Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

SyncSpoofer.exe

windows7-x64

10

SyncSpoofer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/10/2024, 22:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SyncSpoofer.exe

  • Size

    4.5MB

  • MD5

    a83ef3022abbf90408e3d524f1aa7a8b

  • SHA1

    d871478b0d72d51ab3d3325bf45688a9c0c5efd5

  • SHA256

    24d5a4217ca7cbac8b0d33663c7eac767c0248ed2e83c42ac242fd7b9007d42f

  • SHA512

    361cce9ad65fd939a3e78d150931dd468ddacba99b5ba148ba3799ceb2b2ec00904a769601d076d81218d4b732cd82210f88a714418261ad2edce02619ff3293

  • SSDEEP

    98304:uEnVwl1p8jfC2ajXVRONMJ/A2CQsHXst4R6D:12v8ja1WNMhA1Cd

Score
10/10
stealcsoftdefense_evasiondiscoveryevasionpersistencestealerthemidatrojan

Malware Config

Extracted

Family

stealc

Botnet

soft

C2

http://193.233.112.44

Attributes
  • url_path

    /383ccd496f3c5eee.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Detected Nirsoft tools 2 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 7 IoCs
  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 30 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Maps connected drives based on registry 3 TTPs 30 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 60 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: LoadsDriver 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\SyncSpoofer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Roaming\sWsmPty.exe
      "C:\Users\Admin\AppData\Roaming\sWsmPty.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2288
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 892
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2684
    • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
      "C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2300
    • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe
      "C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: VOSF-GPOT
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2592
        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
          C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: VOSF-GPOT
          4⤵
          • Executes dropped EXE
          PID:2700
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Disk.bat
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2812
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1776
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk drive*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1716
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "C:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2420
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "D:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2780
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "E:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1668
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "F:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:108
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "G:\"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:400
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:992
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "disk"
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2564
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "Disk&*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2776
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SWD\WPDBUSENUM*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1496
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "USBSTOR*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1144
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "SCSI\Disk*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2680
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "STORAGE*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2004
        • C:\ProgramData\Microsoft\Windows\DevManView.exe
          C:\\ProgramData\\Microsoft\\Windows\\DevManView.exe /uninstall "WAN Miniport*" /use_wildcard""
          4⤵
          • Executes dropped EXE
          • Enumerates connected drives
          • Maps connected drives based on registry
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1828
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
        3⤵
        • Loads dropped DLL
        PID:1732
        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 22387HP-TRGT21758AB
          4⤵
          • Executes dropped EXE
          PID:2960
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
        3⤵
          PID:1076
          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 222390HP-TRGT32506RV
            4⤵
            • Executes dropped EXE
            PID:3024
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
          3⤵
            PID:2556
            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 822390HP-TRGT32506SG
              4⤵
              • Executes dropped EXE
              PID:3020
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
            3⤵
              PID:276
              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                4⤵
                • Executes dropped EXE
                PID:1536
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
              3⤵
                PID:960
                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 522390HP-TRGT32506SL
                  4⤵
                  • Executes dropped EXE
                  PID:1300
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                3⤵
                  PID:1956
                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 422390HP-TRGT32506FA
                    4⤵
                    • Executes dropped EXE
                    PID:552
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                  3⤵
                    PID:696
                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 622390HP-TRGT32506FU
                      4⤵
                      • Executes dropped EXE
                      PID:2244
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                    3⤵
                      PID:736
                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 322390HP-TRGT32506DQ
                        4⤵
                        • Executes dropped EXE
                        PID:1788
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                      3⤵
                        PID:1504
                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 722390HP-TRGT32506MST
                          4⤵
                          • Executes dropped EXE
                          PID:2436
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                        3⤵
                          PID:1844
                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                            4⤵
                            • Executes dropped EXE
                            PID:1568
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                          3⤵
                            PID:1524
                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 22406HP-TRGT20712AB
                              4⤵
                              • Executes dropped EXE
                              PID:1048
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                            3⤵
                              PID:2448
                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 222406HP-TRGT20712RV
                                4⤵
                                • Executes dropped EXE
                                PID:1416
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                              3⤵
                                PID:2816
                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 822406HP-TRGT20712SG
                                  4⤵
                                  • Executes dropped EXE
                                  PID:1544
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                3⤵
                                  PID:2100
                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                    4⤵
                                    • Executes dropped EXE
                                    PID:1324
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                  3⤵
                                    PID:1724
                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 522406HP-TRGT20712SL
                                      4⤵
                                      • Executes dropped EXE
                                      PID:320
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                    3⤵
                                      PID:1908
                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 422406HP-TRGT20712FA
                                        4⤵
                                        • Executes dropped EXE
                                        PID:1700
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                      3⤵
                                        PID:888
                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 622406HP-TRGT20712FU
                                          4⤵
                                          • Executes dropped EXE
                                          PID:3040
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                        3⤵
                                          PID:1592
                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 322406HP-TRGT20712DQ
                                            4⤵
                                            • Executes dropped EXE
                                            PID:2500
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                          3⤵
                                            PID:2376
                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 722406HP-TRGT20712MST
                                              4⤵
                                              • Executes dropped EXE
                                              PID:2864
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                            3⤵
                                              PID:1796
                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                4⤵
                                                • Executes dropped EXE
                                                PID:2668
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS %RANDOM%HP-TRGT%RANDOM%AB
                                              3⤵
                                                PID:2304
                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SS 22423HP-TRGT8918AB
