3aa16eade9e9c87eb71455caf797f2216757b419d3865ff7dd1b6ac09b5547ed

Analysis

max time kernel
150s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7cacacdb1e83d4997662bb3f07f35e06.exe
Size 1.9MB
Sample240128-kppcvshbeq
SHA256 3aa16eade9e9c87eb71455caf797f2216757b419d3865ff7dd1b6ac09b5547ed
MD5 7cacacdb1e83d4997662bb3f07f35e06
SHA1 dc14ba7b718d17dcfb9b4ffb5f94503cd97bb139
SHA512 1347161953093ea665bdec13c653f3c7bf5d21445d6950e14da7183347cd899b05ebf7b4a68e2dd452fe4e11ce362b30e1fdd5368dd6a1c5681fa1862be5b93c
SSDEEP 49152:hpzL9JvkGM6srW4cVSSVeixSI5laWPQBMhKQ:hBDkhrW4cUWPQBM
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx vmprotect

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1852	MSASCuiiL.exe
1564	NvidiaHel.exe
1488	NvidiaHel.exe
4196	NvidiaHel.exe
4496	NvidiaHel.exe
5004	NvidiaHel.exe
1164	NvidiaHel.exe
1460	NvidiaHel.exe
4556	NvidiaHel.exe
2816	NvidiaHel.exe
3348	NvidiaHel.exe
1528	NvidiaHel.exe
2056	NvidiaHel.exe
4284	NvidiaHel.exe
3564	NvidiaHel.exe
1208	NvidiaHel.exe
768	NvidiaHel.exe
4832	NvidiaHel.exe
2768	MSASCuiiL.exe
3440	NvidiaHel.exe
2260	NvidiaHel.exe
2544	NvidiaHel.exe
1396	NvidiaHel.exe
4696	NvidiaHel.exe
3596	NvidiaHel.exe
4884	NvidiaHel.exe
892	NvidiaHel.exe
4568	NvidiaHel.exe
1848	NvidiaHel.exe
5012	NvidiaHel.exe
1320	NvidiaHel.exe
3952	NvidiaHel.exe
3452	NvidiaHel.exe
3280	NvidiaHel.exe
808	NvidiaHel.exe
2764	NvidiaHel.exe
960	NvidiaHel.exe
1540	NvidiaHel.exe
5104	NvidiaHel.exe
636	NvidiaHel.exe
1516	NvidiaHel.exe
1924	NvidiaHel.exe
3248	NvidiaHel.exe
4064	NvidiaHel.exe
4108	NvidiaHel.exe
656	NvidiaHel.exe
868	NvidiaHel.exe
1396	NvidiaHel.exe
4820	MSASCuiiL.exe
5092	NvidiaHel.exe
4584	NvidiaHel.exe
3412	NvidiaHel.exe
3328	NvidiaHel.exe
360	NvidiaHel.exe
3584	NvidiaHel.exe
4312	NvidiaHel.exe
2784	NvidiaHel.exe
4300	NvidiaHel.exe
3396	NvidiaHel.exe
2968	NvidiaHel.exe
3348	NvidiaHel.exe
3280	NvidiaHel.exe
652	NvidiaHel.exe
4540	NvidiaHel.exe

