Overview

overview

10

Static

static

10

SyncSpoofer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-08-2024 16:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SyncSpoofer.exe

  • Size

    276KB

  • MD5

    5a8afe7bfd11728c32066c4290eeddc7

  • SHA1

    f2064bbdec287d61722ef35e511b4090212cd1a8

  • SHA256

    92c799a2fd29060a44558a153d1ff5866e420e46b35bdd4546c782c17d4bb50f

  • SHA512

    e03994e666aa7ff84400e86e4cc3db5a77a5475e1961b553f16dbc293160f58f196b0ab6fb7be4ba34b1d030969f2f94ae80dc0c423f3ec015621bf987b796cb

  • SSDEEP

    1536:hJ99JW77A9oXFY+w67Vh7O9H/squacb3P12NETDLiaSKry3bgDBsvVeXBdZs4o7M:vSFHh69HEZJRTDLiaSKreumVeBs4o

Score
10/10
gurcupurelogstealerdefense_evasiondiscoverypersistencestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7308213044:AAFm9yNR1WX2-QnC_ZcUdYHkkJGg7179JYE/sendMessag

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • PureLog Stealer

    PureLog Stealer is an infostealer written in C#.

    stealerpurelogstealer
  • PureLog Stealer payload 1 IoCs
  • Detected Nirsoft tools 2 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Maps connected drives based on registry 3 TTPs 64 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
      "C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4952
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4132
    • C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe"
      1⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:240
      • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
        "C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:3128
    • C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe"
      1⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Users\Admin\AppData\Roaming\sWsmPty.exe
        "C:\Users\Admin\AppData\Roaming\sWsmPty.exe"
        2⤵
        • Executes dropped EXE
        PID:3636
      • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
        "C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:4592
      • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe
        "C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:920
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 9C2M-VCU3
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4648
          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
            C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 9C2M-VCU3
            4⤵
            • Executes dropped EXE
            PID:2544
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Disk.bat
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:324
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:2300
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk drive*" /use_wildcard""
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:2044
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "C:\"
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:4844
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "D:\"
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:4756
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "E:\"
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:1916
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "F:\"
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:4392
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "G:\"
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:4632
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk"
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:5036
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "disk"
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:2240
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk&*" /use_wildcard""
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:1664
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard""
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:3512
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "USBSTOR*" /use_wildcard""
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:924
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard""
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:2056
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "STORAGE*" /use_wildcard""
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:1932
          • C:\ProgramData\Microsoft\Windows\DevManView.exe
            C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
            4⤵
            • Executes dropped EXE
            • Enumerates connected drives
            • Maps connected drives based on registry
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:4604
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2332
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 1162HP-TRGT16515AB
            4⤵
            • Executes dropped EXE
            PID:1480
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2840
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 21165HP-TRGT27263RV
            4⤵
            • Executes dropped EXE
            PID:1572
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1136
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 81165HP-TRGT27263SG
            4⤵
            • Executes dropped EXE
            PID:4068
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4676
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
            4⤵
            • Executes dropped EXE
            PID:1424
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
          3⤵
            PID:1164
            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 51165HP-TRGT27263SL
              4⤵
              • Executes dropped EXE
              PID:3720
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
            3⤵
              PID:1476
              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 41165HP-TRGT27263FA
                4⤵
                • Executes dropped EXE
                PID:4448
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
              3⤵
                PID:1372
                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 61165HP-TRGT27263FU
                  4⤵
                  • Executes dropped EXE
                  PID:1508
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                3⤵
                  PID:520
                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 31165HP-TRGT27263DQ
                    4⤵
                    • Executes dropped EXE
                    PID:3008
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                  3⤵
                    PID:1132
                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 71165HP-TRGT27263MST
                      4⤵
                      • Executes dropped EXE
                      PID:3652
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                    3⤵
                      PID:3124
                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                        4⤵
                        • Executes dropped EXE
                        PID:4380
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                      3⤵
                        PID:1616
                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 1181HP-TRGT15469AB
                          4⤵
                          • Executes dropped EXE
                          PID:4604
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                        3⤵
                          PID:3588
                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 21181HP-TRGT15469RV
                            4⤵
                            • Executes dropped EXE
                            PID:3716
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                          3⤵
                            PID:2664
                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 81181HP-TRGT15469SG
                              4⤵
                              • Executes dropped EXE
                              PID:2240
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                            3⤵
                              PID:2072
                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                4⤵
                                • Executes dropped EXE
                                PID:1288
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                              3⤵
                                PID:2480
                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 51181HP-TRGT15469SL
                                  4⤵
                                  • Executes dropped EXE
                                  PID:324
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                3⤵
                                  PID:4232
                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 41181HP-TRGT15469FA
                                    4⤵
                                    • Executes dropped EXE
                                    PID:4940
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                  3⤵
                                    PID:2732
                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 61181HP-TRGT15469FU
                                      4⤵
                                      • Executes dropped EXE
                                      PID:1484
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                    3⤵
                                      PID:2152
                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 31185HP-TRGT26218DQ
                                        4⤵
                                        • Executes dropped EXE
                                        PID:1908
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                      3⤵
                                        PID:560
                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 71185HP-TRGT26218MST
                                          4⤵
                                          • Executes dropped EXE
                                          PID:3988
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                        3⤵
