Overview

overview

10

Static

static

3

4363463463...in.exe

windows7-x64

10

4363463463...in.exe

windows10-2004-x64

10

Resubmissions

16/02/2024, 02:54

240216-dd14ysfc7110

16/02/2024, 01:10

240216-bjwqbaea9310

09/02/2024, 16:00

240209-tfl1taed8610

09/02/2024, 13:49

240209-q4sxgsbf9v10

06/02/2024, 16:58

240206-vg3kmadccn10

06/02/2024, 00:32

240206-avq4jadbfj10

Analysis

  • max time kernel
    405s
  • max time network
    600s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    06/02/2024, 00:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4363463463464363463463463.bin.exe
  • Size 10KB
  • Sample240206-avq4jadbfj
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyphorphiexredlinezgrat666collectiondiscoveryevasioninfostealerloaderpersistencepyinstallerratspywarestealertrojanworm

Malware Config

Extracted

Family

  • redline

Botnet

  • 666

C2

  • 195.20.16.103:18305

Extracted

Family

  • amadey

Version

  • 4.17

C2

  • http://185.215.113.32

Attributes
  • install_dir

    00c07260dc

  • install_file

    explorgu.exe

  • strings_key

    461809bd97c251ba0c0c8450c7055f1d

  • url_paths

    /yandex/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 25 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Phorphiex

    Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Phorphiex payload 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 6 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Creates new service(s) 1 TTPs
    persistence
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Downloads MZ/PE file
  • Stops running service(s) 3 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 54 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Windows directory 12 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Detects Pyinstaller 11 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 6 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 18 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.bin.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup8.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup8.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:888
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2892
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
            5⤵
            • Creates scheduled task(s)
            PID:2476
          • C:\Windows\SysWOW64\chcp.com
            chcp 1251
            5⤵
              PID:2592
        • C:\Users\Admin\AppData\Local\Temp\nsd7BA7.tmp
          C:\Users\Admin\AppData\Local\Temp\nsd7BA7.tmp
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:1388
      • C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2160
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          3⤵
            PID:1664
        • C:\Users\Admin\AppData\Local\Temp\Files\data64_1.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\data64_1.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:704
        • C:\Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:476
          • C:\Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1828
        • C:\Users\Admin\AppData\Local\Temp\Files\hv.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\hv.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          PID:2740
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:980
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            3⤵
              PID:688
          • C:\Users\Admin\AppData\Local\Temp\Files\o3tech.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\o3tech.exe"
            2⤵
            • Executes dropped EXE
            PID:1808
          • C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\amert.exe"
            2⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            PID:652
          • C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\build1234.exe"
            2⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:2688
            • C:\Windows\system32\cmd.exe
              "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
              3⤵
                PID:2380
                • C:\Windows\system32\chcp.com
                  chcp 65001
                  4⤵
                    PID:676
                  • C:\Windows\system32\findstr.exe
                    findstr /R /C:"[ ]:[ ]"
                    4⤵
                      PID:2424
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show profiles
                      4⤵
                        PID:2528
                    • C:\Windows\system32\cmd.exe
                      "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
                      3⤵
                        PID:1940
                        • C:\Windows\system32\findstr.exe
                          findstr "SSID BSSID Signal"
                          4⤵
                            PID:240
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show networks mode=bssid
                            4⤵
                              PID:1660
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              4⤵
                                PID:1524
                          • C:\Users\Admin\AppData\Local\Temp\Files\Gzxzuhejdab.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\Gzxzuhejdab.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2580
                          • C:\Users\Admin\AppData\Local\Temp\Files\univ.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\univ.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:2308
                          • C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:1296
                          • C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe"
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1840
                          • C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe"
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:772
                            • C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:1356
                          • C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe"
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2328
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2744
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2952
                            • C:\Windows\System\svchost.exe
                              "C:\Windows\System\svchost.exe" formal
                              3⤵
                              • Executes dropped EXE
                              • Drops file in Windows directory
                              PID:2780
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1880
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                4⤵
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1568
                              • C:\Users\Admin\AppData\Local\Temp\~tl3BB9.tmp
                                C:\Users\Admin\AppData\Local\Temp\~tl3BB9.tmp
                                4⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious behavior: EnumeratesProcesses
                                PID:3416
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2120
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                  5⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3716
                                • C:\Windows\system32\schtasks.exe
                                  schtasks /delete /TN "Timer"
                                  5⤵
                                    PID:1560
                                  • C:\Windows\System\svchost.exe
                                    "C:\Windows\System\svchost.exe" formal
                                    5⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    PID:1348
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3460
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
                                      6⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3520
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                    5⤵
                                    • Creates scheduled task(s)
                                    PID:2360
                              • C:\Windows\system32\schtasks.exe
                                schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
                                3⤵
                                • Creates scheduled task(s)
                                PID:1884
                            • C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetThreadContext
                              PID:816
                              • C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
                                "C:\Users\Admin\AppData\Local\Temp\Files\soft.exe"
                                3⤵
                                • Executes dropped EXE
                                PID:1824
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 52
                                  4⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:2728
                            • C:\Users\Admin\AppData\Local\Temp\Files\DefenderControl.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\DefenderControl.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:952
                            • C:\Users\Admin\AppData\Local\Temp\Files\GorgeousMovement.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\GorgeousMovement.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:1744
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k cmd < Suddenly & exit
                                3⤵
                                  PID:1076
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd
                                    4⤵
                                    • Loads dropped DLL
                                    PID:1956
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist
                                      5⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1684
                                    • C:\Windows\SysWOW64\findstr.exe
                                      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                      5⤵
                                        PID:268
                                      • C:\Windows\SysWOW64\findstr.exe
                                        findstr /I "wrsa.exe"
                                        5⤵
                                          PID:1892
                                        • C:\Windows\SysWOW64\tasklist.exe
                                          tasklist
                                          5⤵
                                          • Enumerates processes with tasklist
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1096
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd /c mkdir 12793
                                          5⤵
                                            PID:1284
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /c copy /b Antique + Assurance + Volkswagen + Succeed + Equations 12793\Accommodations.pif
                                            5⤵
                                              PID:1320
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c copy /b Matches + Neck 12793\c
                                              5⤵
                                                PID:1604
                                              • C:\Windows\SysWOW64\PING.EXE
                                                ping -n 5 localhost
                                                5⤵
                                                • Runs ping.exe
                                                PID:2984
                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\12793\Accommodations.pif
                                                12793\Accommodations.pif 12793\c
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:2432
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\system32\cmd.exe" /c ping google.com && erase C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\12793\Accommodations.pif
                                                  6⤵
                                                    PID:3124
                                                    • C:\Windows\SysWOW64\PING.EXE
                                                      ping google.com
                                                      7⤵
                                                      • Runs ping.exe
                                                      PID:3156
                                          • C:\Users\Admin\AppData\Local\Temp\Files\MRK.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Files\MRK.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4092
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 600
                                              3⤵
                                              • Loads dropped DLL
                                              • Program crash
                                              PID:3008
                                          • C:\Users\Admin\AppData\Local\Temp\Files\Temp2.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Files\Temp2.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Drops file in System32 directory
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1612
                                            • C:\Windows\system32\schtasks.exe
                                              "schtasks" /create /tn "WSUS Update Client" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\Temp2.exe" /rl HIGHEST /f
                                              3⤵
                                              • Creates scheduled task(s)
                                              PID:2880
                                            • C:\Windows\SysWOW64\SubDir\asg.exe
                                              "C:\Windows\SysWOW64\SubDir\asg.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Drops file in System32 directory
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1448
                                              • C:\Windows\system32\schtasks.exe
                                                "schtasks" /create /tn "WSUS Update Client" /sc ONLOGON /tr "C:\Windows\SysWOW64\SubDir\asg.exe" /rl HIGHEST /f
                                                4⤵
                                                • Creates scheduled task(s)
                                                PID:3128
                                          • C:\Users\Admin\AppData\Local\Temp\Files\fsdfsfsfs.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Files\fsdfsfsfs.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetThreadContext
                                            PID:2736
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              3⤵
                                                PID:2180
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                3⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1340
                                            • C:\Users\Admin\AppData\Local\Temp\Files\netTimer.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Files\netTimer.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2768
                                            • C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Files\crypted.exe"
                                              2⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:3044
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                3⤵
                                                  PID:2152
                                              • C:\Users\Admin\AppData\Local\Temp\Files\patch.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\patch.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:1084
                                              • C:\Users\Admin\AppData\Local\Temp\Files\test.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\test.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3076
                                              • C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
                                                2⤵
                                                • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3348
                                              • C:\Users\Admin\AppData\Local\Temp\Files\miner.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\miner.exe"
                                                2⤵
                                                • UAC bypass
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                • System policy modification
                                                PID:3380
                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\miner.exe'; Add-MpPreference -ExclusionProcess 'miner'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
                                                  3⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3716
                                                • C:\Users\Admin\AppData\Local\Temp\480d7b8f-b25d-47b9-a364-9e72bc82a339.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\480d7b8f-b25d-47b9-a364-9e72bc82a339.exe"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  PID:3916
                                              • C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Sharp_1_4.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\StealerClient_Sharp_1_4.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:3464
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3464 -s 572
                                                  3⤵
                                                  • Program crash
                                                  PID:3556
                                              • C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\syncUpd.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:3528
                                              • C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\asdfg.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3652
                                              • C:\Users\Admin\AppData\Local\Temp\Files\cbchr.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\cbchr.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:3840
                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                  "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cbchr.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
                                                  3⤵
                                                  • Modifies Internet Explorer settings
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1684
                                                  • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
                                                    4⤵
                                                    • Modifies Internet Explorer settings
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3888
                                              • C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exe
                                                C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exe
                                                2⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetThreadContext
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious behavior: MapViewOfSection
                                                PID:4004
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\SysWOW64\cmd.exe
                                                  3⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4064
                                              • C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\Update_new.exe"
                                                2⤵
                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                • Checks BIOS information in registry
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1244
                                              • C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe"
                                                2⤵
                                                • Modifies WinLogon for persistence
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Enumerates connected drives
                                                • Drops file in System32 directory
                                                • Drops file in Windows directory
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3912
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /C AT /delete /yes
                                                  3⤵
                                                    PID:2588
                                                    • C:\Windows\SysWOW64\at.exe
                                                      AT /delete /yes
                                                      4⤵
                                                        PID:3976
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
                                                      3⤵
                                                        PID:3824
                                                        • C:\Windows\SysWOW64\at.exe
                                                          AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\RVHOST.exe
                                                          4⤵
                                                            PID:3476
                                                      • C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe"
                                                        2⤵
                                                        • UAC bypass
                                                        • Executes dropped EXE
                                                        • Checks whether UAC is enabled
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • System policy modification
                                                        PID:3896
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\wefhrf.exe'; Add-MpPreference -ExclusionProcess 'wefhrf'; Add-MpPreference -ExclusionPath 'C:\Users\Admin'"
                                                          3⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3840
                                                        • C:\Users\Admin\AppData\Local\Temp\d5a4a27a-ca5e-48a9-ad27-7d0f5c1dc6f3.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\d5a4a27a-ca5e-48a9-ad27-7d0f5c1dc6f3.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          PID:4044
                                                          • C:\Users\Admin\AppData\Local\Temp\d5a4a27a-ca5e-48a9-ad27-7d0f5c1dc6f3.exe
                                                            C:\Users\Admin\AppData\Local\Temp\d5a4a27a-ca5e-48a9-ad27-7d0f5c1dc6f3.exe
                                                            4⤵
                                                              PID:2272
                                                              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                5⤵
                                                                  PID:1944
                                                          • C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Files\ma.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3504
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpEC81.tmp.bat""
                                                              3⤵
                                                                PID:2676
                                                                • C:\Windows\system32\timeout.exe
                                                                  timeout 3
                                                                  4⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:2412
                                                                • C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
                                                                  "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:3388
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
                                                                    5⤵
                                                                      PID:2680
                                                                      • C:\Windows\system32\schtasks.exe
                                                                        schtasks /create /f /sc MINUTE /mo 3 /RL HIGHEST /tn "ERGVRDVMSK" /tr "C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe"
                                                                        6⤵
                                                                        • Creates scheduled task(s)
                                                                        PID:3620
                                                              • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:2792
                                                                • C:\Users\Admin\AppData\Local\Temp\311628906.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\311628906.exe
                                                                  3⤵
                                                                  • Windows security bypass