Loads dropped DLL 62 IoCs

pid	Process
1564	NvidiaHel.exe
1488	NvidiaHel.exe
4196	NvidiaHel.exe
4496	NvidiaHel.exe
5004	NvidiaHel.exe
1164	NvidiaHel.exe
1460	NvidiaHel.exe
4556	NvidiaHel.exe
2816	NvidiaHel.exe
3348	NvidiaHel.exe
1528	NvidiaHel.exe
2056	NvidiaHel.exe
4284	NvidiaHel.exe
3564	NvidiaHel.exe
1208	NvidiaHel.exe
768	NvidiaHel.exe
4832	NvidiaHel.exe
3440	NvidiaHel.exe
2260	NvidiaHel.exe
2544	NvidiaHel.exe
1396	NvidiaHel.exe
4696	NvidiaHel.exe
3596	NvidiaHel.exe
4884	NvidiaHel.exe
892	NvidiaHel.exe
4568	NvidiaHel.exe
1848	NvidiaHel.exe
5012	NvidiaHel.exe
1320	NvidiaHel.exe
3952	NvidiaHel.exe
3452	NvidiaHel.exe
3280	NvidiaHel.exe
808	NvidiaHel.exe
2764	NvidiaHel.exe
960	NvidiaHel.exe
1540	NvidiaHel.exe
5104	NvidiaHel.exe
636	NvidiaHel.exe
1516	NvidiaHel.exe
1924	NvidiaHel.exe
3248	NvidiaHel.exe
4064	NvidiaHel.exe
4108	NvidiaHel.exe
656	NvidiaHel.exe
868	NvidiaHel.exe
1396	NvidiaHel.exe
5092	NvidiaHel.exe
4584	NvidiaHel.exe
3412	NvidiaHel.exe
3328	NvidiaHel.exe
360	NvidiaHel.exe
3584	NvidiaHel.exe
4312	NvidiaHel.exe
2784	NvidiaHel.exe
4300	NvidiaHel.exe
3396	NvidiaHel.exe
2968	NvidiaHel.exe
3348	NvidiaHel.exe
3280	NvidiaHel.exe
652	NvidiaHel.exe
4540	NvidiaHel.exe
2100	NvidiaHel.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e0000000231ec-17.dat	upx
behavioral2/memory/1564-29-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/1564-33-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/1488-36-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4196-39-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4496-42-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/files/0x00060000000231f1-43.dat	upx
behavioral2/memory/5004-46-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/5004-47-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/files/0x00060000000231f1-48.dat	upx
behavioral2/memory/1164-50-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/1460-53-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4556-56-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/2816-59-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/files/0x00060000000231f1-60.dat	upx
behavioral2/memory/3348-62-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/files/0x00060000000231f1-63.dat	upx
behavioral2/memory/1528-65-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/2056-68-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4284-71-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/3564-74-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/files/0x00060000000231f1-75.dat	upx
behavioral2/memory/1208-77-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/files/0x00060000000231f1-78.dat	upx
behavioral2/memory/768-80-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/files/0x00060000000231f1-81.dat	upx
behavioral2/memory/4832-83-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/files/0x00060000000231f1-90.dat	upx
behavioral2/memory/3440-92-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/2260-95-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/2544-98-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/1396-101-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4696-104-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/3596-107-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4884-110-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/892-113-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4568-116-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/files/0x00060000000231f1-117.dat	upx
behavioral2/memory/1848-119-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/5012-122-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/1320-125-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/3952-127-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/3452-128-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/3280-129-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/808-130-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/2764-131-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/960-132-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/1540-133-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/5104-134-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/636-135-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/1516-136-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/1924-137-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/3248-138-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4064-139-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4108-140-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/656-141-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/868-142-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/1396-143-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/5092-147-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/4584-149-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/3412-150-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/3328-151-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/360-152-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx
behavioral2/memory/3584-153-0x00007FF640090000-0x00007FF64064C000-memory.dmp	upx

VMProtect packed file 13 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/2184-0-0x00007FF6FCA40000-0x00007FF6FCE6E000-memory.dmp	vmprotect
behavioral2/memory/2184-1-0x00007FF6FCA40000-0x00007FF6FCE6E000-memory.dmp	vmprotect
behavioral2/memory/2184-7-0x00007FF6FCA40000-0x00007FF6FCE6E000-memory.dmp	vmprotect
behavioral2/files/0x00060000000231e9-6.dat	vmprotect
behavioral2/memory/1852-8-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	vmprotect
behavioral2/memory/1852-9-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	vmprotect
behavioral2/files/0x00060000000231e9-12.dat	vmprotect
behavioral2/memory/1852-44-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	vmprotect
behavioral2/memory/2768-85-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	vmprotect
behavioral2/memory/2768-86-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	vmprotect
behavioral2/memory/2768-89-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	vmprotect
behavioral2/memory/4820-144-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	vmprotect
behavioral2/memory/4820-148-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	vmprotect