                                          PID:4516
                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                            4⤵
                                            • Executes dropped EXE
                                            PID:2332
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                                          3⤵
                                            PID:4800
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              4⤵
                                                PID:4068
                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 1201HP-TRGT14424AB
                                                4⤵
                                                • Executes dropped EXE
                                                PID:2036
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                                              3⤵
                                                PID:1700
                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 21201HP-TRGT14424RV
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:2972
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                                                3⤵
                                                  PID:4352
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    4⤵
                                                      PID:3720
                                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 81201HP-TRGT14424SG
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:1956
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                    3⤵
                                                      PID:4448
                                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:3740
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                                      3⤵
                                                        PID:1372
                                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 51201HP-TRGT14424SL
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:2936
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                                        3⤵
                                                          PID:1132
                                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 41201HP-TRGT14424FA
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1240
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                                          3⤵
                                                            PID:4640
                                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 61201HP-TRGT14424FU
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:832
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                                            3⤵
                                                              PID:440
                                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 31201HP-TRGT14424DQ
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:3536
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                                              3⤵
                                                                PID:2312
                                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 71201HP-TRGT14424MST
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:112
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                3⤵
                                                                  PID:2240
                                                                  • C:\Windows\System32\Conhost.exe
                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    4⤵
                                                                      PID:1288
                                                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:4740
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: MKR3-9M2O
                                                                    3⤵
                                                                      PID:1508
                                                                      • C:\Windows\System32\Conhost.exe
                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        4⤵
                                                                          PID:3008
                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: MKR3-9M2O
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:2460
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: 1FFU-ECV9
                                                                        3⤵
                                                                          PID:2972
                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: 1FFU-ECV9
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:3600
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: R8TI-SJVG
                                                                          3⤵
                                                                            PID:4132
                                                                            • C:\Windows\System32\Conhost.exe
                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                              4⤵
                                                                                PID:4676
                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: R8TI-SJVG
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:1636
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: 12D9-N74C
                                                                              3⤵
                                                                                PID:4172
                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: 12D9-N74C
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2912
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: GAV2-SLAL
                                                                                3⤵
                                                                                  PID:3536
                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: GAV2-SLAL
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:4836
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: V5AV-TDBN
                                                                                  3⤵
                                                                                    PID:324
                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: V5AV-TDBN
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:4240
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: RH9I-SNZB
                                                                                    3⤵
                                                                                      PID:1736
                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: RH9I-SNZB
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:4452
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: P4CN-J00H
                                                                                      3⤵
                                                                                        PID:1488
                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: P4CN-J00H
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:3596
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: 2C3P-0Z1U
                                                                                        3⤵
                                                                                          PID:1484
                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                            4⤵
                                                                                              PID:2732
                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: 2C3P-0Z1U
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:392
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: G97G-6EJ5
                                                                                            3⤵
                                                                                              PID:3544
                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                4⤵
                                                                                                  PID:4448
                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: G97G-6EJ5
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1136
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: U7J9-85I8
                                                                                                3⤵
                                                                                                  PID:2936
                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: U7J9-85I8
                                                                                                    4⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:1636
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: 97J0-6FT6
                                                                                                  3⤵
                                                                                                    PID:1716
                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                      4⤵
                                                                                                        PID:3740
                                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: 97J0-6FT6
                                                                                                        4⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:640
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: 54S0-LK5T
                                                                                                      3⤵
