Overview

overview

10

Static

static

3

AnaRAT.exe

windows7-x64

10

AnaRAT.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 03:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AnaRAT.exe
  • Size 6.0MB
  • Sample240907-d14hlasfln
  • SHA256 b8af724789e01cb47a661d40a22a5ec93a2f1499d0ace4cd5e1d7d9fffa89246
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratgh0stratnjratpurplefoxremcosstormkitty2 moneyaugust crypter toolz grace stubfffgolazoneufcollectioncredential_accessdiscoveryevasionexecutionpersistenceprivilege_escalationratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

  • njrat

Version

  • Hallaj PRO Rat [Fixed]

Botnet

  • FFF

C2

  • tibiaserver.ddns.net:2323

Mutex

  • 64805e9b9efcd75e104b05fad0cb2a4c

Attributes
  • reg_key

    64805e9b9efcd75e104b05fad0cb2a4c

  • splitter

    boolLove

Extracted

Family

  • remcos

Botnet

  • AUGUST CRYPTER TOOLZ GRACE STUB

C2

  • teamfavour222.ddns.net :6767

  • odogwuvisual123.duckdns.org:6767

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    -YFLE4M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • 2 MONEY

C2

  • twart.myfirewall.org:14143

Mutex

  • udn3BZ1Fqt3jtiZx

Attributes
  • delay

    30

  • install

    true

  • install_file

    svchost.exe

  • install_folder

    %Temp%

aes.plain

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • neuf

C2

  • doddyfire.linkpc.net:10000

Mutex

  • e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Extracted

Family

  • remcos

Botnet

  • GOLAZO

C2

  • agosto14.con-ip.com:7772

Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-KKPQTN

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detect PurpleFox Rootkit 3 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 2 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Detected Nirsoft tools 7 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 26 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 7 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Modifies registry class 22 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnaRAT.exe
    "C:\Users\Admin\AppData\Local\Temp\AnaRAT.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
      "C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:464
    • C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe
      "C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2968
      • C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe
        "C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:3948
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Local\Temp\svchost.exe"' & exit
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4664
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Local\Temp\svchost.exe"'
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:3992
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7B07.tmp.bat""
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2768
          • C:\Windows\SysWOW64\timeout.exe
            timeout 3
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:2464
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:1664
            • C:\Users\Admin\AppData\Local\Temp\svchost.exe
              "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4892
    • C:\Users\Admin\AppData\Local\62264.exe
      "C:\Users\Admin\AppData\Local\62264.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4984
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:440
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2152
        • C:\Users\Admin\AppData\Roaming\svchost.exe
          "C:\Users\Admin\AppData\Roaming\svchost.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2664
    • C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
      "C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
        "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        PID:4144
        • C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
          C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3236
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe" "chargeable.exe" ENABLE
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4812
    • C:\Users\Admin\AppData\Local\1231234.exe
      "C:\Users\Admin\AppData\Local\1231234.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4996
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp51E4.tmp.bat""
        3⤵
          PID:432
          • C:\Windows\system32\timeout.exe
            timeout 3
            4⤵
            • Loads dropped DLL
            • Delays execution with timeout.exe
            PID:1920
          • C:\Users\Admin\AppData\Roaming\DriverrHub\$77Microsoft To Do.exe
            "C:\Users\Admin\AppData\Roaming\DriverrHub\$77Microsoft To Do.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:4928
      • C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
        "C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:8
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Client.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:2556
        • C:\Users\Admin\AppData\Local\Temp\Client.exe
          "C:\Users\Admin\AppData\Local\Temp\Client.exe"
          3⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:1332
          • C:\Windows\SYSTEM32\CMD.exe
            "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
            4⤵
              PID:1204
              • C:\Windows\system32\schtasks.exe
                SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
                5⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3176
          • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
            "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
            3⤵
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3416
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\zzzz.exe'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2508
          • C:\Users\Admin\AppData\Local\Temp\zzzz.exe
            "C:\Users\Admin\AppData\Local\Temp\zzzz.exe"
            3⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • Drops desktop.ini file(s)
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:5004
        • C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
          "C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          PID:452
          • C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
            C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe /stext "C:\Users\Admin\AppData\Local\Temp\yemhvifbxohdhu"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:792
          • C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
            C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe /stext "C:\Users\Admin\AppData\Local\Temp\ahrawaqulwzikizpz"
            3⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook accounts
            • System Location Discovery: System Language Discovery
            PID:2284
          • C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
            C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe /stext "C:\Users\Admin\AppData\Local\Temp\lbxkxtawzfrnuontjjco"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4976
        • C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe
          "C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:368
          • C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe
            "C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1856
        • C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe
          "C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
          2⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1612
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Multimedia Platform\dllhost.exe'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2600
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\uk-UA\651654794161616171771852588547475885414152526396369965885471452525258.exe'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:792
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\fontdrvhost.exe'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2768
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1812
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\IME\de-DE\RuntimeBroker.exe'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1060
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7qjYWRE28c.bat"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:404
            • C:\Windows\system32\chcp.com
              chcp 65001
              4⤵
                PID:4224
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:1620
              • C:\Program Files\Windows Multimedia Platform\dllhost.exe
                "C:\Program Files\Windows Multimedia Platform\dllhost.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:4816
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3120
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2352
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Multimedia Platform\dllhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1856
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "6516547941616161717718525885474758854141525263963699658854714525252586" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\651654794161616171771852588547475885414152526396369965885471452525258.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3624
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "651654794161616171771852588547475885414152526396369965885471452525258" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\651654794161616171771852588547475885414152526396369965885471452525258.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4880
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "6516547941616161717718525885474758854141525263963699658854714525252586" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Internet Explorer\uk-UA\651654794161616171771852588547475885414152526396369965885471452525258.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3136
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\fontdrvhost.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3184
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3176
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:5008
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3580
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:5088
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows NT\Accessories\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1372
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:3412
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\de-DE\RuntimeBroker.exe'" /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:1356
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\IME\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:4628
          • C:\Windows\system32\schtasks.exe
            schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\IME\de-DE\RuntimeBroker.exe'" /rl HIGHEST /f
            1⤵
            • Process spawned unexpected child process
            • Scheduled Task/Job: Scheduled Task
            PID:4640

