete "FLWCUERA"
                                      4⤵
                                      • Launches sc.exe
                                      PID:1940
                                  • C:\Users\Admin\AppData\Local\Temp\1000497001\flesh.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000497001\flesh.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1996
                                  • C:\Users\Admin\AppData\Local\Temp\1000498001\zonak.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000498001\zonak.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3068
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3212 -ip 3212
                                1⤵
                                  PID:2740
                                • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                                  C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2640
                                  • C:\Windows\SysWOW64\cmd.exe
                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                                    2⤵
                                      PID:2716
                                      • C:\Windows\SysWOW64\chcp.com
                                        chcp 1251
                                        3⤵
                                          PID:2556
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                          3⤵
                                          • Creates scheduled task(s)
                                          PID:2348
                                    • C:\Windows\system32\netsh.exe
                                      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                      1⤵
                                      • Modifies Windows Firewall
                                      PID:4896
                                    • C:\Windows\System32\Conhost.exe
                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                      1⤵
                                      • Drops file in System32 directory
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4972
                                    • C:\Windows\SysWOW64\timeout.exe
                                      timeout /t 5
                                      1⤵
                                      • Delays execution with timeout.exe
                                      PID:4716
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1504 -ip 1504
                                      1⤵
                                        PID:4896
                                      • C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
                                        C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
                                        1⤵
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        PID:1388
                                        • C:\Windows\system32\conhost.exe
                                          C:\Windows\system32\conhost.exe
                                          2⤵
                                            PID:3500
                                            • C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
                                              "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"
                                              3⤵
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:4924
                                              • C:\Windows\system32\conhost.exe
                                                conhost.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4448
                                            • C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
                                              "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe"
                                              3⤵
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:3836
                                              • C:\Windows\system32\conhost.exe
                                                conhost.exe
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4940
                                          • C:\Windows\system32\conhost.exe
                                            conhost.exe
                                            2⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2556
                                        • C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
                                          C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4604
                                        • C:\Windows\windefender.exe
                                          C:\Windows\windefender.exe
                                          1⤵
                                          • Executes dropped EXE
                                          • Modifies data under HKEY_USERS
                                          PID:3584
                                        • C:\Windows\SysWOW64\sc.exe
                                          sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                          1⤵
                                          • Launches sc.exe
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4140
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                          1⤵
                                            PID:4268
                                          • C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
                                            C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
                                            1⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2288

                                          Network

                                                MITRE ATT&CK Enterprise v15

                                                Reconnaissance

                                                Resource Development

                                                Initial Access

                                                Execution

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Persistence

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                3
                                                T1543