                                                  4⤵
                                                  • Executes dropped EXE
                                                  PID:2132
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 2%RANDOM%HP-TRGT%RANDOM%RV
                                                3⤵
                                                  PID:2884
                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SV 222423HP-TRGT8918RV
                                                    4⤵
                                                    • Executes dropped EXE
                                                    PID:304
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 8%RANDOM%HP-TRGT%RANDOM%SG
                                                  3⤵
                                                    PID:2576
                                                    • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                      C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 822423HP-TRGT8918SG
                                                      4⤵
                                                      • Executes dropped EXE
                                                      PID:2756
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                    3⤵
                                                      PID:2748
                                                      • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                        C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SU auto
                                                        4⤵
                                                        • Executes dropped EXE
                                                        PID:1020
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 5%RANDOM%HP-TRGT%RANDOM%SL
                                                      3⤵
                                                        PID:2648
                                                        • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                          C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SK 522423HP-TRGT8918SL
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:1716
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 4%RANDOM%HP-TRGT%RANDOM%FA
                                                        3⤵
                                                          PID:2768
                                                          • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                            C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BM 422423HP-TRGT8918FA
                                                            4⤵
                                                            • Executes dropped EXE
                                                            PID:2772
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 6%RANDOM%HP-TRGT%RANDOM%FU
                                                          3⤵
                                                            PID:2636
                                                            • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                              C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BS 622423HP-TRGT8918FU
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:2184
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 3%RANDOM%HP-TRGT%RANDOM%DQ
                                                            3⤵
                                                              PID:2028
                                                              • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /BV 322426HP-TRGT19667DQ
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:1056
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 7%RANDOM%HP-TRGT%RANDOM%MST
                                                              3⤵
                                                                PID:2672
                                                                • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                  C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /PSN 722423HP-TRGT8918MST
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:2420
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                3⤵
                                                                  PID:1668
                                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                    C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe /SM HOPESA-RSPPOF
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:2452
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: G6BH-VZ81
                                                                  3⤵
                                                                    PID:2776
                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe a: G6BH-VZ81
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      PID:1812
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: NH7F-MKDP
                                                                    3⤵
                                                                      PID:1928
                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe b: NH7F-MKDP
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:3016
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 9G57-6UNI
                                                                      3⤵
                                                                        PID:1104
                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe c: 9G57-6UNI
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          PID:796
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: A7OL-A6F7
                                                                        3⤵
                                                                          PID:1080
                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe d: A7OL-A6F7
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:1540
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: DMMV-H3E4
                                                                          3⤵
                                                                            PID:2068
                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe e: DMMV-H3E4
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              PID:1692
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: AEFI-HGTF
                                                                            3⤵
                                                                              PID:1832
                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe f: AEFI-HGTF
                                                                                4⤵
                                                                                • Executes dropped EXE
                                                                                PID:856
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: N58F-O1L7
                                                                              3⤵
                                                                                PID:1292
                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe g: N58F-O1L7
                                                                                  4⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:1356
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: LJ5I-OD57
                                                                                3⤵
                                                                                  PID:2004
                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                    C:\ProgramData\Microsoft\Windows\Volumeid64.exe h: LJ5I-OD57
                                                                                    4⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:908
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: ACD1-5PRJ
                                                                                  3⤵
                                                                                    PID:1388
                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe i: ACD1-5PRJ
                                                                                      4⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1096
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: 41F1-R594
                                                                                    3⤵
                                                                                      PID:852
                                                                                      • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                        C:\ProgramData\Microsoft\Windows\Volumeid64.exe j: 41F1-R594
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:2372
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: O2VC-DM7K
                                                                                      3⤵
                                                                                        PID:1484
                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe k: O2VC-DM7K
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          PID:1620
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: IFNA-7SVB
                                                                                        3⤵
                                                                                          PID:1048
                                                                                          • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                            C:\ProgramData\Microsoft\Windows\Volumeid64.exe l: IFNA-7SVB
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:2724
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: ZK01-0H36
                                                                                          3⤵
                                                                                            PID:1628
                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe m: ZK01-0H36
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1888
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: Z58A-SKKH
                                                                                            3⤵
                                                                                              PID:3000
                                                                                              • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                C:\ProgramData\Microsoft\Windows\Volumeid64.exe n: Z58A-SKKH