                                                                                                        PID:1848
                                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: 54S0-LK5T
                                                                                                          4⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:5104
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: P4L8-3I23
                                                                                                        3⤵
                                                                                                          PID:2260
                                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: P4L8-3I23
                                                                                                            4⤵
                                                                                                              PID:3548
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: ULT6-GH2P
                                                                                                            3⤵
                                                                                                              PID:2312
                                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: ULT6-GH2P
                                                                                                                4⤵
                                                                                                                  PID:440
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: HDU8-2SH6
                                                                                                                3⤵
                                                                                                                  PID:4836
                                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: HDU8-2SH6
                                                                                                                    4⤵
                                                                                                                      PID:3588
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: KP7Z-BSN2
                                                                                                                    3⤵
                                                                                                                      PID:3736
                                                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: KP7Z-BSN2
                                                                                                                        4⤵
                                                                                                                          PID:2592
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: RFFM-BJU2
                                                                                                                        3⤵
                                                                                                                          PID:4748
                                                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: RFFM-BJU2
                                                                                                                            4⤵
                                                                                                                              PID:4952
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 0U4P-IRC1
                                                                                                                            3⤵
                                                                                                                              PID:4856
                                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                4⤵
                                                                                                                                  PID:1488
                                                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 0U4P-IRC1
                                                                                                                                  4⤵
                                                                                                                                    PID:1916
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: DZ36-39RJ
                                                                                                                                  3⤵
                                                                                                                                    PID:4516
                                                                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: DZ36-39RJ
                                                                                                                                      4⤵
                                                                                                                                        PID:4800
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: 8DTP-IDRO
                                                                                                                                      3⤵
                                                                                                                                        PID:4752
                                                                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: 8DTP-IDRO
                                                                                                                                          4⤵
                                                                                                                                            PID:1028
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: NM3C-4OIJ
                                                                                                                                          3⤵
                                                                                                                                            PID:1700
                                                                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: NM3C-4OIJ
                                                                                                                                              4⤵
                                                                                                                                                PID:180
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: LC2N-BMT2
                                                                                                                                              3⤵
                                                                                                                                                PID:1208
                                                                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: LC2N-BMT2
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1420
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                                  3⤵
                                                                                                                                                    PID:3100
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.chm
                                                                                                                                                    3⤵
                                                                                                                                                      PID:416
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5104
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys
                                                                                                                                                        3⤵
                                                                                                                                                          PID:2016
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4276
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1616
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2648
                                                                                                                                                          • C:\Windows\system32\taskmgr.exe
                                                                                                                                                            "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                            1⤵
                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                            PID:2500
                                                                                                                                                          • C:\Windows\system32\BackgroundTransferHost.exe
                                                                                                                                                            "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1372
                                                                                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                              C:\Windows\system32\AUDIODG.EXE 0x394 0x34c
                                                                                                                                                              1⤵
                                                                                                                                                                PID:1476

