0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
16/07/2024, 14:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe
Size

1.5MB
MD5

50a5e891da27e63d54e68511e48aa026
SHA1

87073d85a7ba420b15c8bb9a9e4adc64db2bcfef
SHA256

0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6
SHA512

6df8811e3e1f6a4110ca3b7c498af13898b46962a30888879180b2f11dda24344a1de4807663d46dd86f7ea11855d08137980cc85fe71e688d082f2f79994909
SSDEEP

24576:AfHFw5b9DOnFYrv+kjqipUompMEoNMDYSkbDknoI6JK+ZYtEi8ETtAM5B:sjFYrv+kjV45oeYSRnyJhOtEVcf5B

Score

5^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops file in System32 directory 30 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\monitor.inf_amd64_8a98af5011ee4dc6\monitor.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_fe5b23ea7991a359\hdaudio.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\monitor.inf_amd64_8a98af5011ee4dc6\monitor.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_0d06b6638bdb4763\mshdc.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_adeb6424513f60a2\input.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_fe5b23ea7991a359\hdaudio.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_adeb6424513f60a2\input.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\hdaudbus.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\machine.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\monitor.inf_amd64_8a98af5011ee4dc6\monitor.PNF	detect_x64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\usbport.PNF	detect_x64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudio.inf_amd64_fe5b23ea7991a359\hdaudio.PNF	detect_x64.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\INF\ks.PNF	detect_x64.exe

Executes dropped EXE 9 IoCs

pid	Process
4372	detection.exe
5056	curl_x64.exe
4376	detect_x64.exe
4480	detect_x64.exe
2068	detect_x64.exe
2916	detect_x64.exe
2556	detect_x64.exe
4060	aes_x64.exe
1112	curl_x64.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2264	SC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 30 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	detect_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	detect_x64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	detect_x64.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
4876	identity_helper.exe
4876	identity_helper.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe
1708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3380	552	0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe	85
PID 552 wrote to memory of 3380	552	0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe	85
PID 552 wrote to memory of 3380	552	0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe	85
PID 552 wrote to memory of 4372	552	0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe	87
PID 552 wrote to memory of 4372	552	0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe	87
PID 552 wrote to memory of 4372	552	0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe	87
PID 3380 wrote to memory of 736	3380	cmd.exe	90
PID 3380 wrote to memory of 736	3380	cmd.exe	90
PID 3380 wrote to memory of 736	3380	cmd.exe	90
PID 736 wrote to memory of 3260	736	cmd.exe	93
PID 736 wrote to memory of 3260	736	cmd.exe	93
PID 736 wrote to memory of 3260	736	cmd.exe	93
PID 736 wrote to memory of 3996	736	cmd.exe	94
PID 736 wrote to memory of 3996	736	cmd.exe	94
PID 736 wrote to memory of 3996	736	cmd.exe	94
PID 736 wrote to memory of 3572	736	cmd.exe	95
PID 736 wrote to memory of 3572	736	cmd.exe	95
PID 736 wrote to memory of 3572	736	cmd.exe	95
PID 736 wrote to memory of 4600	736	cmd.exe	96
PID 736 wrote to memory of 4600	736	cmd.exe	96
PID 736 wrote to memory of 4600	736	cmd.exe	96
PID 4372 wrote to memory of 5056	4372	detection.exe	97
PID 4372 wrote to memory of 5056	4372	detection.exe	97
PID 4372 wrote to memory of 688	4372	detection.exe	98
PID 4372 wrote to memory of 688	4372	detection.exe	98
PID 4372 wrote to memory of 688	4372	detection.exe	98
PID 736 wrote to memory of 2160	736	cmd.exe	99
PID 736 wrote to memory of 2160	736	cmd.exe	99
PID 736 wrote to memory of 2160	736	cmd.exe	99
PID 4372 wrote to memory of 2264	4372	detection.exe	100
PID 4372 wrote to memory of 2264	4372	detection.exe	100
PID 4372 wrote to memory of 2264	4372	detection.exe	100
PID 4372 wrote to memory of 4324	4372	detection.exe	102
PID 4372 wrote to memory of 4324	4372	detection.exe	102
PID 4372 wrote to memory of 4324	4372	detection.exe	102
PID 4372 wrote to memory of 2916	4372	detection.exe	103
PID 4372 wrote to memory of 2916	4372	detection.exe	103
PID 4372 wrote to memory of 2556	4372	detection.exe	104
PID 4372 wrote to memory of 2556	4372	detection.exe	104
PID 4372 wrote to memory of 4376	4372	detection.exe	105
PID 4372 wrote to memory of 4376	4372	detection.exe	105
PID 4372 wrote to memory of 4480	4372	detection.exe	106
PID 4372 wrote to memory of 4480	4372	detection.exe	106
PID 4372 wrote to memory of 2068	4372	detection.exe	107
PID 4372 wrote to memory of 2068	4372	detection.exe	107
PID 736 wrote to memory of 1108	736	cmd.exe	108
PID 736 wrote to memory of 1108	736	cmd.exe	108
PID 736 wrote to memory of 1108	736	cmd.exe	108
PID 4372 wrote to memory of 4524	4372	detection.exe	109
PID 4372 wrote to memory of 4524	4372	detection.exe	109
PID 4372 wrote to memory of 4524	4372	detection.exe	109
PID 736 wrote to memory of 4048	736	cmd.exe	110
PID 736 wrote to memory of 4048	736	cmd.exe	110
PID 736 wrote to memory of 4048	736	cmd.exe	110
PID 4372 wrote to memory of 4060	4372	detection.exe	111
PID 4372 wrote to memory of 4060	4372	detection.exe	111
PID 4372 wrote to memory of 1112	4372	detection.exe	112
PID 4372 wrote to memory of 1112	4372	detection.exe	112
PID 4372 wrote to memory of 636	4372	detection.exe	113
PID 4372 wrote to memory of 636	4372	detection.exe	113
PID 4372 wrote to memory of 636	4372	detection.exe	113
PID 4372 wrote to memory of 2080	4372	detection.exe	114
PID 4372 wrote to memory of 2080	4372	detection.exe	114
PID 4372 wrote to memory of 2080	4372	detection.exe	114