                                                                                                4⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2736
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: 091C-MK19
                                                                                              3⤵
                                                                                                PID:1548
                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe o: 091C-MK19
                                                                                                  4⤵
                                                                                                    PID:2864
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: RUU7-OUK0
                                                                                                  3⤵
                                                                                                    PID:2344
                                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe p: RUU7-OUK0
                                                                                                      4⤵
                                                                                                        PID:1324
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: JFJA-V23B
                                                                                                      3⤵
                                                                                                        PID:2552
                                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe r: JFJA-V23B
                                                                                                          4⤵
                                                                                                            PID:3004
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: R05S-1R0U
                                                                                                          3⤵
                                                                                                            PID:1684
                                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe s: R05S-1R0U
                                                                                                              4⤵
                                                                                                                PID:2172
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 4NFP-B42G
                                                                                                              3⤵
                                                                                                                PID:2176
                                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe t: 4NFP-B42G
                                                                                                                  4⤵
                                                                                                                    PID:2492
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: STKI-E9J7
                                                                                                                  3⤵
                                                                                                                    PID:2572
                                                                                                                    • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                      C:\ProgramData\Microsoft\Windows\Volumeid64.exe u: STKI-E9J7
                                                                                                                      4⤵
                                                                                                                        PID:1380
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: AIVH-UEL1
                                                                                                                      3⤵
                                                                                                                        PID:2132
                                                                                                                        • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                          C:\ProgramData\Microsoft\Windows\Volumeid64.exe v: AIVH-UEL1
                                                                                                                          4⤵
                                                                                                                            PID:3052
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: O5OP-H114
                                                                                                                          3⤵
                                                                                                                            PID:1236
                                                                                                                            • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                              C:\ProgramData\Microsoft\Windows\Volumeid64.exe y: O5OP-H114
                                                                                                                              4⤵
                                                                                                                                PID:2620
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /C C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: CN8M-5Z5H
                                                                                                                              3⤵
                                                                                                                                PID:2564
                                                                                                                                • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                  C:\ProgramData\Microsoft\Windows\Volumeid64.exe z: CN8M-5Z5H
                                                                                                                                  4⤵
                                                                                                                                    PID:2804
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                  3⤵
                                                                                                                                    PID:2944
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.chm
                                                                                                                                    3⤵
                                                                                                                                      PID:2628
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                      3⤵
                                                                                                                                        PID:1780
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amide.sys
                                                                                                                                        3⤵
                                                                                                                                          PID:2848
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                          3⤵
                                                                                                                                            PID:2008
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                            3⤵
                                                                                                                                              PID:2184
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /C del C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                              3⤵
                                                                                                                                                PID:400
                                                                                                                                          • C:\Windows\system32\conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe "4204608818145868441273175203-1735673607299307674-945268236915844346428551079"
                                                                                                                                            1⤵
                                                                                                                                              PID:1300
                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-1740506396654872356-564878621263311533-86255898-274822353-418091475443051176"
                                                                                                                                              1⤵
                                                                                                                                                PID:2244
                                                                                                                                              • C:\Windows\system32\conhost.exe
                                                                                                                                                \??\C:\Windows\system32\conhost.exe "238435102796599919-129447556619433180185855743501498907089-34834574724725448"
                                                                                                                                                1⤵
                                                                                                                                                  PID:2436
                                                                                                                                                • C:\Windows\system32\conhost.exe
                                                                                                                                                  \??\C:\Windows\system32\conhost.exe "1129313511324552068-2102506460-1913559071-2011979772-927307690-1458128431913095438"
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1700