                                                                                                                                                              Network

                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                              Replay Monitor

                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                              Downloads

                                                                                                                                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                                                Filesize

                                                                                                                                                                452KB

                                                                                                                                                                MD5

                                                                                                                                                                c4d09d3b3516550ad2ded3b09e28c10c

                                                                                                                                                                SHA1

                                                                                                                                                                7a5e77bb9ba74cf57cb1d119325b0b7f64199824

                                                                                                                                                                SHA256

                                                                                                                                                                66433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3

                                                                                                                                                                SHA512

                                                                                                                                                                2e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                                                Filesize

                                                                                                                                                                1KB

                                                                                                                                                                MD5

                                                                                                                                                                43b37d0f48bad1537a4de59ffda50ffe

                                                                                                                                                                SHA1

                                                                                                                                                                48ca09a0ed8533bf462a56c43b8db6e7b6c6ffa8

                                                                                                                                                                SHA256

                                                                                                                                                                fc258dfb3e49be04041ac24540ef544192c2e57300186f777f301d586f900288

                                                                                                                                                                SHA512

                                                                                                                                                                cfb1d98328aed36d2fe9df008a95c489192f01d4bb20de329e69e0386129aff4634e6fd63a8d49e14fc96da75c9b5ed3a218425846907d0122267d50fc8d7a82

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                                                Filesize

                                                                                                                                                                162KB

                                                                                                                                                                MD5

                                                                                                                                                                33d7a84f8ef67fd005f37142232ae97e

                                                                                                                                                                SHA1

                                                                                                                                                                1f560717d8038221c9b161716affb7cd6b14056e

                                                                                                                                                                SHA256

                                                                                                                                                                a1be60039f125080560edf1eebee5b6d9e2d6039f5f5ac478e6273e05edadb4b

                                                                                                                                                                SHA512

                                                                                                                                                                c059db769b9d8a9f1726709c9ad71e565b8081a879b55d0f906d6927409166e1d5716c784146feba41114a2cf44ee90cf2e0891831245752238f20c41590b3f5

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                                                Filesize

                                                                                                                                                                1KB

                                                                                                                                                                MD5

                                                                                                                                                                250e75ba9aac6e2e9349bdebc5ef104e

                                                                                                                                                                SHA1

                                                                                                                                                                7efdaef5ec1752e7e29d8cc4641615d14ac1855f

                                                                                                                                                                SHA256

                                                                                                                                                                7d50c4fdcf6d8716c7d0d39517d479b3eeee02d2020ed635327405ae49c42516

                                                                                                                                                                SHA512

                                                                                                                                                                7f0d7d41c9eafcd65daa674b5182cf52e11aa0f6d6baaee74fe4c4ffc08a163277c4981cd123af0cb1857ae6fd223b5e8c676d9dc5c646a870fbd9bc4001c438

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                                                Filesize

                                                                                                                                                                165KB

                                                                                                                                                                MD5

                                                                                                                                                                81a45f1a91448313b76d2e6d5308aa7a

                                                                                                                                                                SHA1

                                                                                                                                                                0d615343d5de03da03bce52e11b233093b404083

                                                                                                                                                                SHA256

                                                                                                                                                                fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd

                                                                                                                                                                SHA512

                                                                                                                                                                675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                                                Filesize

                                                                                                                                                                18KB

                                                                                                                                                                MD5

                                                                                                                                                                785045f8b25cd2e937ddc6b09debe01a

                                                                                                                                                                SHA1

                                                                                                                                                                029c678674f482ababe8bbfdb93152392457109d

                                                                                                                                                                SHA256

                                                                                                                                                                37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

                                                                                                                                                                SHA512

                                                                                                                                                                40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SyncSpoofer.exe.log
                                                                                                                                                                Filesize

                                                                                                                                                                942B

                                                                                                                                                                MD5

                                                                                                                                                                9d61fe90e3d46c7436edff71df55f438

                                                                                                                                                                SHA1

                                                                                                                                                                4e4132995ca05b42ca6bf6453a3a2315c6f0beaa

                                                                                                                                                                SHA256

                                                                                                                                                                0970f3d296aa2e17faefff34981061b5e05c735f0068f9f762f71e8659c940af

                                                                                                                                                                SHA512

                                                                                                                                                                d2fc0deb6e999884554d0f1cba1d66d253053f1e241bc0abf142d26087c7ad9a4a7b2ba6dd2a29d3f7c554df79451c8af4564c6e9e0f2839f20a571d15bbf26f

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe
                                                                                                                                                                Filesize

