Overview
overview
10Static
static
7Generators...re.exe
windows7-x64
7Generators...re.exe
windows10-2004-x64
7Generators...ip.dll
windows7-x64
1Generators...ip.dll
windows10-2004-x64
1Generators...CE.zip
windows7-x64
1Generators...CE.zip
windows10-2004-x64
1Generators...er.exe
windows7-x64
7Generators...er.exe
windows10-2004-x64
7Generators...32.exe
windows7-x64
1Generators...32.exe
windows10-2004-x64
1Generators...ds.txt
windows7-x64
1Generators...ds.txt
windows10-2004-x64
1Generators...xy.dll
windows10-2004-x64
10Generators...CE.zip
windows7-x64
1Generators...CE.zip
windows10-2004-x64
1Generators...es.txt
windows7-x64
1Generators...es.txt
windows10-2004-x64
1Generators...CE.zip
windows7-x64
1Generators...CE.zip
windows10-2004-x64
1Generators...SP.exe
windows7-x64
1Generators...SP.exe
windows10-2004-x64
1Analysis
-
max time kernel
151s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/04/2024, 09:42
Behavioral task
behavioral1
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/AGC by Acquire.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/AGC by Acquire.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/WebDriver/Ionic.Zip.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/WebDriver/Ionic.Zip.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/WebDriver/LICENCE.zip
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/WebDriver/LICENCE.zip
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/WebDriver/Launcher.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/WebDriver/Launcher.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/WebDriver/user32.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/WebDriver/user32.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/giftcards.txt
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/giftcards.txt
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/ieproxy.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Generators PACK/Generators PACK/Discord Account Generator v2/RDXService/LICENCE.zip
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral15
Sample
Generators PACK/Generators PACK/Discord Account Generator v2/RDXService/LICENCE.zip
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Generators PACK/Generators PACK/Discord Account Generator v2/RDXService/config/discord_usernames.txt
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral17
Sample
Generators PACK/Generators PACK/Discord Account Generator v2/RDXService/config/discord_usernames.txt
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Generators PACK/Generators PACK/Proxy Generator 1.3.6 BETA/bin/LICENCE.zip
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral19
Sample
Generators PACK/Generators PACK/Proxy Generator 1.3.6 BETA/bin/LICENCE.zip
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Generators PACK/Generators PACK/TSP Dork generator v8.0/Data/TSP.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral21
Sample
Generators PACK/Generators PACK/TSP Dork generator v8.0/Data/TSP.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
Generators PACK/Generators PACK/Amazong GC Generator by Acquire/AGC by Acquire.exe
-
Size
196KB
-
MD5
49237f897197176f8ed16d1cf9a3fc4b
-
SHA1
670a098226870359616218aea0455299bf4302d8
-
SHA256
78785e18a8eac7a00a5458f63d397ab7739aa075bdbb4480f8e87987bde1ea53
-
SHA512
17e3436f812e82d3fee41df02c39250599f4c7fd87eb09a493f028367e0eb3e25cb1a6d89f589fe3dea3127828268ae0dd683b2f28e9d9672b4efe39262d4fdc
-
SSDEEP
1536:E4l/ePiz1tO6UWOD1ClIzuHqFOc350x+Z+:E4l/TMWOeIzuHdc356
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Startup.lnk Launcher.exe -
Executes dropped EXE 26 IoCs
pid Process 2588 Windows Services.exe 2392 Secure System Shell.exe 268 Runtime Explorer.exe 548 Runtime Explorer.exe 308 Runtime Explorer.exe 2744 Runtime Explorer.exe 2864 Runtime Explorer.exe 2120 Runtime Explorer.exe 2112 Runtime Explorer.exe 3040 Runtime Explorer.exe 1832 Runtime Explorer.exe 484 Runtime Explorer.exe 1840 Runtime Explorer.exe 1144 Runtime Explorer.exe 2076 Runtime Explorer.exe 2768 Runtime Explorer.exe 1968 Runtime Explorer.exe 1592 Runtime Explorer.exe 2512 Runtime Explorer.exe 2780 Runtime Explorer.exe 2136 Runtime Explorer.exe 1104 Runtime Explorer.exe 2592 Runtime Explorer.exe 2888 Runtime Explorer.exe 2980 Runtime Explorer.exe 748 Runtime Explorer.exe -
