Overview

overview

10

Static

static

1

SyncSpoofer.exe

windows7-x64

10

SyncSpoofer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-10-2024 22:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SyncSpoofer.exe

  • Size

    4.5MB

  • MD5

    a83ef3022abbf90408e3d524f1aa7a8b

  • SHA1

    d871478b0d72d51ab3d3325bf45688a9c0c5efd5

  • SHA256

    24d5a4217ca7cbac8b0d33663c7eac767c0248ed2e83c42ac242fd7b9007d42f

  • SHA512

    361cce9ad65fd939a3e78d150931dd468ddacba99b5ba148ba3799ceb2b2ec00904a769601d076d81218d4b732cd82210f88a714418261ad2edce02619ff3293

  • SSDEEP

    98304:uEnVwl1p8jfC2ajXVRONMJ/A2CQsHXst4R6D:12v8ja1WNMhA1Cd

Score
10/10
stealcsoftdefense_evasiondiscoveryevasionpersistencestealerthemidatrojan

Malware Config

Extracted

Family

stealc

Botnet

soft

C2

http://193.233.112.44

Attributes
  • url_path

    /383ccd496f3c5eee.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Detected Nirsoft tools 2 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 7 IoCs
  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Maps connected drives based on registry 3 TTPs 30 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 60 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: LoadsDriver 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Roaming\sWsmPty.exe
      "C:\Users\Admin\AppData\Roaming\sWsmPty.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2520
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 884
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:600
    • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
      "C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2264
    • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe
      "C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1444
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: GI62-O9B4
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2608
        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
          C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: GI62-O9B4
          4⤵
          • Executes dropped EXE
          PID:2684
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Disk.bat
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:272
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk drive*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1648
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "C:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1716
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "D:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1392
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "E:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1968
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "F:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1856
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "G:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1800
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1708
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "disk"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1852
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk&*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1884
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1300
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "USBSTOR*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2384
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1296
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "STORAGE*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1320
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1276
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
        3⤵
        • Loads dropped DLL
        PID:2472
        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 11510HP-TRGT23274AB
          4⤵
          • Executes dropped EXE
          PID:2480
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
        3⤵
          PID:2932
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 211510HP-TRGT23274RV
            4⤵
            • Executes dropped EXE
            PID:2936
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
          3⤵
            PID:2224
            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 811510HP-TRGT23274SG
              4⤵
              • Executes dropped EXE
              PID:960
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
            3⤵
              PID:1080
              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                4⤵
                • Executes dropped EXE
                PID:2152
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
              3⤵
                PID:1724
                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 511510HP-TRGT23274SL
                  4⤵
                  • Executes dropped EXE
                  PID:2904
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                3⤵
                  PID:612
                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 411513HP-TRGT1254FA
                    4⤵
                    • Executes dropped EXE
                    PID:1344
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                  3⤵
                    PID:1196
                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 611513HP-TRGT1254FU
                      4⤵
                      • Executes dropped EXE
                      PID:2104
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                    3⤵
                      PID:2028
                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 311513HP-TRGT1254DQ
                        4⤵
                        • Executes dropped EXE
                        PID:2320
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                      3⤵
                        PID:2000
                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 711513HP-TRGT1254MST
                          4⤵
                          • Executes dropped EXE
                          PID:2016
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                        3⤵
                          PID:356
                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                            4⤵
                            • Executes dropped EXE
                            PID:1636
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                          3⤵
                            PID:1632
                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 11529HP-TRGT22228AB
                              4⤵
                              • Executes dropped EXE
                              PID:2108
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                            3⤵
                              PID:2464
                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 211529HP-TRGT22228RV
                                4⤵
                                • Executes dropped EXE
                                PID:768
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                              3⤵
                                PID:1156
                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 811529HP-TRGT22228SG
                                  4⤵
                                  • Executes dropped EXE
                                  PID:2052
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                3⤵
                                  PID:2552
                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                    4⤵
                                    • Executes dropped EXE
                                    PID:1748
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                  3⤵
                                    PID:600
                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 511529HP-TRGT22228SL
                                      4⤵
                                      • Executes dropped EXE
                                      PID:2424
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                    3⤵
                                      PID:2508
                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 411529HP-TRGT22228FA
                                        4⤵
                                        • Executes dropped EXE
                                        PID:2692
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                      3⤵
                                        PID:2440
                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 611529HP-TRGT22228FU
                                          4⤵
                                          • Executes dropped EXE
                                          PID:1644
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                        3⤵
                                          PID:564
                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 311529HP-TRGT22228DQ
                                            4⤵
                                            • Executes dropped EXE
                                            PID:2188
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                          3⤵
                                            PID:1576
                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 711529HP-TRGT22228MST
                                              4⤵
                                              • Executes dropped EXE
                                              PID:344
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                            3⤵
                                              PID:1704
                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                4⤵
                                                • Executes dropped EXE
                                                PID:1740
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                                              3⤵
                                                PID:2656
                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 11546HP-TRGT10434AB
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:2728
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                                                3⤵
                                                  PID:3036
                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 211546HP-TRGT10434RV
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:1676
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                                                  3⤵
                                                    PID:2748
                                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 811546HP-TRGT10434SG
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:1256
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                    3⤵
                                                      PID:2284
                                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:1036
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                                      3⤵
                                                        PID:1808
                                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 511546HP-TRGT10434SL
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:1288
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                                        3⤵
                                                          PID:1764
                                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 411546HP-TRGT10434FA
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:1316
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                                          3⤵
                                                            PID:2368
                                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 611546HP-TRGT10434FU
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:1708
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                                            3⤵
                                                              PID:2844
                                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 311546HP-TRGT10434DQ
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:2092
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                                              3⤵
                                                                PID:1300
                                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 711546HP-TRGT10434MST
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:1968
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                3⤵
                                                                  PID:2676
                                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:2704
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: 3BH7-MLGV
                                                                  3⤵
                                                                    PID:3056
                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: 3BH7-MLGV
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:2672
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: DVTU-3KOV
                                                                    3⤵
                                                                      PID:2192
                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: DVTU-3KOV
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:2312
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 7NGV-SH7F
                                                                      3⤵
                                                                        PID:2480
                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 7NGV-SH7F
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:2936
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: 6MS4-STV1