AutoIT Executable 8 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2184-1-0x00007FF6FCA40000-0x00007FF6FCE6E000-memory.dmp	autoit_exe
behavioral2/memory/2184-7-0x00007FF6FCA40000-0x00007FF6FCE6E000-memory.dmp	autoit_exe
behavioral2/memory/1852-9-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	autoit_exe
behavioral2/memory/1852-44-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	autoit_exe
behavioral2/memory/2768-86-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	autoit_exe
behavioral2/memory/2768-89-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	autoit_exe
behavioral2/memory/4820-144-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	autoit_exe
behavioral2/memory/4820-148-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp	autoit_exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe
1852	MSASCuiiL.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1612	2184	7cacacdb1e83d4997662bb3f07f35e06.exe	95
PID 2184 wrote to memory of 1612	2184	7cacacdb1e83d4997662bb3f07f35e06.exe	95
PID 2184 wrote to memory of 1852	2184	7cacacdb1e83d4997662bb3f07f35e06.exe	97
PID 2184 wrote to memory of 1852	2184	7cacacdb1e83d4997662bb3f07f35e06.exe	97
PID 1612 wrote to memory of 636	1612	cmd.exe	98
PID 1612 wrote to memory of 636	1612	cmd.exe	98
PID 1852 wrote to memory of 1564	1852	MSASCuiiL.exe	99
PID 1852 wrote to memory of 1564	1852	MSASCuiiL.exe	99
PID 1852 wrote to memory of 1488	1852	MSASCuiiL.exe	101
PID 1852 wrote to memory of 1488	1852	MSASCuiiL.exe	101
PID 1852 wrote to memory of 4196	1852	MSASCuiiL.exe	104
PID 1852 wrote to memory of 4196	1852	MSASCuiiL.exe	104
PID 1852 wrote to memory of 4496	1852	MSASCuiiL.exe	106
PID 1852 wrote to memory of 4496	1852	MSASCuiiL.exe	106
PID 1852 wrote to memory of 5004	1852	MSASCuiiL.exe	108
PID 1852 wrote to memory of 5004	1852	MSASCuiiL.exe	108
PID 1852 wrote to memory of 1164	1852	MSASCuiiL.exe	110
PID 1852 wrote to memory of 1164	1852	MSASCuiiL.exe	110
PID 1852 wrote to memory of 1460	1852	MSASCuiiL.exe	112
PID 1852 wrote to memory of 1460	1852	MSASCuiiL.exe	112
PID 1852 wrote to memory of 4556	1852	MSASCuiiL.exe	114
PID 1852 wrote to memory of 4556	1852	MSASCuiiL.exe	114
PID 1852 wrote to memory of 2816	1852	MSASCuiiL.exe	116
PID 1852 wrote to memory of 2816	1852	MSASCuiiL.exe	116
PID 1852 wrote to memory of 3348	1852	MSASCuiiL.exe	118
PID 1852 wrote to memory of 3348	1852	MSASCuiiL.exe	118
PID 1852 wrote to memory of 1528	1852	MSASCuiiL.exe	120
PID 1852 wrote to memory of 1528	1852	MSASCuiiL.exe	120
PID 1852 wrote to memory of 2056	1852	MSASCuiiL.exe	122
PID 1852 wrote to memory of 2056	1852	MSASCuiiL.exe	122
PID 1852 wrote to memory of 4284	1852	MSASCuiiL.exe	124
PID 1852 wrote to memory of 4284	1852	MSASCuiiL.exe	124
PID 1852 wrote to memory of 3564	1852	MSASCuiiL.exe	126
PID 1852 wrote to memory of 3564	1852	MSASCuiiL.exe	126
PID 1852 wrote to memory of 1208	1852	MSASCuiiL.exe	128
PID 1852 wrote to memory of 1208	1852	MSASCuiiL.exe	128
PID 1852 wrote to memory of 768	1852	MSASCuiiL.exe	130
PID 1852 wrote to memory of 768	1852	MSASCuiiL.exe	130
PID 1852 wrote to memory of 4832	1852	MSASCuiiL.exe	132
PID 1852 wrote to memory of 4832	1852	MSASCuiiL.exe	132
PID 1852 wrote to memory of 3440	1852	MSASCuiiL.exe	135
PID 1852 wrote to memory of 3440	1852	MSASCuiiL.exe	135
PID 1852 wrote to memory of 2260	1852	MSASCuiiL.exe	137
PID 1852 wrote to memory of 2260	1852	MSASCuiiL.exe	137
PID 1852 wrote to memory of 2544	1852	MSASCuiiL.exe	139
PID 1852 wrote to memory of 2544	1852	MSASCuiiL.exe	139
PID 1852 wrote to memory of 1396	1852	MSASCuiiL.exe	141
PID 1852 wrote to memory of 1396	1852	MSASCuiiL.exe	141
PID 1852 wrote to memory of 4696	1852	MSASCuiiL.exe	143
PID 1852 wrote to memory of 4696	1852	MSASCuiiL.exe	143
PID 1852 wrote to memory of 3596	1852	MSASCuiiL.exe	145
PID 1852 wrote to memory of 3596	1852	MSASCuiiL.exe	145
PID 1852 wrote to memory of 4884	1852	MSASCuiiL.exe	147
PID 1852 wrote to memory of 4884	1852	MSASCuiiL.exe	147
PID 1852 wrote to memory of 892	1852	MSASCuiiL.exe	149
PID 1852 wrote to memory of 892	1852	MSASCuiiL.exe	149
PID 1852 wrote to memory of 4568	1852	MSASCuiiL.exe	151
PID 1852 wrote to memory of 4568	1852	MSASCuiiL.exe	151
PID 1852 wrote to memory of 1848	1852	MSASCuiiL.exe	153
PID 1852 wrote to memory of 1848	1852	MSASCuiiL.exe	153
PID 1852 wrote to memory of 5012	1852	MSASCuiiL.exe	155
PID 1852 wrote to memory of 5012	1852	MSASCuiiL.exe	155
PID 1852 wrote to memory of 1320	1852	MSASCuiiL.exe	157
PID 1852 wrote to memory of 1320	1852	MSASCuiiL.exe	157