                                                                  • Executes dropped EXE
                                                                  • Windows security modification
                                                                  • Adds Run key to start application
                                                                  • Drops file in Windows directory
                                                                  PID:4024
                                                                  • C:\Users\Admin\AppData\Local\Temp\2509131704.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\2509131704.exe
                                                                    4⤵
                                                                      PID:2512
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 108
                                                                        5⤵
                                                                        • Program crash
                                                                        PID:2708
                                                                    • C:\Users\Admin\AppData\Local\Temp\141441971.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\141441971.exe
                                                                      4⤵
                                                                        PID:3944
                                                                      • C:\Users\Admin\AppData\Local\Temp\490632233.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\490632233.exe
                                                                        4⤵
                                                                          PID:1744
                                                                        • C:\Users\Admin\AppData\Local\Temp\1143526566.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\1143526566.exe
                                                                          4⤵
                                                                            PID:1528
                                                                            • C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
                                                                              5⤵
                                                                                PID:3100
                                                                              • C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
                                                                                5⤵
                                                                                  PID:3412
                                                                                • C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe"
                                                                                  5⤵
                                                                                    PID:3572
                                                                                • C:\Users\Admin\AppData\Local\Temp\437121154.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\437121154.exe
                                                                                  4⤵
                                                                                    PID:240
                                                                              • C:\Users\Admin\AppData\Local\Temp\Files\moto.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Files\moto.exe"
                                                                                2⤵
                                                                                • Checks BIOS information in registry
                                                                                • Executes dropped EXE
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:2180
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe delete "FLWCUERA"
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:4040
                                                                                • C:\Windows\system32\sc.exe
                                                                                  C:\Windows\system32\sc.exe create "FLWCUERA" binpath= "C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe" start= "auto"
                                                                                  3⤵
                                                                                  • Launches sc.exe
                                                                                  PID:3532
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\Files\moto.exe"
                                                                                  3⤵
                                                                                    PID:3340
                                                                                    • C:\Windows\system32\choice.exe
                                                                                      choice /C Y /N /D Y /T 3
                                                                                      4⤵
                                                                                        PID:3640
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe start "FLWCUERA"
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:3744
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe stop eventlog
                                                                                      3⤵
                                                                                      • Launches sc.exe
                                                                                      PID:3188
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe"
                                                                                    2⤵
                                                                                      PID:2604
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2604 -s 460
                                                                                        3⤵
                                                                                        • Program crash
                                                                                        PID:2936
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Files\gate3_64.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Files\gate3_64.exe"
                                                                                      2⤵
                                                                                        PID:3736
                                                                                        • C:\Users\Admin\Documents\GuardFox\tpczwXSHOKXXj75VLolc9nR3.exe
                                                                                          "C:\Users\Admin\Documents\GuardFox\tpczwXSHOKXXj75VLolc9nR3.exe"
                                                                                          3⤵
                                                                                            PID:3936
                                                                                          • C:\Users\Admin\Documents\GuardFox\a0Esv0zqmBEfukfNkOIVNgh1.exe
                                                                                            "C:\Users\Admin\Documents\GuardFox\a0Esv0zqmBEfukfNkOIVNgh1.exe"
                                                                                            3⤵
                                                                                              PID:1532
                                                                                            • C:\Users\Admin\Documents\GuardFox\izHHLLehqpXOKuiW82aVkDGL.exe
                                                                                              "C:\Users\Admin\Documents\GuardFox\izHHLLehqpXOKuiW82aVkDGL.exe"
                                                                                              3⤵
                                                                                                PID:3572
                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-JR392.tmp\izHHLLehqpXOKuiW82aVkDGL.tmp
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-JR392.tmp\izHHLLehqpXOKuiW82aVkDGL.tmp" /SL5="$4034A,7700079,54272,C:\Users\Admin\Documents\GuardFox\izHHLLehqpXOKuiW82aVkDGL.exe"
                                                                                                  4⤵
                                                                                                    PID:448
                                                                                                • C:\Users\Admin\Documents\GuardFox\Ja6gIHWdkdSSolf9dZf2b_Iw.exe
                                                                                                  "C:\Users\Admin\Documents\GuardFox\Ja6gIHWdkdSSolf9dZf2b_Iw.exe"
                                                                                                  3⤵
                                                                                                    PID:2160
                                                                                                  • C:\Users\Admin\Documents\GuardFox\rU9kpmZu1uk6FgIG8muTaKRx.exe
                                                                                                    "C:\Users\Admin\Documents\GuardFox\rU9kpmZu1uk6FgIG8muTaKRx.exe"
                                                                                                    3⤵
                                                                                                      PID:2308
                                                                                                    • C:\Users\Admin\Documents\GuardFox\ir2h1MHXvmyaLmXf3iBNMDWg.exe
                                                                                                      "C:\Users\Admin\Documents\GuardFox\ir2h1MHXvmyaLmXf3iBNMDWg.exe"
                                                                                                      3⤵
                                                                                                        PID:2596
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Files\MartDrum.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Files\MartDrum.exe"
                                                                                                      2⤵
                                                                                                        PID:2324
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /k cmd < Tunisia & exit
                                                                                                          3⤵
                                                                                                            PID:2084
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd
                                                                                                              4⤵
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:3552
                                                                                                              • C:\Windows\SysWOW64\findstr.exe
                                                                                                                findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                                                                                                                5⤵
                                                                                                                  PID:3216
                                                                                                                • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                  tasklist
                                                                                                                  5⤵
                                                                                                                  • Enumerates processes with tasklist
                                                                                                                  PID:2120
                                                                                                                • C:\Windows\SysWOW64\findstr.exe
                                                                                                                  findstr /I "wrsa.exe"
                                                                                                                  5⤵
                                                                                                                    PID:1028
                                                                                                                  • C:\Windows\SysWOW64\tasklist.exe
                                                                                                                    tasklist
                                                                                                                    5⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:2112
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    cmd /c mkdir 14272
                                                                                                                    5⤵
                                                                                                                      PID:2040
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      cmd /c copy /b Cock + Enhance + Forest + Grocery + Mall 14272\Fighting.pif
                                                                                                                      5⤵
                                                                                                                        PID:4088
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        cmd /c copy /b Amd + Backed 14272\Q
                                                                                                                        5⤵
                                                                                                                          PID:2508
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\14272\Fighting.pif
                                                                                                                          14272\Fighting.pif 14272\Q
                                                                                                                          5⤵
                                                                                                                            PID:1632
                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                            ping -n 5 localhost
                                                                                                                            5⤵
                                                                                                                            • Runs ping.exe
                                                                                                                            PID:3620
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Files\Setup11.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Files\Setup11.exe"
                                                                                                                      2⤵
                                                                                                                        PID:2484
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"
                                                                                                                        2⤵
                                                                                                                          PID:3728
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe"
                                                                                                                            3⤵
                                                                                                                              PID:2664
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Files\Ogovckrrq.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Files\Ogovckrrq.exe"
                                                                                                                            2⤵
                                                                                                                              PID:2176
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Files\Windows.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Files\Windows.exe"
                                                                                                                              2⤵
                                                                                                                                PID:3780
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_NyNIUi.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Files\TrueCrypt_NyNIUi.exe"
                                                                                                                                2⤵
                                                                                                                                  PID:1616
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Files\dota.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Files\dota.exe"
                                                                                                                                  2⤵
                                                                                                                                    PID:2040
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe"
                                                                                                                                    2⤵
                                                                                                                                      PID:676
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"
                                                                                                                                      2⤵
                                                                                                                                        PID:2440
                                                                                                                                        • C:\Windows\syspolrvcs.exe
                                                                                                                                          C:\Windows\syspolrvcs.exe
                                                                                                                                          3⤵
                                                                                                                                            PID:1588
                                                                                                                                      • C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
                                                                                                                                        C:\ProgramData\eyfisgalqlbk\iojmibhyhiws.exe
                                                                                                                                        1⤵
                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:3552
                                                                                                                                        • C:\Windows\system32\conhost.exe
                                                                                                                                          C:\Windows\system32\conhost.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:3984
                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                            conhost.exe
                                                                                                                                            2⤵
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1524
                                                                                                                                        • C:\Windows\system32\taskeng.exe
                                                                                                                                          taskeng.exe {FB236435-4F14-4D66-AF45-FB1AD3C5D134} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                                                                          1⤵
                                                                                                                                            PID:2076
                                                                                                                                            • \??\c:\windows\system\svchost.exe
                                                                                                                                              c:\windows\system\svchost.exe
                                                                                                                                              2⤵
                                                                                                                                                PID:1844
                                                                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                              C:\Windows\system32\AUDIODG.EXE 0x5b8
                                                                                                                                              1⤵
                                                                                                                                                PID:3252
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoseidonSense.url" & echo URL="C:\Users\Admin\AppData\Local\GreenTech Innovations\PoseidonSense.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PoseidonSense.url" & exit
                                                                                                                                                1⤵
                                                                                                                                                  PID:1700
                                                                                                                                                • C:\Windows\system32\taskeng.exe
                                                                                                                                                  taskeng.exe {689C7B7F-9968-44D2-85CD-DE2803EE2F85} S-1-5-21-3627615824-4061627003-3019543961-1000:SCFGBRBT\Admin:Interactive:[1]
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3524
                                                                                                                                                    • C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
                                                                                                                                                      C:\ProgramData\SystemPropertiesDataExecutionPrevention\.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1412
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\14272\jsc.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\14272\jsc.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3640