                                                Windows Service

                                                3
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Privilege Escalation

                                                Boot or Logon Autostart Execution

                                                1
                                                T1547

                                                Registry Run Keys / Startup Folder

                                                1
                                                T1547.001

                                                Create or Modify System Process

                                                3
                                                T1543

                                                Windows Service

                                                3
                                                T1543.003

                                                Scheduled Task/Job

                                                1
                                                T1053

                                                Defense Evasion

                                                Impair Defenses

                                                1
                                                T1562

                                                Modify Registry

                                                1
                                                T1112

                                                Credential Access

                                                Unsecured Credentials

                                                3
                                                T1552

                                                Credentials In Files

                                                3
                                                T1552.001

                                                Discovery

                                                Peripheral Device Discovery

                                                1
                                                T1120

                                                Query Registry

                                                6
                                                T1012

                                                System Information Discovery

                                                6
                                                T1082

                                                Lateral Movement

                                                Collection

                                                Data from Local System

                                                3
                                                T1005

                                                Command and Control

                                                Exfiltration

                                                Impact

                                                Service Stop

                                                1
                                                T1489

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                Are.docx
                                                • Path C:\ProgramData\Are.docx
                                                • Size 11KB
                                                • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                iojmibhyhiws.exe
                                                • Path C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
                                                • Size 167KB
                                                • SHA256 5eb3c7d96d59fed9c3f879620c6d213abf3b7323c87613321fde7512865f01d6
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                iojmibhyhiws.exe
                                                • Path C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
                                                • Size 98KB
                                                • SHA256 5de9aab0b88534d2d6a3e7dfaedf18fae1b49801b96c64337bf7286f1d3b9ed6
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                mozglue.dll
                                                • Path C:\ProgramData\mozglue.dll
                                                • Size 17KB
                                                • SHA256 08ab9d97ee242158872675085233af46ebabe60386fcd0d9acd0804bf6f29e98
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                mozglue.dll
                                                • Path C:\ProgramData\mozglue.dll
                                                • Size 14KB
                                                • SHA256 d9a6c030ae208ea1ea43bad7300e388d449e2952c88d9fc142f5d04291a3aed5
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                nss3.dll
                                                • Path C:\ProgramData\nss3.dll
                                                • Size 33KB
                                                • SHA256 4a34ad763f67f2a89d6a0146eaebd8ba9aa8cb868abb55d7a5fe40b1705a06da
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                RegAsm.exe.log
                                                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
                                                • Size 2KB
                                                • SHA256 25a36c129865722052d07b37daa985a3e4b64def94120b6343fb5a96d9026415
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                322321.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000486001\322321.exe
                                                • Size 332KB
                                                • SHA256 ed1e8a42be49a4068d0041315aa697247bf889877259098f01ad9f5322af8cfb
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                322321.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000486001\322321.exe
                                                • Size 243KB
                                                • SHA256 352ef984d44509155177a5bc42c14e871e336e3cb6deeda63e52da1abb305cb4
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                crypted.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000487001\crypted.exe
                                                • Size 341KB
                                                • SHA256 5e88119a34553c24625c42dbbb35b9c969a051a54478ab9227dac4ce720a703e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                crypted.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000487001\crypted.exe
                                                • Size 269KB
                                                • SHA256 6e6587854195067a07694ced8487860f4808431e9d4d70a4f034d1348779b804
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                legnew.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000488001\legnew.exe
                                                • Size 77KB
                                                • SHA256 8c95b89369e9a8f65d1093c1b35b11d33e729fc4d304cb744aec952cd75b0733
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                legnew.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000488001\legnew.exe
                                                • Size 187KB
                                                • SHA256 99600682229c3ca2bac7529c9cd94a7443e3c53f66fcf82a4b350dd6bc15329b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                legnew.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000488001\legnew.exe