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7cacacdb1e83d4997662bb3f07f35e06.exe
"C:\Users\Admin\AppData\Local\Temp\7cacacdb1e83d4997662bb3f07f35e06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c SchTasks /create /SC MINUTE /TN MicrosoftServicces /TR C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\system32\schtasks.exe
    SchTasks /create /SC MINUTE /TN MicrosoftServicces /TR C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
    3⤵
    - Creates scheduled task(s)
    PID:636
- C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
  C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1564
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1488
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4196
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4496
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5004
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1164
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1460
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4556
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2816
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3348
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1528
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2056
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4284
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3564
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1208
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:768
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4832
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3440
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2260
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2544
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1396
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4696
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3596
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4884
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:892
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4568
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1848
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5012
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1320
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3952
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3452
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3280
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:808
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2764
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:960
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1540
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5104
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:636
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1516
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1924
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3248
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4064
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4108
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:656
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:868
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1396
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5092
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4584
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3412
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3328
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:360
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3584
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4312
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2784
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4300
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3396
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2968
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3348
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3280
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:652
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4540
- - C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
    NvidiaHel.exe --server eu1-zcash.flypool.org --user t1WNMyzoQfVExf2Adqg4W9ytZSBj9WCCXbJ.worker1 --pass x --port 3333
    3⤵
    - Loads dropped DLL
    PID:2100

C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
1⤵
- Executes dropped EXE
PID:2768