C:\Users\Admin\AppData\Local\Temp\0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe
"C:\Users\Admin\AppData\Local\Temp\0788aaea249d92a84f70047efcacaa54c26320b439c490ba3ce00457955031d6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /C START "" "C:\Users\Admin\AppData\Local\Temp\interface.lnk"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\interface.cmd" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:736
  - - C:\Windows\SysWOW64\mode.com
      MODE CON: COLS=76 LINES=15
      4⤵
      PID:3260
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" VER "
      4⤵
      PID:3996
  - - C:\Windows\SysWOW64\findstr.exe
      FINDSTR /I /R /C:"version 5\.[0-1]\."
      4⤵
      PID:3572
  - - C:\Windows\SysWOW64\waitfor.exe
      WAITFOR unlock
      4⤵
      PID:4600
  - - C:\Windows\SysWOW64\waitfor.exe
      WAITFOR unlock
      4⤵
      PID:2160
  - - C:\Windows\SysWOW64\waitfor.exe
      WAITFOR unlock
      4⤵
      PID:1108
  - - C:\Windows\SysWOW64\waitfor.exe
      WAITFOR unlock
      4⤵
      PID:4048
- C:\Users\Admin\AppData\Local\Temp\detection.exe
  "C:\Users\Admin\AppData\Local\Temp\detection.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Users\Admin\AppData\Local\Temp\curl_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\curl_x64.exe" --connect-timeout 5 --max-time 20 --fail --silent --request GET "https://www.touslesdrivers.com/php/mes_drivers/version.php?v_version=3.0.4"
    3⤵
    - Executes dropped EXE
    PID:5056
- - C:\Windows\SysWOW64\WAITFOR.exe
    WAITFOR /S XZBQXJLF /SI unlock
    3⤵
    PID:688
- - C:\Windows\SysWOW64\SC.exe
    SC query Winmgmt
    3⤵
    - Launches sc.exe
    PID:2264
- - C:\Windows\SysWOW64\WAITFOR.exe
    WAITFOR /S XZBQXJLF /SI unlock
    3⤵
    PID:4324
- - C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" driverfiles 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" drivernodes 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
    3⤵
    - Drops file in System32 directory
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:2556
- - C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" hwids 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4376
- - C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" stack 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:4480
- - C:\Users\Admin\AppData\Local\Temp\detect_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\detect_x64.exe" status 1394\* DISPLAY\* HDAUDIO\* HID\* MONITOR\* PCI\* PCMCIA\* SBP2\* SD\* USB\*
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:2068
- - C:\Windows\SysWOW64\WAITFOR.exe
    WAITFOR /S XZBQXJLF /SI unlock
    3⤵
    PID:4524
- - C:\Users\Admin\AppData\Local\Temp\aes_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\aes_x64.exe" -e -p anT^UpFuzpuC@lOvsoPVe2kiNTidaBo<zI]BeaRnU0ResFwAy@dEnuCkUd)hAzOh -o "C:\Users\Admin\AppData\Local\Temp\fllX14kKx0nnFQpN\fllX14kKx0nnFQpN" -
    3⤵
    - Executes dropped EXE
    PID:4060
- - C:\Users\Admin\AppData\Local\Temp\curl_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\curl_x64.exe" --connect-timeout 5 --max-time 20 --fail --silent --request POST --form "v_configuration=<C:\Users\Admin\AppData\Local\Temp\fllX14kKx0nnFQpN\fllX14kKx0nnFQpN" "https://www.touslesdrivers.com/php/mes_drivers/envoi.php?v_id=fllX14kKx0nnFQpN&v_version=3.0.4"
    3⤵
    - Executes dropped EXE
    PID:1112
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C START "" "http://www.touslesdrivers.com/index.php?v_page=31&v_id=fllX14kKx0nnFQpN"
    3⤵
    PID:636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.touslesdrivers.com/index.php?v_page=31&v_id=fllX14kKx0nnFQpN
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa17b846f8,0x7ffa17b84708,0x7ffa17b84718
        5⤵
        