                                                                                                                                                      Network

                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                            Reconnaissance

                                                                                                                                                            Resource Development

                                                                                                                                                            Initial Access

                                                                                                                                                            Execution

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Persistence

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            2
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                            1
                                                                                                                                                            T1547.004

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            2
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            2
                                                                                                                                                            T1543.003

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Privilege Escalation

                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                            1
                                                                                                                                                            T1548

                                                                                                                                                            Bypass User Account Control

                                                                                                                                                            1
                                                                                                                                                            T1548.002

                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                            2
                                                                                                                                                            T1547

                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                            1
                                                                                                                                                            T1547.001

                                                                                                                                                            Winlogon Helper DLL

                                                                                                                                                            1
                                                                                                                                                            T1547.004

                                                                                                                                                            Create or Modify System Process

                                                                                                                                                            2
                                                                                                                                                            T1543

                                                                                                                                                            Windows Service

                                                                                                                                                            2
                                                                                                                                                            T1543.003

                                                                                                                                                            Scheduled Task/Job

                                                                                                                                                            1
                                                                                                                                                            T1053

                                                                                                                                                            Defense Evasion

                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                            1
                                                                                                                                                            T1548

                                                                                                                                                            Bypass User Account Control

                                                                                                                                                            1
                                                                                                                                                            T1548.002

                                                                                                                                                            Impair Defenses

                                                                                                                                                            4
                                                                                                                                                            T1562

                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                            3
                                                                                                                                                            T1562.001

                                                                                                                                                            Modify Registry

                                                                                                                                                            8
                                                                                                                                                            T1112

                                                                                                                                                            Subvert Trust Controls

                                                                                                                                                            1
                                                                                                                                                            T1553

                                                                                                                                                            Install Root Certificate

                                                                                                                                                            1
                                                                                                                                                            T1553.004

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            2
                                                                                                                                                            T1497

                                                                                                                                                            Credential Access

                                                                                                                                                            Unsecured Credentials

                                                                                                                                                            4
                                                                                                                                                            T1552

                                                                                                                                                            Credentials In Files

                                                                                                                                                            4
                                                                                                                                                            T1552.001

                                                                                                                                                            Discovery

                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                            1
                                                                                                                                                            T1120

                                                                                                                                                            Process Discovery

                                                                                                                                                            1
                                                                                                                                                            T1057

                                                                                                                                                            Query Registry

                                                                                                                                                            7
                                                                                                                                                            T1012

                                                                                                                                                            Remote System Discovery

                                                                                                                                                            1
                                                                                                                                                            T1018

                                                                                                                                                            System Information Discovery

                                                                                                                                                            5
                                                                                                                                                            T1082

                                                                                                                                                            Virtualization/Sandbox Evasion

                                                                                                                                                            2
                                                                                                                                                            T1497

                                                                                                                                                            Lateral Movement

                                                                                                                                                            Collection

                                                                                                                                                            Data from Local System

                                                                                                                                                            4
                                                                                                                                                            T1005

                                                                                                                                                            Email Collection

                                                                                                                                                            1
                                                                                                                                                            T1114

                                                                                                                                                            Command and Control

                                                                                                                                                            Web Service

                                                                                                                                                            1
                                                                                                                                                            T1102

                                                                                                                                                            Exfiltration

                                                                                                                                                            Impact

                                                                                                                                                            Service Stop

                                                                                                                                                            1
                                                                                                                                                            T1489

