Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-08-2024 20:20

General

  • Target

    SyncSpoofer.exe

  • Size

    276KB

  • MD5

    5a8afe7bfd11728c32066c4290eeddc7

  • SHA1

    f2064bbdec287d61722ef35e511b4090212cd1a8

  • SHA256

    92c799a2fd29060a44558a153d1ff5866e420e46b35bdd4546c782c17d4bb50f

  • SHA512

    e03994e666aa7ff84400e86e4cc3db5a77a5475e1961b553f16dbc293160f58f196b0ab6fb7be4ba34b1d030969f2f94ae80dc0c423f3ec015621bf987b796cb

  • SSDEEP

    1536:hJ99JW77A9oXFY+w67Vh7O9H/squacb3P12NETDLiaSKry3bgDBsvVeXBdZs4o7M:vSFHh69HEZJRTDLiaSKreumVeBs4o

Malware Config

Signatures

  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

  • PureLog Stealer payload 1 IoCs
  • Detected Nirsoft tools 2 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Maps connected drives based on registry 3 TTPs 64 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3544
    • C:\Users\Admin\AppData\Roaming\sWsmPty.exe
      "C:\Users\Admin\AppData\Roaming\sWsmPty.exe"
      2⤵
      • Executes dropped EXE
      PID:3680
    • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
      "C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4516
    • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe
      "C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of WriteProcessMemory
      PID:3504
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: R1J7-L95H
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
          C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: R1J7-L95H
          4⤵
          • Executes dropped EXE
          PID:3780
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Disk.bat
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1536
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3020
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk drive*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2328
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "C:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:4348
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "D:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:748
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "E:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3932
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "F:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:1176
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "G:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:1676
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:940
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "disk"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:216
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk&*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2108
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2964
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "USBSTOR*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:5060
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2316
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "STORAGE*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3364
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:4764
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2020
        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 25418HP-TRGT18715AB
          4⤵
          • Executes dropped EXE
          PID:1300
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 225418HP-TRGT18715RV
          4⤵
          • Executes dropped EXE
          PID:848
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 825418HP-TRGT18715SG
          4⤵
          • Executes dropped EXE
          PID:1384
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4940
        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
          4⤵
          • Executes dropped EXE
          PID:3560
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 525418HP-TRGT18715SL
          4⤵
          • Executes dropped EXE
          PID:1168
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
        3⤵
          PID:2200
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 425418HP-TRGT18715FA
            4⤵
            • Executes dropped EXE
            PID:4636
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
          3⤵
            PID:4076
            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 625418HP-TRGT18715FU
              4⤵
              • Executes dropped EXE
              PID:4160
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
            3⤵
              PID:4512
              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 325421HP-TRGT29463DQ
                4⤵
                • Executes dropped EXE
                PID:2196
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
              3⤵
                PID:3116
                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 725421HP-TRGT29463MST
                  4⤵
                  • Executes dropped EXE
                  PID:4808
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                3⤵
                  PID:3180
                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                    4⤵
                    • Executes dropped EXE
                    PID:2756
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                  3⤵
                    PID:1608
                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 25438HP-TRGT17669AB
                      4⤵
                      • Executes dropped EXE
                      PID:2108
                  • C:\Windows\System32\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                    3⤵
                      PID:4116
                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 225438HP-TRGT17669RV
                        4⤵
                        • Executes dropped EXE
                        PID:1436
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                      3⤵
                        PID:2084
                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 825438HP-TRGT17669SG
                          4⤵
                          • Executes dropped EXE
                          PID:2800
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                        3⤵
                          PID:5060
                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                            4⤵
                            • Executes dropped EXE
                            PID:2772
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                          3⤵
                            PID:2964
                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 525438HP-TRGT17669SL
                              4⤵
                              • Executes dropped EXE
                              PID:2112
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                            3⤵
                              PID:3120
                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 425438HP-TRGT17669FA
                                4⤵
                                • Executes dropped EXE
                                PID:4572
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                              3⤵
                                PID:2020
                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 625441HP-TRGT28417FU
                                  4⤵
                                  • Executes dropped EXE
                                  PID:4636
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                3⤵
                                  PID:848
                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 325441HP-TRGT28417DQ
                                    4⤵
                                    • Executes dropped EXE
                                    PID:3444
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                  3⤵
                                    PID:1236
                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 725441HP-TRGT28417MST
                                      4⤵
                                      • Executes dropped EXE
                                      PID:656
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                    3⤵
                                      PID:1760
                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                        4⤵
                                        • Executes dropped EXE
                                        PID:5024
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                                      3⤵
                                        PID:4808
                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 25457HP-TRGT16623AB
                                          4⤵
                                          • Executes dropped EXE
                                          PID:4356
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                                        3⤵
                                          PID:5096
                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 225457HP-TRGT16623RV
                                            4⤵
                                            • Executes dropped EXE
                                            PID:5092
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                                          3⤵
                                            PID:4588
                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 825457HP-TRGT16623SG
                                              4⤵
                                              • Executes dropped EXE
                                              PID:1068
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                            3⤵
                                              PID:2932
                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                4⤵
                                                • Executes dropped EXE
                                                PID:3996
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                              3⤵
                                                PID:212
                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 525457HP-TRGT16623SL
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:2068
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                                3⤵
                                                  PID:4892
                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 425457HP-TRGT16623FA
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:784
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                                  3⤵
                                                    PID:2816
                                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 625457HP-TRGT16623FU
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:4528
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                                    3⤵
                                                      PID:1940
                                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 325457HP-TRGT16623DQ
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:3228
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                                      3⤵
                                                        PID:4960
                                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 725457HP-TRGT16623MST
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:1532
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                        3⤵
                                                          PID:1436
                                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:5112
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: 55V1-8I4E
                                                          3⤵
                                                            PID:2600
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              4⤵
                                                                PID:2112
                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: 55V1-8I4E
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:216
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: HCM2-EZ4S
                                                              3⤵
                                                                PID:2856
                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: HCM2-EZ4S
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:2084
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: LJEK-56AH
                                                                3⤵
                                                                  PID:2124