        PID:896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
        5⤵
        
        PID:3992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
        5⤵
        
        PID:904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
        5⤵
        
        PID:4104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
        5⤵
        
        PID:3600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
        5⤵
        
        PID:3248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
        5⤵
        
        PID:5112
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
        5⤵
        
        PID:2296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
        5⤵
        
        PID:4860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
        5⤵
        
        PID:4544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
        5⤵
        
        PID:4384
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8961576282070522649,14147029336393371470,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2832 /prefetch:2
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4048
- - C:\Windows\SysWOW64\WAITFOR.exe
    WAITFOR /S XZBQXJLF /SI unlock
    3⤵
    PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
fa0b59005e6e63411f6b9d556ddf691d

SHA1
e564a2b6c7ed6dc6ce03912969a0c6bd04d533e0

SHA256
39ae85a7afe4ee1e706d13113b77882b8c9827e345b8c745cfea18691d83871b

SHA512
8f1e996f10b8dfd7246f5b88c97b433556c36516f7c8dfb0a71fd40b73e9c4ce22131989c2156e7c613155143e4e154bc0e60fc6585d34d508e68065ceaf608d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d8621ec5fff984d5baf32dd52ea11a37

SHA1
f9532d82c922d0c2b499099e86f7f829fc8cee5e

SHA256
bdafb40083537d85b6c430c3dde65de143c71e80da5072cedbf9c648c4b03a97

SHA512
25736fc97d50f6085e23f0f6c18ceb2af17375fe1ad2dbf285497cd69b9cd03a312bde106a29506a8e47dcae86bb4b521a959e41cf6d5ca6ebb5a49111eb3ef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3d692fc239631a20230fb49136d2cab2