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            Are.docx
                                                                                                                                                            • Path C:\ProgramData\Are.docx
                                                                                                                                                            • Size 11KB
                                                                                                                                                            • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            DHJDAKEG
                                                                                                                                                            • Path C:\ProgramData\DHJDAKEG
                                                                                                                                                            • Size 92KB
                                                                                                                                                            • SHA256 53c5e056da67d60a3b2872f8d4bda857f687be398ed05ed17c102f4c4b942883
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            StepInstall.txt
                                                                                                                                                            • Path C:\ProgramData\StepInstall.txt
                                                                                                                                                            • Size 1.2MB
                                                                                                                                                            • SHA256 e20c74065daa2899fa2e1e8b402c5cf000d2c2da32943a1870a0f6f89c65250e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            UnpublishRename.xlsx
                                                                                                                                                            • Path C:\ProgramData\UnpublishRename.xlsx
                                                                                                                                                            • Size 1.0MB
                                                                                                                                                            • SHA256 d693a6b3b0a6656ac49d96c835e4598a61836c8b5068cbd2f7076a6ea5be47da
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            6B2043001D270792DFFD725518EAFE2C
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C
                                                                                                                                                            • Size 579B
                                                                                                                                                            • SHA256 31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 65KB
                                                                                                                                                            • SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            6B2043001D270792DFFD725518EAFE2C
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C
                                                                                                                                                            • Size 252B
                                                                                                                                                            • SHA256 9a4c69fe7c16e990c05487bf54ab0bfb539ba3cf0e3a3d79283b38023e5b4cd8
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 344B
                                                                                                                                                            • SHA256 cad540d3083134887873aae17e668bcfeb70ed938fbc8023e99d15cd4caa9199
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 344B
                                                                                                                                                            • SHA256 ad45b6bd23009ebf72556abe5a23f05222f94a7cc253e5d3416d1eab2bb4c55e
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 344B
                                                                                                                                                            • SHA256 8c126373186e75f7fe70a987b8b97b289bd5d80b407ce3f0e85f8bf9224693c0
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 344B
                                                                                                                                                            • SHA256 e994680eb59544026071d9788dc2cb068a33bb6dce79b29e74e4b7e21946ffea
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 344B
                                                                                                                                                            • SHA256 1a2f9663002331092d424fffbe92b4b244b1e68973d289ae8662f610410a01ec
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 344B
                                                                                                                                                            • SHA256 0672800f95fe0789ce61fabf0b06588107c35cbfdf010b2a6e45128637aeba7a
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 344B
                                                                                                                                                            • SHA256 659e01c07becdfd7d5c62e92323b1e646465722132a7f1de48cfc65e87c4c49a
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 344B
                                                                                                                                                            • SHA256 401c6d00784b92bcdc4459013531edf19a1716ed88f4278e2554f58b7b07f44c
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                                                                                                                                            • Size 344B
                                                                                                                                                            • SHA256 9ebe2626f31ba8a09cc688a0a8d9bc19e74f5ce84edc58b45d8923b848003865
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
                                                                                                                                                            • Size 242B
                                                                                                                                                            • SHA256 e650819dc1dded2f38db8509e082fdab6c7f3bd4a1f6e8940675baa87578f9ed
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
                                                                                                                                                            • Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
                                                                                                                                                            • Size 4KB
                                                                                                                                                            • SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            nss3[1].dll
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S09WNX97\nss3[1].dll
                                                                                                                                                            • Size 1.3MB
                                                                                                                                                            • SHA256 56c5047bc309e33043222a62432e9708dc1852253cc0cc2241498168353483e8
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            141441971.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\141441971.exe
                                                                                                                                                            • Size 79KB
                                                                                                                                                            • SHA256 c07243389989e597d65e2f2fd11d43c07719c520da9723e2f66f0814dfc1f0ea
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            311628906.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\311628906.exe
                                                                                                                                                            • Size 79KB
                                                                                                                                                            • SHA256 94a66eea65edd08ca19bf6db266058e81714312b6a51892298b461ffd8b90161
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Cock
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Cock
                                                                                                                                                            • Size 245KB
                                                                                                                                                            • SHA256 4b4fa7e6aa4e413577040eed27ab1b8295e0f019ca4007dedf5d131bacb8c86a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            BroomSetup.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                                                                                                                                                            • Size 1.7MB
                                                                                                                                                            • SHA256 1839245a5eb47e00bfa74609911b79bcb199240ec4d013fc081facf8514dd2db
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            382498393934ena-rr.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe
                                                                                                                                                            • Size 2.7MB
                                                                                                                                                            • SHA256 c5d45c5ebe085deac51d8c8194d16fcd0ef456d4892ceb328e4de322e3fffc4b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            382498393934ena-rr.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 a8556aacde908091b8720ddb5a67c31b639cf73b7dcfa5d8e31f273427c33c27
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760.exe
                                                                                                                                                            • Size 334KB
                                                                                                                                                            • SHA256 3b9da1066d77143b24ee1c9b9c9787f63400bc599fcaf4bfc8f58efc802cf760
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            DefenderControl.ini
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\DefenderControl.ini
                                                                                                                                                            • Size 1KB
                                                                                                                                                            • SHA256 dc7706246c39f69ff77e6ac447b1a2de41683fbcf5a5a89fca6025cc5b005548
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            Gzxzuhejdab.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\Gzxzuhejdab.exe
                                                                                                                                                            • Size 127KB
                                                                                                                                                            • SHA256 aa04a13d2668a7bb8367e920efb6a0bae4b0bca315107a0d834a1478d25b34d2
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Gzxzuhejdab.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\Gzxzuhejdab.exe
                                                                                                                                                            • Size 285KB
                                                                                                                                                            • SHA256 f4d08b0ec6a43b6468069ba449befd14bc7c8e3fcf041c0bf9654dbc49860605
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            InstallSetup8.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup8.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 887cac6d25886c334e88ed7e9012e78fbecb5bc7d89e92844d3b116cb7602605
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            InstallSetup8.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\InstallSetup8.exe
                                                                                                                                                            • Size 1.6MB
                                                                                                                                                            • SHA256 7dc7f9746ba91cf2d5a22922432c16cd205af686554a0a094b34077aeb845cac
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            M5traider.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe
                                                                                                                                                            • Size 1024KB
                                                                                                                                                            • SHA256 1302839eb9500b49e94947f91edc55944aa042db6deccf53429987c73622d684
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            M5traider.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\M5traider.exe
                                                                                                                                                            • Size 602KB
                                                                                                                                                            • SHA256 de5c45ce06f43c3d9bc7c2978af67922a8254d08f9a0dfa1241d236700db9168
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            PresentationFontCache.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe
                                                                                                                                                            • Size 4.1MB
                                                                                                                                                            • SHA256 b8025209060d12d5487ba32f040497b6bec56030c4bf3d40a96db4132b31078e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            PresentationFontCache.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe
                                                                                                                                                            • Size 3.5MB
                                                                                                                                                            • SHA256 546a0287aa1c8a287272db902e28278a94a29d355d329452c144f1173f6776cd
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            PresentationFontCache.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe
                                                                                                                                                            • Size 4.5MB
                                                                                                                                                            • SHA256 b696e65abfe073f20e760aca2439ebd15ad8eac99369a24deab3c4d52f7c062a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Wattyl.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\Wattyl.exe
                                                                                                                                                            • Size 477KB
                                                                                                                                                            • SHA256 2919b157d8d2161bf56a17af0efc171d8e2c3c233284cf116e8c968dd9704572
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            amert.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
                                                                                                                                                            • Size 41KB
                                                                                                                                                            • SHA256 7f0e8ee75027c34e70c6a24990feb3fd26e64f60743cce02c4b8dcb882a33b17
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            amert.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
                                                                                                                                                            • Size 17KB
                                                                                                                                                            • SHA256 523ac9808778130bc60479613d55ff96047d4dcfe137a332f1dc983071451f0d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            amert.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\amert.exe
                                                                                                                                                            • Size 150KB
                                                                                                                                                            • SHA256 dcfe2e5dc3a2db2b6a0c0654f502ec02d9955bc1a838a73adba89dca7d41c833
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            cbchr.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\cbchr.exe
                                                                                                                                                            • Size 243KB
                                                                                                                                                            • SHA256 b037843ef212f9907c4c2f22167379db44aa02d7c647c53278b4d8d784343537
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            cs_maltest.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\cs_maltest.exe
                                                                                                                                                            • Size 136KB
                                                                                                                                                            • SHA256 7b021b996b65f29cae4896c11d3a31874e2d5c4ce8a7a212c8bedf7dcae0f8ae
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            data64_1.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\data64_1.exe
                                                                                                                                                            • Size 9KB
                                                                                                                                                            • SHA256 08fa07c28724cb7a64f936efa29b42446786f4a8f40dc311dd1bd5f3fe8d704a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            ghjkl.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\ghjkl.exe