                                                                        3⤵
                                                                          PID:960
                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: 6MS4-STV1
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:2208
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: BLFN-KPI4
                                                                          3⤵
                                                                            PID:2232
                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: BLFN-KPI4
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              PID:1408
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: H2M5-ZZVR
                                                                            3⤵
                                                                              PID:1280
                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: H2M5-ZZVR
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:1592
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: E2DC-FCEZ
                                                                              3⤵
                                                                                PID:2028
                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: E2DC-FCEZ
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2000
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: P548-HURT
                                                                                3⤵
                                                                                  PID:1636
                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: P548-HURT
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1292
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: G4UK-786N
                                                                                  3⤵
                                                                                    PID:1248
                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: G4UK-786N
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1320
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: SF1D-3MP2
                                                                                    3⤵
                                                                                      PID:1028
                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: SF1D-3MP2
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1536
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: 09DD-NM1Z
                                                                                      3⤵
                                                                                        PID:2652
                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: 09DD-NM1Z
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:2280
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: S09R-451T
                                                                                        3⤵
                                                                                          PID:552
                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: S09R-451T
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:804
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: 0Z00-AKPG
                                                                                          3⤵
                                                                                            PID:3012
                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: 0Z00-AKPG
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:884
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: IIUG-GHS0
                                                                                            3⤵
                                                                                              PID:1632
                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: IIUG-GHS0
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:1060
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: T6CS-KSB8
                                                                                              3⤵
                                                                                                PID:2956
                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: T6CS-KSB8
                                                                                                  4⤵
                                                                                                    PID:896
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: EJZS-4THR
                                                                                                  3⤵
                                                                                                    PID:716
                                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: EJZS-4THR
                                                                                                      4⤵
                                                                                                        PID:344
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: 5A81-GNA5
                                                                                                      3⤵
                                                                                                        PID:2548
                                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: 5A81-GNA5
                                                                                                          4⤵
                                                                                                            PID:2552
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: 988G-378J
                                                                                                          3⤵
                                                                                                            PID:3032
                                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: 988G-378J
                                                                                                              4⤵
                                                                                                                PID:1580
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 0FB3-DH04
                                                                                                              3⤵
                                                                                                                PID:2576
                                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 0FB3-DH04
                                                                                                                  4⤵
                                                                                                                    PID:2516
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: KIU6-0HVG
                                                                                                                  3⤵
                                                                                                                    PID:2096
                                                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: KIU6-0HVG
                                                                                                                      4⤵
                                                                                                                        PID:2688
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: 7AVN-V29N
                                                                                                                      3⤵
                                                                                                                        PID:2416
                                                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: 7AVN-V29N
                                                                                                                          4⤵
                                                                                                                            PID:3040
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: 1VK0-TKM9
                                                                                                                          3⤵
                                                                                                                            PID:1692
                                                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: 1VK0-TKM9
                                                                                                                              4⤵
                                                                                                                                PID:2580
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: SVM9-29AB
                                                                                                                              3⤵
                                                                                                                                PID:1676
                                                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: SVM9-29AB
                                                                                                                                  4⤵
                                                                                                                                    PID:1816
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                  3⤵
                                                                                                                                    PID:3016
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.chm
                                                                                                                                    3⤵
                                                                                                                                      PID:1952
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                      3⤵
                                                                                                                                        PID:1480
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys
                                                                                                                                        3⤵
                                                                                                                                          PID:2720
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                          3⤵
                                                                                                                                            PID:1256
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:2816
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                              3⤵
                                                                                                                                                PID:2160
                                                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                                                            C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
                                                                                                                                            1⤵
                                                                                                                                              PID:2076
                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe "1071802169421404681841957323-97499149816736064241594287287-84330737-1418839575"
                                                                                                                                              1⤵
                                                                                                                                                PID:2472
                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe "20768878132002407247729933073-1728424535835345264270184005-696546393422996410"
                                                                                                                                                1⤵
                                                                                                                                                  PID:2224
                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "-114444260-1693906546-492528373-1359524320-247058113-1348423669848194111-1920129116"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:356
                                                                                                                                                  • C:\Windows\system32\conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe "-1549784662393080097-11522271231133141979-1022699870-1907364157799937651860116760"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:1156
                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                      \??\C:\Windows\system32\conhost.exe "725517741-1827710946-1206258432-126353503755112784211384249920927549-1305849333"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2508
                                                                                                                                                      • C:\Windows\system32\conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe "3272842821285305883-1634573877-20710430582052703340-927318300-1213300878124737789"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3036