Loads dropped DLL 51 IoCs
pid Process 2500 Launcher.exe 2500 Launcher.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Explorer = "C:\\Windows\\IMF\\\\Windows Services.exe" Launcher.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\IMF\LICENCE.zip Launcher.exe File created C:\Windows\IMF\LICENCE.dat Launcher.exe File created C:\Windows\IMF\Runtime Explorer.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Runtime Explorer.exe Launcher.exe File opened for modification C:\Windows\IMF\Secure System Shell.exe Launcher.exe File created C:\Windows\IMF\LICENCE.zip Launcher.exe File created C:\Windows\IMF\Windows Services.exe.tmp Launcher.exe File opened for modification C:\Windows\IMF\Windows Services.exe Launcher.exe File created C:\Windows\IMF\Secure System Shell.exe.tmp Launcher.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 2500 Launcher.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2688 powershell.exe 2392 Secure System Shell.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe 2588 Windows Services.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2500 Launcher.exe Token: SeDebugPrivilege 2588 Windows Services.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 2392 Secure System Shell.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 268 Runtime Explorer.exe 548 Runtime Explorer.exe 308 Runtime Explorer.exe 2744 Runtime Explorer.exe 2864 Runtime Explorer.exe 2120 Runtime Explorer.exe 2112 Runtime Explorer.exe 3040 Runtime Explorer.exe 1832 Runtime Explorer.exe 484 Runtime Explorer.exe 1840 Runtime Explorer.exe 1144 Runtime Explorer.exe 2076 Runtime Explorer.exe 2768 Runtime Explorer.exe 1968 Runtime Explorer.exe 1592 Runtime Explorer.exe 2512 Runtime Explorer.exe 2780 Runtime Explorer.exe 2136 Runtime Explorer.exe 1104 Runtime Explorer.exe 2592 Runtime Explorer.exe 2888 Runtime Explorer.exe 2980 Runtime Explorer.exe 748 Runtime Explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 2500 1652 AGC by Acquire.exe 28 PID 1652 wrote to memory of 2500 1652 AGC by Acquire.exe 28 PID 1652 wrote to memory of 2500 1652 AGC by Acquire.exe 28 PID 1652 wrote to memory of 2500 1652 AGC by Acquire.exe 28 PID 1652 wrote to memory of 2500 1652 AGC by Acquire.exe 28 PID 1652 wrote to memory of 2500 1652 AGC by Acquire.exe 28 PID 1652 wrote to memory of 2500 1652 AGC by Acquire.exe 28 PID 2500 wrote to memory of 2688 2500 Launcher.exe 29 PID 2500 wrote to memory of 2688 2500 Launcher.exe 29 PID 2500 wrote to memory of 2688 2500 Launcher.exe 29 PID 2500 wrote to memory of 2688 2500 Launcher.exe 29 PID 2500 wrote to memory of 2688 2500 Launcher.exe 29 PID 2500 wrote to memory of 2688 2500 Launcher.exe 29 PID 2500 wrote to memory of 2688 2500 Launcher.exe 29 PID 1652 wrote to memory of 3056 1652 AGC by Acquire.exe 31 PID 1652 wrote to memory of 3056 1652 AGC by Acquire.exe 31 PID 1652 wrote to memory of 3056 1652 AGC by Acquire.exe 31 PID 1652 wrote to memory of 3056 1652 AGC by Acquire.exe 31 PID 2500 wrote to memory of 2588 2500 Launcher.exe 33 PID 2500 wrote to memory of 2588 2500 Launcher.exe 33 PID 2500 wrote to memory of 2588 2500 Launcher.exe 33 PID 2500 wrote to memory of 2588 2500 Launcher.exe 33 PID 2500 wrote to memory of 2588 2500 Launcher.exe 33 PID 2500 wrote to memory of 2588 2500 Launcher.exe 33 PID 2500 wrote to memory of 2588 2500 Launcher.exe 33 PID 2588 wrote to memory of 2392 2588 Windows Services.exe 34 PID 2588 wrote to memory of 2392 2588 Windows Services.exe 34 PID 2588 wrote to memory of 2392 2588 Windows Services.exe 34 PID 2588 wrote to memory of 2392 2588 Windows Services.exe 34 PID 2588 wrote to memory of 2392 2588 Windows Services.exe 34 PID 2588 wrote to memory of 2392 2588 Windows Services.exe 34 PID 2588 wrote to memory of 2392 2588 Windows Services.exe 34 PID 2588 wrote to memory of 268 2588 Windows Services.exe 35 PID 2588 wrote to memory of 268 2588 Windows Services.exe 35 PID 2588 wrote to memory of 268 2588 Windows Services.exe 35 PID 2588 wrote to memory of 268 2588 Windows Services.exe 35 PID 2588 wrote to memory of 268 2588 Windows Services.exe 35 PID 2588 wrote to memory of 268 2588 Windows Services.exe 35 PID 2588 wrote to memory of 