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    4⤵
                                                                      PID:3444
                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: LJEK-56AH
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:3484
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: VU7H-IZ0J
                                                                    3⤵
                                                                      PID:5024
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        4⤵
                                                                          PID:4940
                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: VU7H-IZ0J
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:4988
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: 2VRS-CUMU
                                                                        3⤵
                                                                          PID:1016
                                                                          • C:\Windows\System32\Conhost.exe
                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                            4⤵
                                                                              PID:1236
                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: 2VRS-CUMU
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              PID:4520
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: 89VF-P25K
                                                                            3⤵
                                                                              PID:1072
                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: 89VF-P25K
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:4760
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: UCA0-ZGTK
                                                                              3⤵
                                                                                PID:5016
                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: UCA0-ZGTK
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2732
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: FC2L-4RC9
                                                                                3⤵
                                                                                  PID:1156
                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: FC2L-4RC9
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:2900
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: UA78-4V9Z
                                                                                  3⤵
                                                                                    PID:3180
                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                      4⤵
                                                                                        PID:3116
                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: UA78-4V9Z
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4316
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: KUFZ-VD5B
                                                                                      3⤵
                                                                                        PID:1804
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          4⤵
                                                                                            PID:3996
                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: KUFZ-VD5B
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2148
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: I9C4-11NE
                                                                                          3⤵
                                                                                            PID:212
                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: I9C4-11NE
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:644
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: S2IV-DRN1
                                                                                            3⤵
                                                                                              PID:628
                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: S2IV-DRN1
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2808
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: K944-P0N4
                                                                                              3⤵
                                                                                                PID:3228
                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: K944-P0N4
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:4112
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: 67UV-E4JJ
                                                                                                3⤵
                                                                                                  PID:3932
                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: 67UV-E4JJ
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:4456
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: F8RV-FEG7
                                                                                                  3⤵
                                                                                                    PID:4572
                                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: F8RV-FEG7
                                                                                                      4⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:4884
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: LNLC-C5PT
                                                                                                    3⤵
                                                                                                      PID:1180
                                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: LNLC-C5PT
                                                                                                        4⤵
                                                                                                          PID:2388
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: H5KI-SPHD
                                                                                                        3⤵
                                                                                                          PID:2204
                                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: H5KI-SPHD
                                                                                                            4⤵
                                                                                                              PID:1168
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: K6ZD-SC0T
                                                                                                            3⤵
                                                                                                              PID:3320
                                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: K6ZD-SC0T
                                                                                                                4⤵
                                                                                                                  PID:2252
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: EBSD-EH85
                                                                                                                3⤵
                                                                                                                  PID:3092
                                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: EBSD-EH85
                                                                                                                    4⤵
                                                                                                                      PID:548
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: CDM6-Z445
                                                                                                                    3⤵
                                                                                                                      PID:3940
                                                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: CDM6-Z445
                                                                                                                        4⤵
                                                                                                                          PID:1920
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: 55JC-IRGC
                                                                                                                        3⤵
                                                                                                                          PID:5196
                                                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: 55JC-IRGC
                                                                                                                            4⤵
                                                                                                                              PID:5244
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: D2RV-CVZ9
                                                                                                                            3⤵
                                                                                                                              PID:5404
                                                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: D2RV-CVZ9
                                                                                                                                4⤵
                                                                                                                                  PID:5456
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: EV75-UR3C
                                                                                                                                3⤵
                                                                                                                                  PID:5484
                                                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: EV75-UR3C
                                                                                                                                    4⤵
                                                                                                                                      PID:5696
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                    3⤵
                                                                                                                                      PID:5516
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.chm
                                                                                                                                      3⤵
                                                                                                                                        PID:5556
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                        3⤵
                                                                                                                                          PID:5620
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys
                                                                                                                                          3⤵
                                                                                                                                            PID:5656
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                            3⤵
                                                                                                                                              PID:5724
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                              3⤵
                                                                                                                                                PID:5772
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                                3⤵
                                                                                                                                                  PID:5816