                                                                                                                                                        Network

                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          43b37d0f48bad1537a4de59ffda50ffe

                                                                                                                                                          SHA1

                                                                                                                                                          48ca09a0ed8533bf462a56c43b8db6e7b6c6ffa8

                                                                                                                                                          SHA256

                                                                                                                                                          fc258dfb3e49be04041ac24540ef544192c2e57300186f777f301d586f900288

                                                                                                                                                          SHA512

                                                                                                                                                          cfb1d98328aed36d2fe9df008a95c489192f01d4bb20de329e69e0386129aff4634e6fd63a8d49e14fc96da75c9b5ed3a218425846907d0122267d50fc8d7a82

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          250e75ba9aac6e2e9349bdebc5ef104e

                                                                                                                                                          SHA1

                                                                                                                                                          7efdaef5ec1752e7e29d8cc4641615d14ac1855f

                                                                                                                                                          SHA256

                                                                                                                                                          7d50c4fdcf6d8716c7d0d39517d479b3eeee02d2020ed635327405ae49c42516

                                                                                                                                                          SHA512

                                                                                                                                                          7f0d7d41c9eafcd65daa674b5182cf52e11aa0f6d6baaee74fe4c4ffc08a163277c4981cd123af0cb1857ae6fd223b5e8c676d9dc5c646a870fbd9bc4001c438

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                                          Filesize

                                                                                                                                                          165KB

                                                                                                                                                          MD5

                                                                                                                                                          81a45f1a91448313b76d2e6d5308aa7a

                                                                                                                                                          SHA1

                                                                                                                                                          0d615343d5de03da03bce52e11b233093b404083

                                                                                                                                                          SHA256

                                                                                                                                                          fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd

                                                                                                                                                          SHA512

                                                                                                                                                          675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                                          Filesize

                                                                                                                                                          18KB

                                                                                                                                                          MD5

                                                                                                                                                          785045f8b25cd2e937ddc6b09debe01a

                                                                                                                                                          SHA1

                                                                                                                                                          029c678674f482ababe8bbfdb93152392457109d

                                                                                                                                                          SHA256

                                                                                                                                                          37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

                                                                                                                                                          SHA512

                                                                                                                                                          40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
                                                                                                                                                          Filesize