C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
1⤵
- Executes dropped EXE
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autDFF0.tmp

Path C:\Users\Admin\AppData\Local\Temp\autDFF0.tmp
Size 1.2MB
SHA256 3666c1870d83f9a0e813671adfd920ea87e64a6174ece357e5b4d1b65191b5d0
MD5 07b17a890dab65ad9ec5e91b9e73af58
SHA1 c2c5314ca29830044ff26bcfb2dd575f625b825d
SHA512 3b221b0bb9dd8c26db8900f725e978642ff542fab9ab4919aa71f7aad0a1ced25ac4c3bac4b170e2d37f32982ae555641cd2c0214f81fcdd58d1480a57bcd7a2
SSDEEP 24576:yi9fMCcZp4GoHV6Tz3r5wkGBQ+hwYItQmf7oOsRvvT:yqfaZpdOV6T//GBttIamzSRn
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvidiaHel.exe

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
Size 92KB
SHA256 8ab82068dcefd78c118b031ef52c54e08fee16d778c2d48976992e3c99f994a1
MD5 ad12e2315ed93aa60e4c00ffb9276616
SHA1 e7a3e11a4df67d389cea71ad77bc2bbfbacf2d50
SHA512 9bbd98137547e73b106b3603d3effe4cac2521c48ae913b29303e552a08715d78368f4309708473a60380ed183058a277e4dc34a101632506f568da2f2568167
SSDEEP 1536:Ps7oSqfajINBNCVpidte4P9JSdT91gfPNVIche6RNcnvJUv9YiE4C9SqkiB9PiBT:U7RXj2fdtjspYfDgScvbka9PwOMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvidiaHel.exe

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
Size 1.0MB
SHA256 fa1f8c79d9e607afefe3a0e286be749bf433a44f247a06b0927f7789029ad2a6
MD5 568fe423eeb8598d52f7de364f96a25d
SHA1 42a03b8fdb43c411f0e027b147d9a688e457e0ed
SHA512 90c1f22006c778eb82663f8f209d9cfe83b23fcd0d5a662d662f6aef35a18fa006b8941d2730614bfbc6adcf92ace2a6b16dda0ed4b7ba5e8045763152a16b97
SSDEEP 24576:yi9fMCcZp4GoHV6Tz3r5wkGBQ+hwYItQmf7oOsU:yqfaZpdOV6T//GBttIamzSU
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvidiaHel.exe

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
Size 474KB
SHA256 12f1b947d47e7d102027233098332f1b2ffb065be37edc379b6643eadbbcab68
MD5 f8edb644b6f184dd03c06612a87c5456
SHA1 f18739902c7356ea65cb4f64a8742b3b13943400
SHA512 4e907c0c961f63f175a173cc2d37c05921930ddcb255c3e0922d48c400c9e26797bf7abeb2ab33f21657213a927e5b9ab1a6ce3e6cde2bb5df3653104be865e0
SSDEEP 12288:DLE5Ti6nUAIfG/rCq9Zp4WMObvwLDtxRCW5wTX7PLrrzyb8H:yi9fMCcZp4GoHV6Tz3r5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvidiaHel.exe

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
Size 25KB
SHA256 da80b20913bab570fa03fdf425adc12037b7f6382d5912fd756ae4496c2c87ca
MD5 faf7199566b503a861d1b7b3b8ddf099
SHA1 a37a19e110091d978e015697c0792fc8996b4910
SHA512 bfbda6aad3af4b94f5fd9ec6efc053a633a58a8eaaa9b0dbd6da3ba705d57797d04afbbdba3701cb67d862ca1aed0c7cd04e48029bdb25538fbdf4fe47f1834f
SSDEEP 768:wys7oLQ9qaMaDHxGxfB9c6CIcpRghrRBZvlR:Ps7oSqfajINBNCVpidtR
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvidiaHel.exe