                                                • Size 179KB
                                                • SHA256 0b3eea2472a2a81818ee9dd758de567ffe597bb19e3629083bbdfcc1b3039bd6
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                newbuild.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000489001\newbuild.exe
                                                • Size 149KB
                                                • SHA256 2f3be7176e3202ad3168b38e489d8c6e0bad52cc8504086471378eeb64ce8077
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                newbuild.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000489001\newbuild.exe
                                                • Size 176KB
                                                • SHA256 8fe2e94b4cf77e88139810b10a0a3ac916bbb895f35fa7edccbc87ee6497e9f9
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                newbuild.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000489001\newbuild.exe
                                                • Size 230KB
                                                • SHA256 ef17adf313cbfd9c1f710ed14d4042368bd82a98e0861969bff3233bb08a21cf
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                data.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000490001\data.exe
                                                • Size 282KB
                                                • SHA256 6ac7d80f68fd47ed1a93e9a5848cbb15ee9a68e311ba36eb1e4d81163483827a
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                data.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000490001\data.exe
                                                • Size 365KB
                                                • SHA256 6c21c3fb24a807e86446c15ce51ef7071460e8cec312d1e9526f7ef5010d1672
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                data.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000490001\data.exe
                                                • Size 245KB
                                                • SHA256 a87801668b16af6a27f6353b9125e34e6ed2f1c9e69bbd11213959320cf54921
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                2024.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000491001\2024.exe
                                                • Size 300KB
                                                • SHA256 1ca8f444f95c2cd9817ce6ab789513e55629c0e0ac0d2b7b552d402517e7cfe9
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                crypteddaisy.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000492001\crypteddaisy.exe
                                                • Size 117KB
                                                • SHA256 56585e8470916d2a064ba36783d86f6de681bfee010d0ae4d57ac5be2782898e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                crypteddaisy.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000492001\crypteddaisy.exe
                                                • Size 376KB
                                                • SHA256 674584cc65902ea8754821a390d0bf68bf5f8a9665d11af28a35efe2d024e47f
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                crypteddaisy.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000492001\crypteddaisy.exe
                                                • Size 387KB
                                                • SHA256 bf11a72df62ce83529a881e2b42a93618bd523a06fbd1e52a2bc12f160541e75
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                latestrocki.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000493001\latestrocki.exe
                                                • Size 137KB
                                                • SHA256 28cc2b64d86666389d0cb30b7638a47f7f9101d2123333aec5851d201b005133
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                latestrocki.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000493001\latestrocki.exe
                                                • Size 191KB
                                                • SHA256 3baeaed9b0bd3aefda8f071672f1c211933be46ec920feda8e8cf5e5611b41d8
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                latestrocki.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000493001\latestrocki.exe
                                                • Size 109KB
                                                • SHA256 2a2a59a408bb46db9ada02c11726feee142b2c1b14ec6a15e91b87a467c82d60
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                rdx1122.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000494001\rdx1122.exe
                                                • Size 189KB
                                                • SHA256 d815fb214902d65cf2ad7efa52f58663c9ce252fbbe14f9a24a9a5885110cb67
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                rdx1122.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000494001\rdx1122.exe
                                                • Size 187KB
                                                • SHA256 94096e69916d0e85796eef2935fa613713af58ffa54fc4dc832165b4e661a71a
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                rdx1122.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000494001\rdx1122.exe
                                                • Size 173KB
                                                • SHA256 193b536563e5df5a89c455e57a0416b5e49440e40d71ae536180a68e7f224057
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                SetupPowerGREPDemo.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe
                                                • Size 231KB
                                                • SHA256 5696dc15fb96504654a873a3afccc73ad390c515e1b32c26825af3c27af4fc4b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                SetupPowerGREPDemo.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe
                                                • Size 99KB
                                                • SHA256 2757edd5b2859823cc600755a75fbd046c4de3f7b83b2071a7abc34b27d0568b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                SetupPowerGREPDemo.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000495001\SetupPowerGREPDemo.exe
                                                • Size 77KB
                                                • SHA256 478e78cc01f125feab6d38984e9ad5626ca5332a46de8f9437f5846ea58adc4a
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Miner-XMR1.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000496001\Miner-XMR1.exe
                                                • Size 72KB
                                                • SHA256 2ba83c94c752daab3e0aa2ffe061b5efbfb5236f0016d0004af1396fccd0fd05
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Miner-XMR1.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000496001\Miner-XMR1.exe
                                                • Size 38KB
                                                • SHA256 fe3c9cb4413175d618ea9a5897befef3f24b3dd0e973090396506041c4a69b7e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Miner-XMR1.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000496001\Miner-XMR1.exe
                                                • Size 78KB
                                                • SHA256 9349945ac6374c24c5e228c5c9e60672de5a571a0eda1b25d9b3642bd7ab3111
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                flesh.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000497001\flesh.exe
                                                • Size 41KB