                                                                                                                                                            • Size 2.1MB
                                                                                                                                                            • SHA256 217fbf967c95d1359314fcd53ae8d04489eb3c7bdc1f22110d5a8a476d1fc92e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            hv.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\hv.exe
                                                                                                                                                            • Size 341KB
                                                                                                                                                            • SHA256 28a2654d3e7e1eb602f29c385baa4f56f7e6bd1cfe0fbcdacb165878994f0ff7
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            hv.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\hv.exe
                                                                                                                                                            • Size 329KB
                                                                                                                                                            • SHA256 73f8b57a174b6f85fe34f40dfec159216bf557ca771977f98d15a49581080ec8
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            kb^fr_ouverture.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\kb^fr_ouverture.exe
                                                                                                                                                            • Size 11KB
                                                                                                                                                            • SHA256 693fbe27170b14efde45d627cf3e0af36143762d2ef70a52a8402f121f6d6ae4
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            ma.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\ma.exe
                                                                                                                                                            • Size 768KB
                                                                                                                                                            • SHA256 fc51641fa2bbac2d11a6fc1e4d459a0095d627194af1d915c8a46b89a9271af5
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            moto.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\moto.exe
                                                                                                                                                            • Size 896KB
                                                                                                                                                            • SHA256 073f03695106b6421edea02778675f93c0ae97f2371e2e5d683c6c0c69c30a37
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            o3tech.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\o3tech.exe
                                                                                                                                                            • Size 452KB
                                                                                                                                                            • SHA256 f8d39fd9e795c6980b7ac12138a539da171ccb1a86fb55bd9254c10f965c2e52
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            soft.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\soft.exe
                                                                                                                                                            • Size 870KB
                                                                                                                                                            • SHA256 1855f2e186082829dc56b0a519121067853c92d7d96d1d630616c14c2a38ff81
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            timeSync.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\timeSync.exe
                                                                                                                                                            • Size 307KB
                                                                                                                                                            • SHA256 ca6f9561aee75b5af06dae196d2d79f7b66c840f96947c2bacb386065726afeb
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            twztl.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
                                                                                                                                                            • Size 80KB
                                                                                                                                                            • SHA256 b5bf9b891fdd046d626082bad71ef887a9fcafca9cdfd6887d2e60ef6d4a0462
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            univ.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\univ.exe
                                                                                                                                                            • Size 353KB
                                                                                                                                                            • SHA256 5c18ffb101e46d491832511d997a4f5791134bf39a1f3d4354439d4d773d762b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            voice5.13sert.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe
                                                                                                                                                            • Size 1.2MB
                                                                                                                                                            • SHA256 af48e88165b44a6db6275db3af48dcae49c502d8e0e56702f41dc60f94ad5b80
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            voice5.13sert.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe
                                                                                                                                                            • Size 2.2MB
                                                                                                                                                            • SHA256 a22e21b5ca8ba036bbf0315e5bc1127eb29dba8173a9b581d85fbfc532ba4101
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            voice5.13sert.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe
                                                                                                                                                            • Size 1.4MB
                                                                                                                                                            • SHA256 95e4e695290e3e337c7b833e961b4e1ffd73976e5ea70e04bde0145035d19bbe
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Tar7229.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Tar7229.tmp
                                                                                                                                                            • Size 171KB
                                                                                                                                                            • SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Windows Security Upgrade Service.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\Windows Security Upgrade Service.exe
                                                                                                                                                            • Size 20KB
                                                                                                                                                            • SHA256 1a97deb1661bd0c9e50415a15bee1e40f8a2e9346b5d03ff59cb5b21c357d2c3
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            python311.dll
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI4762\python311.dll
                                                                                                                                                            • Size 1018KB
                                                                                                                                                            • SHA256 16b945816bad6eb8d9ac684b7d791d6c795c14739c29b6e5ff8657e5884c1b3d
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            python311.dll
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\_MEI7722\python311.dll
                                                                                                                                                            • Size 3.8MB
                                                                                                                                                            • SHA256 e8d56453fcd7872aef32c055c081aaba3760fe3fe16321f125e92a43ce6766ae
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            nsd7BA7.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\nsd7BA7.tmp
                                                                                                                                                            • Size 307KB
                                                                                                                                                            • SHA256 327480fc54d13e3e32f6db1cec9d6acf18a396f533e00274f96da7080acbd28e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            tmp5A60.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmp5A60.tmp
                                                                                                                                                            • Size 20KB
                                                                                                                                                            • SHA256 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            tmpEC81.tmp.bat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpEC81.tmp.bat
                                                                                                                                                            • Size 168B
                                                                                                                                                            • SHA256 95c7619f90bc9a7155634e12cd00d34f48de2d233dc390ee884f610ff31838cd
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            413TD1EH5LDJQ9PNJYP6.temp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\413TD1EH5LDJQ9PNJYP6.temp
                                                                                                                                                            • Size 7KB
                                                                                                                                                            • SHA256 37838832e143f3dc554c1f37cf78c063a662f314e973cec8643c14642ae134ed
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Task.bat
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\Temp\Task.bat
                                                                                                                                                            • Size 128B
                                                                                                                                                            • SHA256 6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            VCDDaemon.exe
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\msdt\VCDDaemon.exe
                                                                                                                                                            • Size 86KB
                                                                                                                                                            • SHA256 332e6806eff846a2e6d0dc04a70d3503855dabfa83e6ec27f37e2d9103e80e51
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            cached-microdesc-consensus.tmp
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
                                                                                                                                                            • Size 2.6MB
                                                                                                                                                            • SHA256 17427900157943c34a1928ab2da52d106bb249ae8fea62ca411df7d24a4e1e3c
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            cached-microdescs.new
                                                                                                                                                            • Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                                                                            • Size 14.9MB
                                                                                                                                                            • SHA256 3333cf71d04cbf6a7609266056b164222fe5d40ea96b03f342ae156ae1a22dab
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Ja6gIHWdkdSSolf9dZf2b_Iw.exe
                                                                                                                                                            • Path C:\Users\Admin\Documents\GuardFox\Ja6gIHWdkdSSolf9dZf2b_Iw.exe
                                                                                                                                                            • Size 1.9MB
                                                                                                                                                            • SHA256 5bdfc4959f65de99c89c4a93e3d30b43548ae604cc942fbc857b48d07f310c88
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            MKb3SffDkKxaAfCWNwT38iVm.exe
                                                                                                                                                            • Path C:\Users\Admin\Documents\GuardFox\MKb3SffDkKxaAfCWNwT38iVm.exe
                                                                                                                                                            • Size 241KB
                                                                                                                                                            • SHA256 6f3b37db961e50ea3f72af675a67f902baadc3038f8f0e8a9a662ad5a8e21481
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            h3Lfg3AnLL_17GI_qYrqIImi.exe
                                                                                                                                                            • Path C:\Users\Admin\Documents\GuardFox\h3Lfg3AnLL_17GI_qYrqIImi.exe
                                                                                                                                                            • Size 241KB
                                                                                                                                                            • SHA256 5a0cd441ffea7618d44d3aa8fb401fb3418c6d8a5c26772000c4f989abdce606
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            ir2h1MHXvmyaLmXf3iBNMDWg.exe
                                                                                                                                                            • Path C:\Users\Admin\Documents\GuardFox\ir2h1MHXvmyaLmXf3iBNMDWg.exe
                                                                                                                                                            • Size 296KB
                                                                                                                                                            • SHA256 4f1806d4e580fbc8ae97b25f4d0a4f371252d1e5cdbbb954636f20c8faa2eafb
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            izHHLLehqpXOKuiW82aVkDGL.exe
                                                                                                                                                            • Path C:\Users\Admin\Documents\GuardFox\izHHLLehqpXOKuiW82aVkDGL.exe
                                                                                                                                                            • Size 2.1MB
                                                                                                                                                            • SHA256 b3048fca3a8456d7d470e3d2824bb6567cbd9c51e6d01195dcde0c26ea156287
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            rU9kpmZu1uk6FgIG8muTaKRx.exe
                                                                                                                                                            • Path C:\Users\Admin\Documents\GuardFox\rU9kpmZu1uk6FgIG8muTaKRx.exe
                                                                                                                                                            • Size 2.2MB
                                                                                                                                                            • SHA256 8ef1f217551c95e0a1337615ace7894e564f35bce71bff19dbe7708f18fa835b
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            tpczwXSHOKXXj75VLolc9nR3.exe
                                                                                                                                                            • Path C:\Users\Admin\Documents\GuardFox\tpczwXSHOKXXj75VLolc9nR3.exe
                                                                                                                                                            • Size 296KB
                                                                                                                                                            • SHA256 4caad70658f9199c1a36ec8950c98c359ff5f6f06ed34e35a00c853d2c1db631
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            asg.exe
                                                                                                                                                            • Path C:\Windows\SysWOW64\SubDir\asg.exe
                                                                                                                                                            • Size 342KB
                                                                                                                                                            • SHA256 3588657707cd5b04586693c6600be0159b321b258f48953f824faa876f6b8566
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            gpt.ini
                                                                                                                                                            • Path C:\Windows\System32\GroupPolicy\gpt.ini
                                                                                                                                                            • Size 127B
                                                                                                                                                            • SHA256 9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
                                                                                                                                                            • MD5 SHA1 SHA512
                                                                                                                                                            Submit Download