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
Size 497KB
SHA256 18c5ce90e2dd949a5f5c36debcb458fcd317b88e28c7e20ba888bb273483c761
MD5 3aa1aa394844f7b8e162984c09802eb5
SHA1 b62165362c1e077b518987e8fc8f34a708bc603b
SHA512 0525f5b31b4e5c970b5e239eeaf03829c845cdd0bce06bba626ce05a7f2441ed18548e25f1ad9c6262bedbfbf3056ded2e742f0c8869e82694121dd1207c97d8
SSDEEP 12288:DLE5Ti6nUAIfG/rCq9Zp4WMObvwLDtxRCW5wTX7PLrrzyb82:yi9fMCcZp4GoHV6Tz3r52
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvidiaHel.exe

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
Size 15KB
SHA256 10899ed56244cd1010a8f436aae2fa8ad122cb7ad1cdc45fac5a659d1507fd53
MD5 c56ac3e047e68fa5b66b7b470d9441cb
SHA1 82aded5badb03a7744cfb30f1ee3b57c4b6deef3
SHA512 8e0ecc47388efe49ffec24c425e2c6918d285499708d74e3c5e04b0deeac511a79c9fe075bafe3edd76a6828d592804bababb71c4ef2c45f4f7b4ede7d3baa2b
SSDEEP 384:w0nnr47oLQ9qsr/0V9vVet11DEXAHaEGxA9UUsj9cV:wys7oLQ9qaMaDHxGxfB9cV
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvidiaHel.exe

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
Size 62KB
SHA256 4fbf5cb0b481a70c5960af7652a7251bbf1471ad1805cb4de23de737d3a2b8a3
MD5 0854c738f0de94b90282a7c0481bfab8
SHA1 52ce368fa8bd8e1cdc3d9bb4491f29a616c5e702
SHA512 b6530d813773cc61cb4e0c257e2320bde61470b6d67037a0ccfc8986aeddaeee9d65ee93674ce3847cd6cf8b7ffd3f3ff4af92ba7d1661823da1d1347878062c
SSDEEP 1536:Ps7oSqfajINBNCVpidte4P9JSdT91gfPNVIche6RNcnvJUk:U7RXj2fdtjspYfDgScvt
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvidiaHel.exe

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
Size 65KB
SHA256 6fe193c922adfc76c071db7790a7afddf122cc00f4171d49b0e1bbbbdcfeee83
MD5 58debba99b9c0a79db7da7b8e5448429
SHA1 d0379c984bccd86aeab1a1ed9c7509669cce8bca
SHA512 2f3d7fe3e1f54878dc17167e5d712d4defc3d403f1ef1a38077204349a54de6a65465f6977b7024a64e380e05d09f76763160040849769a8afd7f0021bdd24b3
SSDEEP 1536:Ps7oSqfajINBNCVpidte4P9JSdT91gfPNVIche6RNcnvJUv9f:U7RXj2fdtjspYfDgScvm
MD5 SHA1 SHA512 SSDEEP

Submit Download

NvidiaHel.exe

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\NvidiaHel.exe
Size 122KB
SHA256 8a769e308e46ef9e0cf62c2e926edc959262005b9769c0b644a7bb54cdf8cc3d
MD5 b6373dfbd8d4f9e9d8894c72a4c20ddc
SHA1 bb8ed78bdc8b3723f1d8de93611426035f830561
SHA512 0a921a5901ce9e4ee6f45c1948077fa115290b288f13254ff3a726e74c4d649935d3e3957f15e756925674488906291d9c79d2bc40bf8d929503218c0eb6d1cf
SSDEEP 3072:U7RXj2fdtjspYfDgScvbka9PwOM5ib7V+OF0R6Do:cOZLMbvPwOZTF06o
MD5 SHA1 SHA512 SSDEEP