                                                • SHA256 82d6efdd0d595937ea62a7077708762825d8c654ad41ea66352411808989f405
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                flesh.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000497001\flesh.exe
                                                • Size 115KB
                                                • SHA256 514519261dd8298fa9a985cb7d5ec937e13beb564fb5a6cfdad7f407aa27753b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                flesh.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000497001\flesh.exe
                                                • Size 108KB
                                                • SHA256 a75100099a225273213011fba5cb8417ac134b2b45c48a69bd0eb95429dad54e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                zonak.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\1000498001\zonak.exe
                                                • Size 57KB
                                                • SHA256 14092cbd7b009f55555c52d482ebcd782a6f4abbcf7561363b43167ed0dd3b62
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                31839b57a4f11171d6abc8bbc4451ee4.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                • Size 40KB
                                                • SHA256 0b97af695b7eadbfa8ab367bf3770e1f89ce9c7672aa13c869889850afd3456e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                31839b57a4f11171d6abc8bbc4451ee4.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                • Size 85KB
                                                • SHA256 07ca896d1fcefa9ccfc86ee4e140f7530c5c165462d28e435f3079c569e1cf18
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                31839b57a4f11171d6abc8bbc4451ee4.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                • Size 120KB
                                                • SHA256 34f155d405d5651cbbc3011e69b1eabfa9320b6dc5423ba5019a0c3740697c72
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                31839b57a4f11171d6abc8bbc4451ee4.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
                                                • Size 221KB
                                                • SHA256 5677d392dba6edda7a5c490d37e3ef7f0e7d5650e418cf5a9a07b3bda4d6c3b8
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                BroomSetup.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                                                • Size 48KB
                                                • SHA256 77abb41d94132ba76df2b824bacebb5e24339c8c3f1884ffb7e4b077d0613618
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                InstallSetup7.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
                                                • Size 64KB
                                                • SHA256 efdb5133f78f0f5239f2fff7fb00944a0867e6b41b8c64306e40414e97f04ed0
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                InstallSetup7.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
                                                • Size 66KB
                                                • SHA256 35f06bcaba482d5e93458f7f9b56e0cef7a8b97e80a17ff3bc310651386afb70
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                InstallSetup7.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\InstallSetup7.exe
                                                • Size 93KB
                                                • SHA256 8a57871faa5e3a9c289b1625eddda5dc429ac9384bef97d77ea152946a9d66e4
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                Protect544cd51a.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
                                                • Size 114KB
                                                • SHA256 069e035033c13c4389b51c9691a631e9eed9892b4460e37f75f5c74564d48606
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                __PSScriptPolicyTest_f1oavjhu.hiu.ps1
                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1oavjhu.hiu.ps1
                                                • Size 60B
                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                injector.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                • Size 31KB
                                                • SHA256 d33fe00e136e04a41cf3f634765927f3e06a5562ab840a4ea09c50346d3cf8e6
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                injector.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                                • Size 33KB
                                                • SHA256 5d72481f6a0ead5dd9e676af33ab9ebce6fb5d7f884958d905222b37e39772f3
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                explorhe.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
                                                • Size 498KB
                                                • SHA256 b19c92ee6d46cb6a77679e3a4795fe76565f6f65f29b1ca32353dd63c2e4b9ff
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                explorhe.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
                                                • Size 554KB
                                                • SHA256 7e0b0db256e5bddd5c1433424598d31792b3d919a9e83c9e8bb99dad11407438
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                explorhe.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
                                                • Size 652KB
                                                • SHA256 af95d67d672bbf418581aea15bd8f9a3214b18816fa3fc570e198a7dbee0e38d
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                explorhe.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\d887ceb89d\explorhe.exe
                                                • Size 108KB
                                                • SHA256 7430c03df7f22570d8ace3128a4214f9e9f2f8767fe70f8c41ccddc3881c3b19
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                qemu-ga.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\d887ceb89d\qemu-ga.exe
                                                • Size 4KB
                                                • SHA256 9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                INetC.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsxA625.tmp\INetC.dll
                                                • Size 25KB
                                                • SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                INetC.dll
                                                • Path C:\Users\Admin\AppData\Local\Temp\nsxA625.tmp\INetC.dll
                                                • Size 1KB
                                                • SHA256 711ce1b5b08d30470c7cb844d2dd9345ffb6c2add9392f56a86e8c515ba89ed0
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                nszAA1E.tmp
                                                • Path C:\Users\Admin\AppData\Local\Temp\nszAA1E.tmp
                                                • Size 106KB
                                                • SHA256 8d9f1041cf60316d703517f7053a449d4139c5271ffa7a324129ab3871183e7b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                nszAA1E.tmp
                                                • Path C:\Users\Admin\AppData\Local\Temp\nszAA1E.tmp
                                                • Size 133KB
                                                • SHA256 b6b05ac200d8feeea4b88ec3d36ab776db195073b9d113173d533061d7ee0f3f