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe

                                                                                                                                              Filesize

                                                                                                                                              452KB

                                                                                                                                              MD5

                                                                                                                                              c4d09d3b3516550ad2ded3b09e28c10c

                                                                                                                                              SHA1

                                                                                                                                              7a5e77bb9ba74cf57cb1d119325b0b7f64199824

                                                                                                                                              SHA256

                                                                                                                                              66433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3

                                                                                                                                              SHA512

                                                                                                                                              2e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2

                                                                                                                                            • C:\ProgramData\Microsoft\Windows\DevManView.cfg

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              43b37d0f48bad1537a4de59ffda50ffe

                                                                                                                                              SHA1

                                                                                                                                              48ca09a0ed8533bf462a56c43b8db6e7b6c6ffa8

                                                                                                                                              SHA256

                                                                                                                                              fc258dfb3e49be04041ac24540ef544192c2e57300186f777f301d586f900288

                                                                                                                                              SHA512

                                                                                                                                              cfb1d98328aed36d2fe9df008a95c489192f01d4bb20de329e69e0386129aff4634e6fd63a8d49e14fc96da75c9b5ed3a218425846907d0122267d50fc8d7a82

                                                                                                                                            • C:\ProgramData\Microsoft\Windows\DevManView.exe

                                                                                                                                              Filesize

                                                                                                                                              162KB

                                                                                                                                              MD5

                                                                                                                                              33d7a84f8ef67fd005f37142232ae97e

                                                                                                                                              SHA1

                                                                                                                                              1f560717d8038221c9b161716affb7cd6b14056e

                                                                                                                                              SHA256

                                                                                                                                              a1be60039f125080560edf1eebee5b6d9e2d6039f5f5ac478e6273e05edadb4b

                                                                                                                                              SHA512

                                                                                                                                              c059db769b9d8a9f1726709c9ad71e565b8081a879b55d0f906d6927409166e1d5716c784146feba41114a2cf44ee90cf2e0891831245752238f20c41590b3f5

                                                                                                                                            • C:\ProgramData\Microsoft\Windows\Disk.bat

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              250e75ba9aac6e2e9349bdebc5ef104e

                                                                                                                                              SHA1

                                                                                                                                              7efdaef5ec1752e7e29d8cc4641615d14ac1855f

                                                                                                                                              SHA256

                                                                                                                                              7d50c4fdcf6d8716c7d0d39517d479b3eeee02d2020ed635327405ae49c42516

                                                                                                                                              SHA512

                                                                                                                                              7f0d7d41c9eafcd65daa674b5182cf52e11aa0f6d6baaee74fe4c4ffc08a163277c4981cd123af0cb1857ae6fd223b5e8c676d9dc5c646a870fbd9bc4001c438