                                                                                                                                                                905KB

                                                                                                                                                                MD5

                                                                                                                                                                dd1313842898ffaf72d79df643637ded

                                                                                                                                                                SHA1

                                                                                                                                                                93a34cb05fdf76869769af09a22711deea44ed28

                                                                                                                                                                SHA256

                                                                                                                                                                81b27a565d2eb4701c404e03398a4bca48480e592460121bf8ec62c5f4b061df

                                                                                                                                                                SHA512

                                                                                                                                                                db8cdcbfca205e64f1838fc28ea98107c854a4f31f617914e45c25d37da731b876afc36f816a78839d7b48b3c2b90f81856c821818f27239a504ab4253fe28f9

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
                                                                                                                                                                Filesize

                                                                                                                                                                2.6MB

                                                                                                                                                                MD5

                                                                                                                                                                dab13157795e19d8fe050f65ce49401d

                                                                                                                                                                SHA1

                                                                                                                                                                ecb6f0a864fd92fb7c423d882f9a6ea703096318

                                                                                                                                                                SHA256

                                                                                                                                                                d8b4ce77f87bfe0b958f01ea30f48cf53e6ff51b425a57abc4f83a71d47f58fc

                                                                                                                                                                SHA512

                                                                                                                                                                5cdb82bf347dbdae3c8e3f376ad18fb48509af3da91e8d18876ee7adb9db9fa9d2476060bf5de1294d44e86d477486db9efa045bd45a86a0e6739d6cfa9cca89

                                                                                                                                                                Download Submit

                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\sWsmPty.exe
                                                                                                                                                                Filesize

                                                                                                                                                                13.2MB

                                                                                                                                                                MD5

                                                                                                                                                                f94352e1545f9b8820885dca9baafcb4

                                                                                                                                                                SHA1

                                                                                                                                                                710f642efb3e30e5e9a3abc7586997de1aac0852

                                                                                                                                                                SHA256

                                                                                                                                                                07d614e26f1ab51b36eba12ba11e5deae3415688c6d6989e9a41d387884df763

                                                                                                                                                                SHA512

                                                                                                                                                                d13ccb3b6ba61db1bc1a03438fda50e617ea531ea568aa86366909fecee01b8979e284552aac2441aa8bdeddf4c1634d1d5e82701697978986294f53196537ab

                                                                                                                                                                Download Submit

                                                                                                                                                              • memory/240-8-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/240-112-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/240-10-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/240-7-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/240-11-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-24-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-25-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-14-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-23-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-22-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-21-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-20-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-19-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-15-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2500-13-0x00000190B6900000-0x00000190B6901000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2636-156-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2636-5-0x00000000744DE000-0x00000000744DF000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2636-4-0x00000000054F0000-0x00000000054FA000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                40KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2636-6-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2636-3-0x0000000002FE0000-0x0000000002FEC000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                48KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2636-0-0x00000000744DE000-0x00000000744DF000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                4KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2636-2-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/2636-1-0x0000000000B00000-0x0000000000B46000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                280KB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3128-96-0x0000000000D00000-0x000000000175D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3128-93-0x0000000000D00000-0x000000000175D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-51-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-38-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-194-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-48-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-64-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-47-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-49-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-46-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-45-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-113-0x0000000000400000-0x000000000114E000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                13.3MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-115-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-50-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/3636-44-0x0000000140000000-0x0000000140273000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                2.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4592-181-0x00000000005C0000-0x000000000101D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4592-144-0x00000000005C0000-0x000000000101D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4592-143-0x00000000005C0000-0x000000000101D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4592-208-0x00000000005C0000-0x000000000101D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4592-206-0x00000000005C0000-0x000000000101D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4592-204-0x00000000005C0000-0x000000000101D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4592-200-0x00000000005C0000-0x000000000101D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4592-60-0x00000000005C0000-0x000000000101D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4800-12-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4800-9-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4800-94-0x00000000744D0000-0x0000000074C80000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                7.7MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4800-26-0x0000000008BF0000-0x0000000009194000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                5.6MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4952-155-0x0000000000B30000-0x000000000158D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download

                                                                                                                                                              • memory/4952-152-0x0000000000B30000-0x000000000158D000-memory.dmp

                                                                                                                                                                Filesize

                                                                                                                                                                10.4MB

                                                                                                                                                                Download