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                rty25.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\rty25.exe
                                                • Size 144KB
                                                • SHA256 6f53431380b750f6ab2fa51419d6ca7c8394de8bbc7a3c942958657684463f6f
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                rty25.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\rty25.exe
                                                • Size 57KB
                                                • SHA256 437fa9b74ff9727c08e8c2dd997f9a36229948d4d4f04f06c8816b2fbceabe5c
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                rty25.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\rty25.exe
                                                • Size 68KB
                                                • SHA256 63434eb650428e9764d0cb7a6fc2efa7b8a0edf90e30b0b85faa6a74b53fee0b
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                toolspub1.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
                                                • Size 171KB
                                                • SHA256 09d71e8c2a892cee75ae48367dfebed3ef34a0ece826b1afbcbcd52c5a5e0789
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                toolspub1.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
                                                • Size 123KB
                                                • SHA256 06f177aefcb72ebae47b15079749b84cdb6e977f1584762b586f577da337029e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                toolspub1.exe
                                                • Path C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
                                                • Size 113KB
                                                • SHA256 d79f85145a4a8b50a08d8b7aba6c6e6426080248cd0d68f3c482cf2c8bef48d7
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                clip64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                • Size 102KB
                                                • SHA256 150fb1285c252e2b79dea84efb28722cc22d370328ceb46fb9553de1479e001e
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                clip64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                • Size 84KB
                                                • SHA256 6fa0268434834e310d449335d5a190d758e0c21a57dbc07c21727145bf6dfedb
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                clip64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
                                                • Size 4KB
                                                • SHA256 401abe1e094b01644a68ab8e88f89a41cb23f88bdbbe2d23297a7d1b607c6050
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                cred64.dll
                                                • Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
                                                • Size 162B
                                                • SHA256 340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                Task.bat
                                                • Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                                                • Size 128B
                                                • SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                ms_tool.exe
                                                • Path C:\Users\Admin\AppData\Roaming\ms_tool.exe
                                                • Size 89KB
                                                • SHA256 8237163b9d075e0ab0c77457d2fd426d17c230c8731a6237c1755e04b40519db
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                ms_updater.exe
                                                • Path C:\Users\Admin\AppData\Roaming\ms_updater.exe
                                                • Size 149KB
                                                • SHA256 82917b6a3884d2718aa52e41a8b3c2b2a71901de400c8c2d12cb4bb0053361e1
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                ms_updater.exe
                                                • Path C:\Users\Admin\AppData\Roaming\ms_updater.exe
                                                • Size 46KB
                                                • SHA256 af5698e361ae340bb4056bc6eb8b819fe00c27227d39b0476139ffa1b52371b9
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                ms_updater.exe
                                                • Path C:\Users\Admin\AppData\Roaming\ms_updater.exe
                                                • Size 66KB
                                                • SHA256 593678bcd1d16e00a2a416545e47d7141e1d54d4849ec9858863ffc0542107d8
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                powershell.exe.log
                                                • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                • Size 2KB
                                                • SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                StartupProfileData-Interactive
                                                • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                • Size 19KB
                                                • SHA256 f05d17a497ecaf3b8ddc4feff8bb741776155c1a2b133a1a99f9bc87f00e38df
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                StartupProfileData-Interactive
                                                • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                • Size 19KB
                                                • SHA256 5388c373ed1daaad40022891dea84aaf777e226aaeb1afcbb44acc03d4b946b5
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                StartupProfileData-Interactive
                                                • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                • Size 19KB
                                                • SHA256 d13adbb513f1de5838f3ef049f39f4b2313a86263fb4be4a5788c60b283e3355
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                StartupProfileData-Interactive
                                                • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                • Size 19KB
                                                • SHA256 69bbdfc1f02ab0fadc41d3c806469f7387e8c938ace0197c818168918a9a55f4
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                StartupProfileData-Interactive
                                                • Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
                                                • Size 1KB
                                                • SHA256 738be71b1bc016e77631aec608cc2caa184e0ac7e22e9a240ab49da8e19e14bf
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                csrss.exe
                                                • Path C:\Windows\rss\csrss.exe
                                                • Size 88KB
                                                • SHA256 d234ccf4f76121b0a51b6fa09bab5c93c5b5a7d10fbf1db0831290c52d3cbd31
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                csrss.exe
                                                • Path C:\Windows\rss\csrss.exe
                                                • Size 53KB
                                                • SHA256 7f0a2655d68c70351628751e9b8f3049ca17a146cc5fdff604b676cd28247198
                                                • MD5 SHA1 SHA512 SSDEEP
                                                Submit Download