                                                                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe

                                                                                                                                              Filesize

                                                                                                                                              165KB

                                                                                                                                              MD5

                                                                                                                                              81a45f1a91448313b76d2e6d5308aa7a

                                                                                                                                              SHA1

                                                                                                                                              0d615343d5de03da03bce52e11b233093b404083

                                                                                                                                              SHA256

                                                                                                                                              fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd

                                                                                                                                              SHA512

                                                                                                                                              675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d

                                                                                                                                            • C:\ProgramData\Microsoft\Windows\amifldrv64.sys

                                                                                                                                              Filesize

                                                                                                                                              18KB

                                                                                                                                              MD5

                                                                                                                                              785045f8b25cd2e937ddc6b09debe01a

                                                                                                                                              SHA1

                                                                                                                                              029c678674f482ababe8bbfdb93152392457109d

                                                                                                                                              SHA256

                                                                                                                                              37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

                                                                                                                                              SHA512

                                                                                                                                              40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe

                                                                                                                                              Filesize

                                                                                                                                              905KB

                                                                                                                                              MD5

                                                                                                                                              dd1313842898ffaf72d79df643637ded

                                                                                                                                              SHA1

                                                                                                                                              93a34cb05fdf76869769af09a22711deea44ed28

                                                                                                                                              SHA256

                                                                                                                                              81b27a565d2eb4701c404e03398a4bca48480e592460121bf8ec62c5f4b061df

                                                                                                                                              SHA512

                                                                                                                                              db8cdcbfca205e64f1838fc28ea98107c854a4f31f617914e45c25d37da731b876afc36f816a78839d7b48b3c2b90f81856c821818f27239a504ab4253fe28f9

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe

                                                                                                                                              Filesize

                                                                                                                                              2.6MB

                                                                                                                                              MD5

                                                                                                                                              dab13157795e19d8fe050f65ce49401d

                                                                                                                                              SHA1

                                                                                                                                              ecb6f0a864fd92fb7c423d882f9a6ea703096318

                                                                                                                                              SHA256

                                                                                                                                              d8b4ce77f87bfe0b958f01ea30f48cf53e6ff51b425a57abc4f83a71d47f58fc

                                                                                                                                              SHA512

                                                                                                                                              5cdb82bf347dbdae3c8e3f376ad18fb48509af3da91e8d18876ee7adb9db9fa9d2476060bf5de1294d44e86d477486db9efa045bd45a86a0e6739d6cfa9cca89

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\sWsmPty.exe

                                                                                                                                              Filesize

                                                                                                                                              13.2MB

                                                                                                                                              MD5

                                                                                                                                              f94352e1545f9b8820885dca9baafcb4

                                                                                                                                              SHA1

                                                                                                                                              710f642efb3e30e5e9a3abc7586997de1aac0852

                                                                                                                                              SHA256

                                                                                                                                              07d614e26f1ab51b36eba12ba11e5deae3415688c6d6989e9a41d387884df763

                                                                                                                                              SHA512

                                                                                                                                              d13ccb3b6ba61db1bc1a03438fda50e617ea531ea568aa86366909fecee01b8979e284552aac2441aa8bdeddf4c1634d1d5e82701697978986294f53196537ab

                                                                                                                                            • memory/3544-7-0x0000000007600000-0x0000000007BA4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              5.6MB

                                                                                                                                            • memory/3544-6-0x0000000074E90000-0x0000000075640000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/3544-0-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/3544-5-0x0000000074E9E000-0x0000000074E9F000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/3544-4-0x0000000004B80000-0x0000000004B8A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              40KB

                                                                                                                                            • memory/3544-3-0x0000000002420000-0x000000000242C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              48KB

                                                                                                                                            • memory/3544-2-0x0000000074E90000-0x0000000075640000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/3544-73-0x0000000074E90000-0x0000000075640000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/3544-1-0x00000000001A0000-0x00000000001E6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              280KB

                                                                                                                                            • memory/3680-32-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-37-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-39-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-31-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-166-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-33-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-34-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-72-0x0000000000400000-0x000000000114E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              13.3MB

                                                                                                                                            • memory/3680-35-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-88-0x00000000036E0000-0x00000000038E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                            • memory/3680-89-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-36-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-38-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-149-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-19-0x00000000012B0000-0x00000000012B1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/3680-20-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.4MB

                                                                                                                                            • memory/3680-21-0x00000000036E0000-0x00000000038E8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                            • memory/4516-112-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-127-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-111-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-150-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-158-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-160-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-162-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-164-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-48-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-175-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-176-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB

                                                                                                                                            • memory/4516-177-0x0000000000DC0000-0x000000000181D000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.4MB