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                2
                T1546

                AppInit DLLs

                1
                T1546.010

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                2
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Winlogon Helper DLL

                1
                T1547.004

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                2
                T1546

                AppInit DLLs

                1
                T1546.010

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Impair Defenses

                1
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Modify Registry

                2
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                2
                T1552

                Credentials In Files

                2
                T1552.001

                Discovery

                Browser Information Discovery

                1
                T1217

                Query Registry

                4
                T1012

                Remote System Discovery

                1
                T1018

                System Information Discovery

                3
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Data from Local System

                2
                T1005

                Email Collection

                2
                T1114

                Command and Control

                Web Service

                1
                T1102

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                logs.dat
                • Path C:\ProgramData\remcos\logs.dat
                • Size 122B
                • SHA256 65e5724c50cc82729eb00f4ceac09875681e42f15971e2f9be4aed48009d10aa
                • MD5 SHA1 SHA512
                Submit Download

                0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
                • Path C:\Users\Admin\AppData\Local\0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5.exe
                • Size 446KB
                • SHA256 0430dc1af2f95a33401d17b84b314a48cf619c9cae8e7fb8376466ca96ba8ec5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                1231234.exe
                • Path C:\Users\Admin\AppData\Local\1231234.exe
                • Size 37KB
                • SHA256 6d2223ee967236cbc2c35809fce753553cfdb0aac7ba34e7087e19d61eecaa18
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
                • Path C:\Users\Admin\AppData\Local\150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712.exe
                • Size 227KB
                • SHA256 150704149f7e54c4f7cbdb776f33173979791bc0c625f42477815923d13f8712
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                • Path C:\Users\Admin\AppData\Local\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                • Size 233KB
                • SHA256 87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                62264.exe
                • Path C:\Users\Admin\AppData\Local\62264.exe
                • Size 198KB
                • SHA256 d22bf8ad4fc9b769ea2944bbdee78277ab29bac7199407baf7c3b489568a9489
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                651654794161616171771852588547475885414152526396369965885471452525258.exe
                • Path C:\Users\Admin\AppData\Local\651654794161616171771852588547475885414152526396369965885471452525258.exe
                • Size 1.6MB
                • SHA256 75f846b15fa1b548a0143f35584b25875a03c03a783e9310c8573f3b76957688
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                690c1b65a6267d6d0b201ba46089aabc.exe
                • Path C:\Users\Admin\AppData\Local\690c1b65a6267d6d0b201ba46089aabc.exe
                • Size 608KB
                • SHA256 244f3a2fad1afa232909355901f33cca18ea95444c5d142c7aa308170db5294f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
                • Path C:\Users\Admin\AppData\Local\73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3.exe
                • Size 110KB
                • SHA256 73304b5c73a1c90b192c8748348509c213890807d3ca34b08c8fb84652b0cbd3
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                • MD5 SHA1 SHA512
                Submit Download