                                                                                                                                                          2.9MB

                                                                                                                                                          MD5

                                                                                                                                                          507acc8f3249adef7468989fee931211

                                                                                                                                                          SHA1

                                                                                                                                                          4d66286973a21e76b0e2c746bac00fa28d446ca9

                                                                                                                                                          SHA256

                                                                                                                                                          6abb77dce6d4af42005e673cb089b6d41e0ef0b88a6411f4d5dfd8e8b4858154

                                                                                                                                                          SHA512

                                                                                                                                                          2faee963523b401bf1e588c86bfeef899067456f22848d299525acde5d2ce28a66f769d741deea2e6b218b4e1b0c0f7f4cc08cfc1c2fd8eac5375b3c183b7ee3

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\sWsmPty.exe
                                                                                                                                                          Filesize

                                                                                                                                                          328KB

                                                                                                                                                          MD5

                                                                                                                                                          ea6989e3a607d753377b05bae55140d8

                                                                                                                                                          SHA1

                                                                                                                                                          5c67ca11e96875c9beb0d320170e000698a65148

                                                                                                                                                          SHA256

                                                                                                                                                          9e857e6656ff0d6da789faa05f9fb49c323bdcea03b0b7887bbac919122f32fb

                                                                                                                                                          SHA512

                                                                                                                                                          80b021d768456c797e8ff1e44f6e1c4699705917cb4b735d1286e470251c279cf4273fc0ff8360e77142bdec02e5213aa251a0cedfbb1bc315810ea89f32e1c2

                                                                                                                                                          Download Submit

                                                                                                                                                        • \ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                                          Filesize

                                                                                                                                                          452KB

                                                                                                                                                          MD5

                                                                                                                                                          c4d09d3b3516550ad2ded3b09e28c10c

                                                                                                                                                          SHA1

                                                                                                                                                          7a5e77bb9ba74cf57cb1d119325b0b7f64199824

                                                                                                                                                          SHA256

                                                                                                                                                          66433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3

                                                                                                                                                          SHA512

                                                                                                                                                          2e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2

                                                                                                                                                          Download Submit

                                                                                                                                                        • \ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                                          Filesize

                                                                                                                                                          162KB

                                                                                                                                                          MD5

                                                                                                                                                          33d7a84f8ef67fd005f37142232ae97e

                                                                                                                                                          SHA1

                                                                                                                                                          1f560717d8038221c9b161716affb7cd6b14056e

                                                                                                                                                          SHA256

                                                                                                                                                          a1be60039f125080560edf1eebee5b6d9e2d6039f5f5ac478e6273e05edadb4b

                                                                                                                                                          SHA512

                                                                                                                                                          c059db769b9d8a9f1726709c9ad71e565b8081a879b55d0f906d6927409166e1d5716c784146feba41114a2cf44ee90cf2e0891831245752238f20c41590b3f5

                                                                                                                                                          Download Submit

                                                                                                                                                        • \Users\Admin\AppData\Roaming\HpsrSpoof.exe
                                                                                                                                                          Filesize

                                                                                                                                                          905KB

                                                                                                                                                          MD5

                                                                                                                                                          dd1313842898ffaf72d79df643637ded

                                                                                                                                                          SHA1

                                                                                                                                                          93a34cb05fdf76869769af09a22711deea44ed28

                                                                                                                                                          SHA256

                                                                                                                                                          81b27a565d2eb4701c404e03398a4bca48480e592460121bf8ec62c5f4b061df

                                                                                                                                                          SHA512

                                                                                                                                                          db8cdcbfca205e64f1838fc28ea98107c854a4f31f617914e45c25d37da731b876afc36f816a78839d7b48b3c2b90f81856c821818f27239a504ab4253fe28f9

                                                                                                                                                          Download Submit

                                                                                                                                                        • memory/2264-77-0x0000000000400000-0x0000000000B78000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          7.5MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2264-25-0x0000000000400000-0x0000000000B78000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          7.5MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2264-26-0x0000000000400000-0x0000000000B78000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          7.5MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2264-21-0x0000000000400000-0x0000000000B78000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          7.5MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2380-0-0x000007FEF5C83000-0x000007FEF5C84000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2380-27-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          9.9MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2380-5-0x00000000003E0000-0x00000000003E6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          24KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2380-4-0x000000001B780000-0x000000001BBDC000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4.4MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2380-3-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          9.9MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2380-2-0x00000000003D0000-0x00000000003D6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          24KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2380-1-0x0000000001090000-0x000000000150A000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4.5MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2520-17-0x0000000001360000-0x00000000015C4000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          2.4MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2520-147-0x0000000001360000-0x00000000015C4000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          2.4MB

                                                                                                                                                          Download