                                                                                                                                                            svchost.exe
                                                                                                                                                            • Path C:\Windows\system\svchost.exe
                                                                                                                                                            • Size 3.3MB
                                                                                                                                                            • SHA256 71edeb6bad66b432ff252e61c75a0aa2c0e696e815f2d9158fe3fc25a82a95ba
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            winkqdvsdo.exe
                                                                                                                                                            • Path C:\Windows\winkqdvsdo.exe
                                                                                                                                                            • Size 23KB
                                                                                                                                                            • SHA256 deb0e9fe1aa66fc42d58bf8561a417d6018f4a1b28b9d2a891a353b6f3d670d0
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            mozglue.dll
                                                                                                                                                            • Path \ProgramData\mozglue.dll
                                                                                                                                                            • Size 593KB
                                                                                                                                                            • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            nss3.dll
                                                                                                                                                            • Path \ProgramData\nss3.dll
                                                                                                                                                            • Size 1.2MB
                                                                                                                                                            • SHA256 a94f40af426c23c9943175c72d41b44c185e94771366de8f9c437e35bbb7b99f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            BroomSetup.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\BroomSetup.exe
                                                                                                                                                            • Size 1.5MB
                                                                                                                                                            • SHA256 6128e517cf06e19230be5e206006d813a5f4af0ad38f58fd92755f90b14cf0a0
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            382498393934ena-rr.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe
                                                                                                                                                            • Size 2.6MB
                                                                                                                                                            • SHA256 85a22eb0fec2df05100298717947d19c0bd5d3bf4b9f9503d06620cc8c031e31
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            382498393934ena-rr.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\382498393934ena-rr.exe
                                                                                                                                                            • Size 3.0MB
                                                                                                                                                            • SHA256 960567c29077463dd638be427c550372e2ee2ace96df79bdaef97a30ffac52b7
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Gzxzuhejdab.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\Gzxzuhejdab.exe
                                                                                                                                                            • Size 197KB
                                                                                                                                                            • SHA256 24ae9f204a6e0e3ad23d8bc67286d67920cf81572bba14fc2cb861daf22b015c
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            InstallSetup8.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\InstallSetup8.exe
                                                                                                                                                            • Size 1.7MB
                                                                                                                                                            • SHA256 2addb4cfcce2cf95e60b338b6fa9f62b02f48ff70e34b3de183ad0458d3765bf
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            M5traider.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\M5traider.exe
                                                                                                                                                            • Size 674KB
                                                                                                                                                            • SHA256 6960f672cee9df788fb6c04c3f1396cce9b253758cf258b4edede71297d7a888
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            PresentationFontCache.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\PresentationFontCache.exe
                                                                                                                                                            • Size 2.9MB
                                                                                                                                                            • SHA256 60350f3bcb983c8109ef0165d57dbbc6f0c93e2076abdc27419a3efccba82c8e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            amert.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\amert.exe
                                                                                                                                                            • Size 29KB
                                                                                                                                                            • SHA256 79749c07658f92a09342485c6f684bb4bd424084b89df9f0979fe8ac3f6bc47a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            amert.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\amert.exe
                                                                                                                                                            • Size 33KB
                                                                                                                                                            • SHA256 86b4a05a974e56c5c742528fa1a34495799116f210233aa8c76f2297b5ba8dc2
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            build1234.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\build1234.exe
                                                                                                                                                            • Size 124KB
                                                                                                                                                            • SHA256 94048358360fd46766cdf1d4f487c1c61a391f97ebc10704c388170ae4e66b88
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            hv.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\hv.exe
                                                                                                                                                            • Size 469KB
                                                                                                                                                            • SHA256 a5f1251eeed06678b7122934e91ea925f2518bfa685d4b7ca6afe917564e7125
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            o3tech.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\o3tech.exe
                                                                                                                                                            • Size 426KB
                                                                                                                                                            • SHA256 f3c84b8c0f9d337a61c3a76834d72e8db144eca6bce2de85c603f3c66dd54504
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            voice5.13sert.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe
                                                                                                                                                            • Size 1.2MB
                                                                                                                                                            • SHA256 c4331f4ec87d0b121ee37bacf22b9fc04eff7b34fba6e4f3a54891a2b4e9628e
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            voice5.13sert.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe
                                                                                                                                                            • Size 871KB
                                                                                                                                                            • SHA256 fd997b495fa28cba4133af3d3c7026baff1cc98a200c850fec90629eb54f7197
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            voice5.13sert.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe
                                                                                                                                                            • Size 568KB
                                                                                                                                                            • SHA256 72531a55b8258680db0c2c164703c5e9090ffe432f0c6659a301137814fffe3a
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            voice5.13sert.exe
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Files\voice5.13sert.exe
                                                                                                                                                            • Size 1.8MB
                                                                                                                                                            • SHA256 81059e0be514fd64cc4a1aa34aa2e6c933e6f1cf8dfe05dbc8fb9894bc408c7f
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            Protect544cd51a.dll
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
                                                                                                                                                            • Size 136KB
                                                                                                                                                            • SHA256 5c0c8b948221f78b8e7a5f94cf39851e1a82e5749805c01a0fb64c84bebf1c85
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            python311.dll
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\_MEI4762\python311.dll
                                                                                                                                                            • Size 1.1MB
                                                                                                                                                            • SHA256 4d19e9efb561195cf6c0eda118ab4501abb97371c24f0c8f4131d889289b66c9
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            python311.dll
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\_MEI7722\python311.dll
                                                                                                                                                            • Size 2.8MB
                                                                                                                                                            • SHA256 35006561e46d413d089d1e44b734cef28e071abfb296529254ddf575d28aa766
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            INetC.dll
                                                                                                                                                            • Path \Users\Admin\AppData\Local\Temp\nsd77B0.tmp\INetC.dll
                                                                                                                                                            • Size 25KB
                                                                                                                                                            • SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
                                                                                                                                                            • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                            Submit Download