                690c1b65a6267d6d0b201ba46089aabc.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\690c1b65a6267d6d0b201ba46089aabc.exe.log
                • Size 1KB
                • SHA256 1e1b444fe2d8772f6709b22b94bb5b0aa7fa590f6a693705d9bf1f2f71267a55
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 cce65b73cdfe9304bcd5207913e8b60fb69faa20cd3b684f2b0343b755b99438
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
                • MD5 SHA1 SHA512
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 af18fc4864bc2982879aed928c960b6266f372c928f8c9632c5a4eecd64e448a
                • MD5 SHA1 SHA512
                Submit Download

                3HH6KfBvI8
                • Path C:\Users\Admin\AppData\Local\Temp\3HH6KfBvI8
                • Size 116KB
                • SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                4bDPnfeBYs
                • Path C:\Users\Admin\AppData\Local\Temp\4bDPnfeBYs
                • Size 114KB
                • SHA256 e6287cb739a35ef64a6d19ec146c90c848de8646032fd98d570042c0e2ecf070
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                7qjYWRE28c.bat
                • Path C:\Users\Admin\AppData\Local\Temp\7qjYWRE28c.bat
                • Size 184B
                • SHA256 80719acc858f473c0c4692e4243f2d68e7708b93218c41a10b0a0cfb1f251ab1
                • MD5 SHA1 SHA512
                Submit Download

                Client.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Client.exe
                • Size 100KB
                • SHA256 d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SCRIPT~1.EXE
                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SCRIPT~1.EXE
                • Size 210KB
                • SHA256 ab532f166e08886166c0ed6426bb6a8998de8273d37ccac5823528a1ba3d8ca1
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                script-error.xml
                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\script-error.xml
                • Size 19B
                • SHA256 49704e6fd30fc98988f40be963296c81b95662d7f3af605c372cd0344ab78e1b
                • MD5 SHA1 SHA512
                Submit Download

                script-error.zip
                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\script-error.zip
                • Size 308B
                • SHA256 c2423419d653bf31077eb40ad665590445b5baac4f82948822c8ed55fc009c4d
                • MD5 SHA1 SHA512
                Submit Download

                svchost.exe
                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe
                • Size 152KB
                • SHA256 5fb62cc6421cf636023381cc6fd5a06e3b326a58ea3d3ce9c879f1cc408519f4
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Launcher.exe
                • Path C:\Users\Admin\AppData\Local\Temp\Launcher.exe
                • Size 22KB
                • SHA256 dcdc72549f7ad41cc860738adbeee5e44f02222415fd84ed5c92538ac9049b92
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                WizFN6Ayux
                • Path C:\Users\Admin\AppData\Local\Temp\WizFN6Ayux
                • Size 40KB
                • SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                __PSScriptPolicyTest_ojiyt3tq.gyb.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ojiyt3tq.gyb.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512
                Submit Download

                tmp51E4.tmp.bat
                • Path C:\Users\Admin\AppData\Local\Temp\tmp51E4.tmp.bat
                • Size 173B
                • SHA256 cae2ad934a7a8027cbb568e1aa648a6cf35e614ef66ffc67551bb26426176ab6
                • MD5 SHA1 SHA512
                Submit Download

                tmp7B07.tmp.bat
                • Path C:\Users\Admin\AppData\Local\Temp\tmp7B07.tmp.bat
                • Size 154B
                • SHA256 52d1d4a9bf16e854c78ed6a1785fae0ae4feab57199c21da9432b7a405cd2cd5
                • MD5 SHA1 SHA512
                Submit Download

                yemhvifbxohdhu
                • Path C:\Users\Admin\AppData\Local\Temp\yemhvifbxohdhu
                • Size 4KB
                • SHA256 29338949fae4c88a972837aae898529e4c7a2c4df35982eef2f8d7b602c17f4e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                zzzz.exe
                • Path C:\Users\Admin\AppData\Local\Temp\zzzz.exe
                • Size 320KB
                • SHA256 51813dfedbe02f03d08b4728187eadb4948d8be40c9d8fe6e4e1cb61fa7ae209
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                a6a1abaf12a28ea8f6553356c3bdcf57.exe
                • Path C:\Users\Admin\AppData\Local\a6a1abaf12a28ea8f6553356c3bdcf57.exe
                • Size 874KB
                • SHA256 f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Bookmarks.txt
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\Browsers\Firefox\Bookmarks.txt
                • Size 105B
                • SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
                • MD5 SHA1 SHA512
                Submit Download