SHA1
271dcb8f15505ca7cb2f7eac70ee7ca5165cbb77

SHA256
1b6c190fc3077beb91607840f1f52f40815574165fd03c851ccc558db50ba0aa

SHA512
305356a5a59a28566ab7f5a6ed9ac7316cbf897f95b06efe1fa5f7d02d981309ee5690790dcff9acf9ad9a932a13ea9e3a239334754ec345bdd89dcb6574b5d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bc5f9c36387907c9b8238862bb3d443b

SHA1
8ad703aa75dfd2b87bf8bea8343291cadeea84f4

SHA256
a1e9eceeb9d2b84800696f1686cfc9cf84cf68f6c37deba079a94b32d75fed99

SHA512
69aae6d481acb947b8d269a5332fc28af63c48c1ac104b4114bc4ecb753957a46c459ba53461b3a0642f43d478afe918ac87b4d516fb5c1eb75aef3f5231150d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d1a6b421a81cf7c6a182ea04e3839efe

SHA1
dfd738d10522fea61999fca2a3652b58ae660110

SHA256
74203ece20abe80f85d6acb4aa68677f2e1e127ebc88a3fa1ea3852bdd0a3675

SHA512
9ded9f458710d69972de915e9b8b0b5dbe4539e44030525699b3ee2f316babf2d8eccf60aad72c424e0999a3728990edaf925893b501423e9d19076a76d0c529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
4615e6fffa269885dfa4419fab4daabc

SHA1
6a5af14aa8f3e9dd3d91ce2a9b085927439f6dc3

SHA256
1708e6f24692a370ad48f45b081a4a78a8adfe85d086c6bce49d5a18252d20f5

SHA512
2b6573fe75620e043a591355214ecd9c5798c87d2eaf1e006f49eb23775a33fe85d9b68e726dd8ca01a4df45b867c1a476f342d97c8da540ee6cd0944d7669d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a35a17ac09787c875fd3c94c06546948

SHA1
5f5ab43ad514e089795ab9c62538baedeec2aa8f

SHA256
1807a682271ed88e1d0fa37673852484cc49f7dd65d31101672fa0e16509c39a

SHA512
e13ba9d1e357cc5ca3f0a129eeec623dfdc55297e55192167d6dd9c99788782a0dc5a18ae78e48789b27eb34a5ffd4c1cd134314c9a10e5f23c3905466ce0deb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585f03.TMP

Filesize
705B

MD5
f6d71f31de71e9f3ebb863fd3d6c21eb

SHA1
457f668c3fd71cf87ba28e6705c6de355db33cd8

SHA256
b1c005ce76b0b1af8c61730b4c35a9590b76dc1e9d8c309081ecbc7ec8da444b

SHA512
b478449053a85f0c1740fe348cc1779e31704f6b1d60734abfd17182058c0f29a2df00a92bec5399467d983ec7002a20adfb7ad32ea25e71fcd5fa487b6e8353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0d4a5ad0370b32eab346cc428742f898

SHA1
db936b7b6a1e3ed24e7eccaff683770930975f47

SHA256
114838bd2566774bc94f5b50f2aef3eaa8c330bd39984dba4f5dabffa1da53d6

SHA512
985d7194a34f811d1b57c5a5b6d4ea7eee788989ca02cf04b221e9ca5d70c142132e62c51c383e33c8e1ab9781cf04b52c0a8e8193b962e88ad41b9ed5158232

Download Submit
C:\Users\Admin\AppData\Local\Temp\aes_x64.exe

Filesize
151KB

MD5
e5125d4651c008eba61d9fd3abd5ab31

SHA1
4a85e5d6ab73891832c9adaa4a70c1896773c279

SHA256
874cb7a8513b781b25e176828fe8fe5ac73fa2fe29ea2aac5fe0eaad50e63f39

SHA512
26ba2cecf7324e1c5fe46112c31523e2fabad8de34fe84ce3a9e3a63922b0f85d84982e7c6bae13d2e3cf65193f7a19a67a2fc80af5a78ef8cfe611fce1a9409