                                                F59E91F8
                                                • Path \??\c:\users\admin\appdata\local\temp\F59E91F8
                                                • Size 14B
                                                • SHA256 0f6a105fc2a026f60919579108e06a9f7c38f22ca4e4284a6a23eeebb453ef83
                                                • MD5 SHA1 SHA512
                                                Submit Download

                                                memory/864-204-0x00007FF6C7A70000-0x00007FF6C7D05000-memory.dmp
                                                Download

                                                memory/1048-253-0x0000000000400000-0x0000000000458000-memory.dmp
                                                Download

                                                memory/1048-259-0x0000000004810000-0x0000000004820000-memory.dmp
                                                Download

                                                memory/1048-260-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/1048-262-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/1136-17-0x0000000000360000-0x0000000000768000-memory.dmp
                                                Download

                                                memory/1136-177-0x0000000000360000-0x0000000000768000-memory.dmp
                                                Download

                                                memory/1136-110-0x0000000000360000-0x0000000000768000-memory.dmp
                                                Download

                                                memory/1136-471-0x0000000000360000-0x0000000000768000-memory.dmp
                                                Download

                                                memory/1136-16-0x0000000000360000-0x0000000000768000-memory.dmp
                                                Download

                                                memory/1136-274-0x0000000000360000-0x0000000000768000-memory.dmp
                                                Download

                                                memory/1136-751-0x0000000000360000-0x0000000000768000-memory.dmp
                                                Download

                                                memory/1388-860-0x00007FF75C510000-0x00007FF75CF4D000-memory.dmp
                                                Download

                                                memory/1504-482-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                Download

                                                memory/1504-775-0x0000000000400000-0x000000000085E000-memory.dmp
                                                Download

                                                memory/1504-643-0x0000000000400000-0x000000000085E000-memory.dmp
                                                Download

                                                memory/2324-276-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/2324-296-0x0000000004E10000-0x0000000004E20000-memory.dmp
                                                Download

                                                memory/2324-75-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/2324-203-0x0000000000A30000-0x0000000000A82000-memory.dmp
                                                Download

                                                memory/2324-70-0x00000000058C0000-0x00000000058D0000-memory.dmp
                                                Download

                                                memory/2324-178-0x00000000031B0000-0x00000000051B0000-memory.dmp
                                                Download

                                                memory/2324-76-0x00000000031B0000-0x00000000051B0000-memory.dmp
                                                Download

                                                memory/2324-205-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/2324-68-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/2324-67-0x0000000000EF0000-0x0000000000F4A000-memory.dmp
                                                Download

                                                memory/2452-797-0x0000000000400000-0x000000000049E000-memory.dmp
                                                Download

                                                memory/2452-793-0x0000000000400000-0x000000000049E000-memory.dmp
                                                Download

                                                memory/2556-858-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2556-847-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2556-843-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2556-841-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2556-846-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2556-842-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2556-844-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2556-848-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2556-861-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2556-863-0x0000019698C20000-0x0000019698C40000-memory.dmp
                                                Download

                                                memory/2556-845-0x0000000140000000-0x0000000140840000-memory.dmp
                                                Download

                                                memory/2640-601-0x0000000000400000-0x00000000008E2000-memory.dmp
                                                Download

                                                memory/3012-257-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/3012-251-0x0000000005920000-0x0000000005930000-memory.dmp
                                                Download

                                                memory/3012-248-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/3012-246-0x0000000000FA0000-0x0000000001008000-memory.dmp
                                                Download

                                                memory/3012-258-0x0000000003420000-0x0000000005420000-memory.dmp
                                                Download

                                                memory/3176-252-0x0000000005050000-0x0000000005060000-memory.dmp
                                                Download

                                                memory/3176-152-0x0000000005050000-0x0000000005060000-memory.dmp
                                                Download

                                                memory/3176-250-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/3176-150-0x0000000000490000-0x00000000004E2000-memory.dmp
                                                Download

                                                memory/3176-151-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/3236-828-0x00007FF65F3C0000-0x00007FF65FDFD000-memory.dmp
                                                Download

                                                memory/3312-806-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                Download

                                                memory/3500-832-0x0000000140000000-0x000000014000D000-memory.dmp
                                                Download

                                                memory/3500-834-0x0000000140000000-0x000000014000D000-memory.dmp
                                                Download

                                                memory/3500-835-0x0000000140000000-0x000000014000D000-memory.dmp
                                                Download

                                                memory/3500-836-0x0000000140000000-0x000000014000D000-memory.dmp
                                                Download

                                                memory/3500-837-0x0000000140000000-0x000000014000D000-memory.dmp
                                                Download