                SetHide.svg
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Desktop\SetHide.svg
                • Size 447KB
                • SHA256 807d57fca560d1827d50d591c4caf5048cee4f701baec0b37c0d952cb13e2bed
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                InitializeExpand.xls
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Documents\InitializeExpand.xls
                • Size 2.4MB
                • SHA256 00e0687c49e300b4706f45b9c56062eb78e014bb5e0a3155f81c54f99164d4eb
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ApproveWait.pdf
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Downloads\ApproveWait.pdf
                • Size 173KB
                • SHA256 43b8423f1ba9bdb7612c9786e842acf9aacece7770971c1dcb10b3f96615108d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ConvertClose.bmp
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Downloads\ConvertClose.bmp
                • Size 302KB
                • SHA256 2254bb532d090f9c8a1a97b24a4cba87fe20fe59828e0dd3ce753ac0da0ea428
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                DenySync.docx
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Downloads\DenySync.docx
                • Size 197KB
                • SHA256 76ef178c405e705a183fd93a3e4abbe7dccb5c40d08ad6861e0e36092b63d512
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SkipFind.sql
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Downloads\SkipFind.sql
                • Size 222KB
                • SHA256 2f1ffa1196e82e87d81ebdca8b10b9c0cb5a8f6c8be3f48a8d09136b476f9c98
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                SplitPop.xlsx
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Downloads\SplitPop.xlsx
                • Size 327KB
                • SHA256 816b5f2b1f79a98040e4263d080af875a1e999490fce985a9fb97f7452e479e1
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                GetSet.png
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Pictures\GetSet.png
                • Size 366KB
                • SHA256 406e200a8f6849de7ce3e643a102074e3a884cdf34ea99572078ae639317f8ff
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                ReceivePop.jpg
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Pictures\ReceivePop.jpg
                • Size 238KB
                • SHA256 ef4457d1030493f82185f52e3e3223708dc1c79d68857f1e26a0f65f03a934b3
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                UnlockRemove.jpg
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\FileGrabber\Pictures\UnlockRemove.jpg
                • Size 334KB
                • SHA256 10df9f0f68713506743c03c59c737a3de996c84b33f4ec6f85efa479e91e2d95
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                Process.txt
                • Path C:\Users\Admin\AppData\Roaming\DSEYXUOD\Process.txt
                • Size 4KB
                • SHA256 1264acc71eb1b8a3b10c15c1d2db985e1176b3f13d990a1bbd9be4bc686bc0e8
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                chargeable.exe
                • Path C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
                • Size 110KB
                • SHA256 9ea12d40d73546ddc087cec87954ab07de5dfe8ff8226242a2c3dabb9355011e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                xdwd.dll
                • Path C:\Windows\xdwd.dll
                • Size 136KB
                • SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/8-97-0x0000000000BA0000-0x0000000000BE0000-memory.dmp
                Download

                memory/368-433-0x0000000000400000-0x000000000058F000-memory.dmp
                Download

                memory/368-438-0x0000000000400000-0x000000000058F000-memory.dmp
                Download

                memory/452-556-0x0000000000400000-0x000000000048A000-memory.dmp
                Download

                memory/452-502-0x0000000010000000-0x0000000010019000-memory.dmp
                Download

                memory/452-759-0x0000000000400000-0x000000000048A000-memory.dmp
                Download

                memory/452-505-0x0000000010000000-0x0000000010019000-memory.dmp
                Download

                memory/452-278-0x0000000000400000-0x000000000048A000-memory.dmp
                Download

                memory/452-277-0x0000000000400000-0x000000000048A000-memory.dmp
                Download

                memory/452-506-0x0000000010000000-0x0000000010019000-memory.dmp
                Download

                memory/452-856-0x0000000000400000-0x000000000048A000-memory.dmp
                Download

                memory/452-94-0x0000000000400000-0x000000000048A000-memory.dmp
                Download

                memory/464-118-0x0000000010000000-0x00000000101A5000-memory.dmp
                Download

                memory/464-123-0x0000000010000000-0x00000000101A5000-memory.dmp
                Download

                memory/464-121-0x0000000010000000-0x00000000101A5000-memory.dmp
                Download

                memory/464-120-0x0000000010000000-0x00000000101A5000-memory.dmp
                Download

                memory/792-499-0x0000000000400000-0x0000000000478000-memory.dmp
                Download

                memory/792-465-0x0000000000400000-0x0000000000478000-memory.dmp
                Download

                memory/792-462-0x0000000000400000-0x0000000000478000-memory.dmp
                Download

                memory/792-459-0x0000000000400000-0x0000000000478000-memory.dmp
                Download

                memory/1060-114-0x0000000074CA0000-0x0000000075251000-memory.dmp
                Download

                memory/1060-2-0x0000000074CA0000-0x0000000075251000-memory.dmp
                Download