                                                                                                                                                            memory/652-1486-0x0000000002960000-0x0000000002961000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1470-0x0000000000C60000-0x0000000001115000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1490-0x00000000027F0000-0x00000000027F1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1496-0x00000000025C0000-0x00000000025C1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1523-0x0000000000C60000-0x0000000001115000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1499-0x0000000002950000-0x0000000002951000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1500-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1501-0x0000000002560000-0x0000000002561000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1473-0x0000000076F20000-0x0000000076F22000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1478-0x0000000002820000-0x0000000002821000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1474-0x0000000000C60000-0x0000000001115000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1483-0x00000000025D0000-0x00000000025D1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1489-0x0000000000620000-0x0000000000621000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1495-0x0000000000C50000-0x0000000000C51000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1498-0x00000000027E0000-0x00000000027E1000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/652-1475-0x0000000002800000-0x0000000002801000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/704-376-0x0000000000AC0000-0x0000000000B00000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/704-373-0x0000000000F20000-0x0000000000F28000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/704-375-0x0000000073F30000-0x000000007461E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/704-1440-0x0000000073F30000-0x000000007461E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/704-378-0x0000000000AC0000-0x0000000000B00000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/888-400-0x0000000000400000-0x00000000008E2000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/888-82-0x0000000000240000-0x0000000000241000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/888-402-0x0000000000240000-0x0000000000241000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1388-1730-0x0000000000400000-0x0000000000647000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1388-309-0x0000000000400000-0x0000000000647000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1388-318-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1388-1411-0x00000000002B0000-0x00000000003B0000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1388-1412-0x0000000000270000-0x00000000002A4000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1388-308-0x0000000000270000-0x00000000002A4000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1388-307-0x00000000002B0000-0x00000000003B0000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1388-401-0x0000000000400000-0x0000000000647000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1664-1449-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1664-1439-0x0000000000400000-0x000000000043C000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1664-1447-0x0000000000400000-0x000000000043C000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1664-1451-0x0000000000400000-0x000000000043C000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1664-1444-0x0000000000400000-0x000000000043C000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1664-1446-0x0000000000400000-0x000000000043C000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1664-1784-0x0000000000400000-0x000000000043C000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/1808-1458-0x000000013F0B0000-0x000000013F443000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-361-0x0000000073F30000-0x000000007461E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1437-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1434-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1776-0x0000000073F30000-0x000000007461E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1427-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1424-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1443-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1428-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1429-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1431-0x0000000073F30000-0x000000007461E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1432-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1433-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1441-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1436-0x0000000006DC0000-0x0000000006EC0000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1438-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1425-0x0000000000430000-0x0000000000440000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1413-0x0000000006A20000-0x0000000006BB2000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-1408-0x0000000005500000-0x00000000056C8000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-362-0x0000000004E10000-0x0000000004E50000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2160-360-0x0000000001390000-0x000000000182E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1579-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1572-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1514-0x00000000010C0000-0x00000000011CA000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1524-0x0000000004B80000-0x0000000004C7E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1541-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1542-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1556-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1560-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1591-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1601-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1558-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1589-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1587-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1585-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1581-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1562-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1566-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2580-1568-0x0000000004B80000-0x0000000004C78000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2688-1786-0x000007FEF4B20000-0x000007FEF550C000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2688-1497-0x0000000000D90000-0x0000000000DB2000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2740-1426-0x0000000000360000-0x0000000000A00000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2740-1435-0x0000000002580000-0x0000000002588000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2740-1423-0x0000000073F30000-0x000000007461E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2740-1430-0x00000000024E0000-0x00000000024FA000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2988-0-0x00000000003D0000-0x00000000003D8000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2988-1469-0x0000000007190000-0x0000000007645000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2988-1468-0x0000000007190000-0x0000000007645000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2988-377-0x00000000048D0000-0x0000000004910000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2988-374-0x0000000073F30000-0x000000007461E000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2988-2-0x00000000048D0000-0x0000000004910000-memory.dmp
                                                                                                                                                            Download

                                                                                                                                                            memory/2988-1-0x0000000073F30000-0x000000007461E000-memory.dmp
                                                                                                                                                            Download