                                                memory/3500-840-0x0000000140000000-0x000000014000D000-memory.dmp
                                                Download

                                                memory/3632-618-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                Download

                                                memory/3656-386-0x0000000000400000-0x0000000000452000-memory.dmp
                                                Download

                                                memory/3716-598-0x0000000000400000-0x0000000000D1C000-memory.dmp
                                                Download

                                                memory/4004-116-0x00000000070C0000-0x0000000007282000-memory.dmp
                                                Download

                                                memory/4004-176-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4004-105-0x0000000004910000-0x0000000004950000-memory.dmp
                                                Download

                                                memory/4004-106-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4004-111-0x0000000004990000-0x00000000049A0000-memory.dmp
                                                Download

                                                memory/4004-108-0x0000000004F90000-0x0000000004FCE000-memory.dmp
                                                Download

                                                memory/4004-107-0x0000000004990000-0x00000000049A0000-memory.dmp
                                                Download

                                                memory/4004-109-0x0000000004990000-0x00000000049A0000-memory.dmp
                                                Download

                                                memory/4004-117-0x0000000007290000-0x00000000077BC000-memory.dmp
                                                Download

                                                memory/4004-115-0x00000000069E0000-0x0000000006A30000-memory.dmp
                                                Download

                                                memory/4004-112-0x0000000005AC0000-0x0000000005B26000-memory.dmp
                                                Download

                                                memory/4004-113-0x0000000006330000-0x00000000063A6000-memory.dmp
                                                Download

                                                memory/4004-114-0x0000000006560000-0x000000000657E000-memory.dmp
                                                Download

                                                memory/4008-300-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4008-297-0x0000000000D70000-0x00000000013F0000-memory.dmp
                                                Download

                                                memory/4384-227-0x0000000005680000-0x0000000005690000-memory.dmp
                                                Download

                                                memory/4384-226-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4384-225-0x0000000000B80000-0x0000000000BD2000-memory.dmp
                                                Download

                                                memory/4384-298-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4444-831-0x00007FF681C90000-0x00007FF6829F1000-memory.dmp
                                                Download

                                                memory/4704-275-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4704-201-0x00000000008E0000-0x0000000000EE8000-memory.dmp
                                                Download

                                                memory/4704-202-0x00000000057B0000-0x000000000584C000-memory.dmp
                                                Download

                                                memory/4704-200-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4712-2-0x00000000004D0000-0x00000000008D8000-memory.dmp
                                                Download

                                                memory/4712-0-0x00000000004D0000-0x00000000008D8000-memory.dmp
                                                Download

                                                memory/4712-1-0x00000000004D0000-0x00000000008D8000-memory.dmp
                                                Download

                                                memory/4712-13-0x00000000004D0000-0x00000000008D8000-memory.dmp
                                                Download

                                                memory/4856-175-0x0000000000010000-0x0000000000018000-memory.dmp
                                                Download

                                                memory/4856-261-0x00007FFDA5F20000-0x00007FFDA69E1000-memory.dmp
                                                Download

                                                memory/4856-180-0x00007FFDA5F20000-0x00007FFDA69E1000-memory.dmp
                                                Download

                                                memory/4976-81-0x0000000006530000-0x0000000006B48000-memory.dmp
                                                Download

                                                memory/4976-179-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4976-78-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4976-91-0x0000000005830000-0x000000000593A000-memory.dmp
                                                Download

                                                memory/4976-229-0x0000000073180000-0x0000000073930000-memory.dmp
                                                Download

                                                memory/4976-79-0x00000000053B0000-0x0000000005442000-memory.dmp
                                                Download

                                                memory/4976-77-0x0000000005960000-0x0000000005F04000-memory.dmp
                                                Download

                                                memory/4976-80-0x0000000005450000-0x000000000545A000-memory.dmp
                                                Download

                                                memory/4976-92-0x0000000005760000-0x0000000005772000-memory.dmp
                                                Download

                                                memory/4976-93-0x00000000057C0000-0x00000000057FC000-memory.dmp
                                                Download

                                                memory/4976-95-0x0000000005F10000-0x0000000005F5C000-memory.dmp
                                                Download

                                                memory/4976-72-0x0000000000400000-0x0000000000454000-memory.dmp
                                                Download