                memory/1060-1-0x0000000074CA0000-0x0000000075251000-memory.dmp
                Download

                memory/1060-0-0x0000000074CA2000-0x0000000074CA3000-memory.dmp
                Download

                memory/1332-253-0x0000000000420000-0x0000000000440000-memory.dmp
                Download

                memory/1612-135-0x000000001AD10000-0x000000001AD60000-memory.dmp
                Download

                memory/1612-147-0x0000000002410000-0x000000000241C000-memory.dmp
                Download

                memory/1612-115-0x0000000000040000-0x000000000011C000-memory.dmp
                Download

                memory/1612-116-0x00000000007B0000-0x00000000007B6000-memory.dmp
                Download

                memory/1612-122-0x000000001B090000-0x000000001B214000-memory.dmp
                Download

                memory/1612-124-0x00000000007C0000-0x00000000007C6000-memory.dmp
                Download

                memory/1612-132-0x00000000021A0000-0x00000000021AE000-memory.dmp
                Download

                memory/1612-137-0x00000000023D0000-0x00000000023E8000-memory.dmp
                Download

                memory/1612-134-0x00000000021D0000-0x00000000021EC000-memory.dmp
                Download

                memory/1612-139-0x00000000021B0000-0x00000000021BE000-memory.dmp
                Download

                memory/1612-143-0x00000000023F0000-0x00000000023FC000-memory.dmp
                Download

                memory/1612-141-0x00000000021C0000-0x00000000021CE000-memory.dmp
                Download

                memory/1612-145-0x0000000002400000-0x000000000240E000-memory.dmp
                Download

                memory/1856-855-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-563-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-1068-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-442-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-1040-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-1038-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-985-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-984-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-955-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-826-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-520-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-718-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-546-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-671-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-561-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-445-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-447-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-954-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-857-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-436-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-827-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/1856-440-0x0000000000590000-0x0000000000612000-memory.dmp
                Download

                memory/2152-211-0x00000000002F0000-0x000000000031C000-memory.dmp
                Download

                memory/2152-232-0x0000000005750000-0x000000000575C000-memory.dmp
                Download

                memory/2284-468-0x0000000000400000-0x0000000000462000-memory.dmp
                Download

                memory/2284-463-0x0000000000400000-0x0000000000462000-memory.dmp
                Download

                memory/2284-466-0x0000000000400000-0x0000000000462000-memory.dmp
                Download

                memory/2284-479-0x0000000000470000-0x0000000000539000-memory.dmp
                Download

                memory/2284-481-0x0000000000400000-0x0000000000462000-memory.dmp
                Download

                memory/2284-467-0x0000000000400000-0x0000000000462000-memory.dmp
                Download

                memory/2556-157-0x000001EF5CAA0000-0x000001EF5CAC2000-memory.dmp
                Download

                memory/2968-95-0x0000000005150000-0x00000000051E2000-memory.dmp
                Download

                memory/2968-82-0x0000000000820000-0x00000000008BA000-memory.dmp
                Download

                memory/2968-108-0x00000000055D0000-0x00000000055DA000-memory.dmp
                Download

                memory/2968-117-0x0000000006F30000-0x0000000006F4E000-memory.dmp
                Download

                memory/2968-109-0x0000000005DA0000-0x0000000005E3C000-memory.dmp
                Download

                memory/2968-335-0x00000000093C0000-0x0000000009414000-memory.dmp
                Download

                memory/2968-96-0x0000000005270000-0x00000000055C4000-memory.dmp
                Download

                memory/2968-84-0x0000000005640000-0x0000000005BE4000-memory.dmp
                Download

                memory/2968-334-0x0000000006740000-0x0000000006756000-memory.dmp
                Download

                memory/3236-379-0x0000000000400000-0x000000000040C000-memory.dmp
                Download

                memory/3948-338-0x0000000000400000-0x0000000000412000-memory.dmp
                Download

                memory/4976-477-0x0000000000400000-0x0000000000424000-memory.dmp
                Download

                memory/4976-478-0x0000000000400000-0x0000000000424000-memory.dmp
                Download

                memory/4976-484-0x0000000000400000-0x0000000000424000-memory.dmp
                Download

                memory/4976-472-0x0000000000400000-0x0000000000424000-memory.dmp
                Download

                memory/4996-61-0x0000000000CC0000-0x0000000000CCE000-memory.dmp
                Download

                memory/5004-302-0x00000000004F0000-0x0000000000546000-memory.dmp
                Download

                memory/5004-344-0x00000000065D0000-0x0000000006636000-memory.dmp
                Download