268 2588 Windows Services.exe 35 PID 2588 wrote to memory of 548 2588 Windows Services.exe 36 PID 2588 wrote to memory of 548 2588 Windows Services.exe 36 PID 2588 wrote to memory of 548 2588 Windows Services.exe 36 PID 2588 wrote to memory of 548 2588 Windows Services.exe 36 PID 2588 wrote to memory of 548 2588 Windows Services.exe 36 PID 2588 wrote to memory of 548 2588 Windows Services.exe 36 PID 2588 wrote to memory of 548 2588 Windows Services.exe 36 PID 2588 wrote to memory of 308 2588 Windows Services.exe 39 PID 2588 wrote to memory of 308 2588 Windows Services.exe 39 PID 2588 wrote to memory of 308 2588 Windows Services.exe 39 PID 2588 wrote to memory of 308 2588 Windows Services.exe 39 PID 2588 wrote to memory of 308 2588 Windows Services.exe 39 PID 2588 wrote to memory of 308 2588 Windows Services.exe 39 PID 2588 wrote to memory of 308 2588 Windows Services.exe 39 PID 2588 wrote to memory of 2744 2588 Windows Services.exe 40 PID 2588 wrote to memory of 2744 2588 Windows Services.exe 40 PID 2588 wrote to memory of 2744 2588 Windows Services.exe 40 PID 2588 wrote to memory of 2744 2588 Windows Services.exe 40 PID 2588 wrote to memory of 2744 2588 Windows Services.exe 40 PID 2588 wrote to memory of 2744 2588 Windows Services.exe 40 PID 2588 wrote to memory of 2744 2588 Windows Services.exe 40 PID 2588 wrote to memory of 2864 2588 Windows Services.exe 41 PID 2588 wrote to memory of 2864 2588 Windows Services.exe 41 PID 2588 wrote to memory of 2864 2588 Windows Services.exe 41 PID 2588 wrote to memory of 2864 2588 Windows Services.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\AGC by Acquire.exe"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\AGC by Acquire.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\WebDriver\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\WebDriver\Launcher.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\IMF\Windows Services.exe"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\IMF\Secure System Shell.exe"C:\Windows\IMF\Secure System Shell.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:268
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:308
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2744
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2864
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2120
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2112
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3040
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1832
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:484
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1840
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1144
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2076
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1592
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2512
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2780
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2136
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1104
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2592
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2888
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2980
-
-
C:\Windows\IMF\Runtime Explorer.exe"C:\Windows\IMF\Runtime Explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:748
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\WebDriver\user32.exe"C:\Users\Admin\AppData\Local\Temp\Generators PACK\Generators PACK\Amazong GC Generator by Acquire\WebDriver\user32.exe"2⤵PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144KB
MD5ec70c6f4dc443c5ab2b91d64ae04fa8e
SHA143eb3b3289782fced204f0b4e3edad2ba1b085b7
SHA256276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d
SHA5126217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584
-
Filesize
45KB
MD57d0c7359e5b2daa5665d01afdc98cc00
SHA1c3cc830c8ffd0f53f28d89dcd9f3426be87085cb
SHA256f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809
SHA512a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407
-
Filesize
46KB
MD5ad0ce1302147fbdfecaec58480eb9cf9
SHA1874efbc76e5f91bc1425a43ea19400340f98d42b
SHA2562c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3
SHA512adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53