Download Submit
C:\Users\Admin\AppData\Local\Temp\curl_x64.exe

Filesize
840KB

MD5
e80c8cb9887a7c9426d4e843dddb8a44

SHA1
a04821e6d51f45b72a10bdbd3bb7e49de069ccd2

SHA256
3df4725778c0351e8472a0f8e18caf4fa9b95c98e4f2d160a26c3749f9869568

SHA512
41b4bd84336785d4da13b5653183bf2a405b918afad3acd934f253d23b1e00460173e36b2d65a61f77ef2b942dba735655fc5b4ec561c375896f5a010e053d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\detect_x64.exe

Filesize
80KB

MD5
6a7ec375af8ba2e87ff7f23497e9944e

SHA1
791fb650e9e27e9857b332f534a0ade1eae28be7

SHA256
65c68fd55281a0a4598807ea83531a0cb0e4e79a8c5bf38e9637e776f72c3514

SHA512
c6fa4ac94692ddb8d60c8ab40aa33b17e9d0800c802ee5d3c7d6f0db24c507638743287a274d7ec62fe568b6aa1c69932d52e74a50040720a89138cb5c8be7aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\detection.exe

Filesize
1.1MB

MD5
02ba1c44b6392f013a7aa0b91314f45a

SHA1
724c1977101ecae88e4f104a8422b64bfec01a98

SHA256
7fbe59195f5f6f45c8b38b12488a169fdcb3a272004dbaf44c9d92a60a3690cb

SHA512
56bed935b028257e6eb485c555002f3e07e86788452cca0e28786098cc9254a7462b777a7a46ae6594911a73d786a6d15dee248f05a4c33a1bc749be071bcc3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\fllX14kKx0nnFQpN\fllX14kKx0nnFQpN

Filesize
24KB

MD5
b49a0b7e8d7228fb2fd696b8b6a7c7c9

SHA1
d98b9191a29813511152e02643d7d9c44c97d79f

SHA256
268e55e87ff0e86742b12050a5b57114c7c53289245372cec24c98c3cb67bb32

SHA512
e9cc6eac94a7c975c16c4cd9c9d7c2e066240e723812f4bc7250882b996a70abfdab7b17e47486968f819f97d90148d3f10c98b0e6154fdddc83a83d6b68f819

Download Submit
C:\Users\Admin\AppData\Local\Temp\interface.cmd

Filesize
2KB

MD5
e0eb53551aca2acff814ddd7aca212e2

SHA1
ee825c865d5abf244d6165ee838735f1ba05bfcb

SHA256
11993a03f68a33500a3ce8fbeb3e3c2042a28299d04f39eed40147709e76ca79

SHA512
ddde3d274b2ea8da0d645f88bd6b340902dca83e599ba0c7249953a7c1f2dd512f764802134a6efa1f48ca6cae23b78881569228f908dd0746abe3c46e95a348

Download Submit
C:\Users\Admin\AppData\Local\Temp\interface.lnk

Filesize
2KB

MD5
cd7d0fede7f77d17c089fbc77e205f6b

SHA1
a6f8dac95f7f7b1dcc10c036e1b5f72b6025fe33

SHA256
951ca3e4caf53fcc331f8944ee2e79a4a52ab544c257f62df9dc5cf9a5591036

SHA512
92ece0a28c36c6b80c2ece8834f5f6db0c510bdcc78d1ac0ad80c66dc581df2157d3d26633cebcb0410c2041499bb71b5351e19543e438e8cd4e0e3d83fd935e

Download Submit
memory/552-48-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/552-59-0x0000000000400000-0x000000000059F000-memory.dmp

Filesize
1.6MB

Download
memory/4372-49-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/4372-56-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download
memory/4372-17-0x000000000068E000-0x000000000068F000-memory.dmp

Filesize
4KB

Download
memory/4372-14-0x0000000000400000-0x0000000000693000-memory.dmp

Filesize
2.6MB

Download