Submit Download

pthreadVC2.dll

Path C:\Users\Admin\AppData\Roaming\Win32\CUDA\pthreadVC2.dll
Size 77KB
SHA256 cc568d60ddaa4dbffdd060eccc05b072600365fe6e8046070c04668152c4ad8f
MD5 cc38037372b27e02a291eccd686d5653
SHA1 dae301fcd087e0c3a03dd7252e218d04014293b0
SHA512 5c20ecf4ab0910253ed16e8b11098c88f2812a11caf18b8e1a299faa95107277d64c15a84fb907e6508d4fe9a81c070e86365a0ebff24ff98b1b565b7f906be8
SSDEEP 768:C77R7rMVmZJKS/D1IrYSjsUSDXd4lE19iH/piiLSLqW:AomL7SrLwP9iH/ptSLqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSASCuiiL.exe

Path C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
Size 1.9MB
SHA256 3aa16eade9e9c87eb71455caf797f2216757b419d3865ff7dd1b6ac09b5547ed
MD5 7cacacdb1e83d4997662bb3f07f35e06
SHA1 dc14ba7b718d17dcfb9b4ffb5f94503cd97bb139
SHA512 1347161953093ea665bdec13c653f3c7bf5d21445d6950e14da7183347cd899b05ebf7b4a68e2dd452fe4e11ce362b30e1fdd5368dd6a1c5681fa1862be5b93c
SSDEEP 49152:hpzL9JvkGM6srW4cVSSVeixSI5laWPQBMhKQ:hBDkhrW4cUWPQBM
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSASCuiiL.exe

Path C:\Users\Admin\AppData\Roaming\Win32\MSASCuiiL.exe
Size 192KB
SHA256 b89ca97eb9713f7f274117d658ebe5167290608f462a88d3b36aaca2cbeb242c
MD5 46d3817676655ec4e920a56e62d0307d
SHA1 abf3ebb7128a96565ac53c5cb896a5535a638796
SHA512 9f2b2c7f674922561d867d0b30af6537de04eb18963bbdb10a80d48341ef5860e8d6dcdb939ff5b144745b602005952f555b685a1ae63d2339535943461bd786
SSDEEP 3072:QyWljQ6NgTRbzqyhNuP3EdEDH/mMM7VVtb8yJUv5Q3WviyhU8LWUki0hUeNtt:QyRHFbzqguP3EdguZVfb9JgimvieLqiY
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/360-152-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/636-135-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/652-169-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/656-141-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/768-80-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/808-130-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/868-142-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/892-113-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/960-132-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1164-50-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1208-77-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1320-125-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1396-143-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1396-101-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1460-53-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1488-36-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1516-136-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1528-65-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1540-133-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1564-29-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1564-33-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1848-119-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/1852-9-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp

Download

memory/1852-44-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp

Download

memory/1852-8-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp

Download

memory/1924-137-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/2056-68-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/2100-173-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/2184-0-0x00007FF6FCA40000-0x00007FF6FCE6E000-memory.dmp

Download

memory/2184-7-0x00007FF6FCA40000-0x00007FF6FCE6E000-memory.dmp

Download

memory/2184-1-0x00007FF6FCA40000-0x00007FF6FCE6E000-memory.dmp

Download

memory/2260-95-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/2544-98-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/2764-131-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/2768-89-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp

Download

memory/2768-86-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp

Download

memory/2768-85-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp

Download

memory/2784-157-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/2816-59-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/2968-163-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3248-138-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3280-167-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3280-129-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3328-151-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3348-165-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3348-62-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3396-161-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3412-150-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3440-92-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3452-128-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3564-74-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3584-153-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3596-107-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/3952-127-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4064-139-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4108-140-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4196-39-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4284-71-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4300-159-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4312-155-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4496-42-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4540-171-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4556-56-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4568-116-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4584-149-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4696-104-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4820-148-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp

Download

memory/4820-144-0x00007FF6EE430000-0x00007FF6EE85E000-memory.dmp

Download

memory/4832-83-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/4884-110-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/5004-47-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/5004-46-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/5012-122-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/5092-147-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download

memory/5104-134-0x00007FF640090000-0x00007FF64064C000-memory.dmp

Download