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\AMIDEWINx64.exe
                                                                                                                                                    Filesize

                                                                                                                                                    452KB

                                                                                                                                                    MD5

                                                                                                                                                    c4d09d3b3516550ad2ded3b09e28c10c

                                                                                                                                                    SHA1

                                                                                                                                                    7a5e77bb9ba74cf57cb1d119325b0b7f64199824

                                                                                                                                                    SHA256

                                                                                                                                                    66433a06884f28fdabb85a73c682d1587767e1dfa116907559ec00ed8d0919d3

                                                                                                                                                    SHA512

                                                                                                                                                    2e7800aae592d38c4a6c854b11d0883de70f938b29d78e257ab47a8a2bbf09121145d0a9aea9b56c16e18cde31b693d31d7ebfcd0473b7c15df5d7ae6708bbd2

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\DevManView.cfg
                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    43b37d0f48bad1537a4de59ffda50ffe

                                                                                                                                                    SHA1

                                                                                                                                                    48ca09a0ed8533bf462a56c43b8db6e7b6c6ffa8

                                                                                                                                                    SHA256

                                                                                                                                                    fc258dfb3e49be04041ac24540ef544192c2e57300186f777f301d586f900288

                                                                                                                                                    SHA512

                                                                                                                                                    cfb1d98328aed36d2fe9df008a95c489192f01d4bb20de329e69e0386129aff4634e6fd63a8d49e14fc96da75c9b5ed3a218425846907d0122267d50fc8d7a82

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\Disk.bat
                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    250e75ba9aac6e2e9349bdebc5ef104e

                                                                                                                                                    SHA1

                                                                                                                                                    7efdaef5ec1752e7e29d8cc4641615d14ac1855f

                                                                                                                                                    SHA256

                                                                                                                                                    7d50c4fdcf6d8716c7d0d39517d479b3eeee02d2020ed635327405ae49c42516

                                                                                                                                                    SHA512

                                                                                                                                                    7f0d7d41c9eafcd65daa674b5182cf52e11aa0f6d6baaee74fe4c4ffc08a163277c4981cd123af0cb1857ae6fd223b5e8c676d9dc5c646a870fbd9bc4001c438

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\Volumeid64.exe
                                                                                                                                                    Filesize

                                                                                                                                                    165KB

                                                                                                                                                    MD5

                                                                                                                                                    81a45f1a91448313b76d2e6d5308aa7a

                                                                                                                                                    SHA1

                                                                                                                                                    0d615343d5de03da03bce52e11b233093b404083

                                                                                                                                                    SHA256

                                                                                                                                                    fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd

                                                                                                                                                    SHA512

                                                                                                                                                    675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\ProgramData\Microsoft\Windows\amifldrv64.sys
                                                                                                                                                    Filesize

                                                                                                                                                    18KB

                                                                                                                                                    MD5

                                                                                                                                                    785045f8b25cd2e937ddc6b09debe01a

                                                                                                                                                    SHA1

                                                                                                                                                    029c678674f482ababe8bbfdb93152392457109d

                                                                                                                                                    SHA256

                                                                                                                                                    37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

                                                                                                                                                    SHA512

                                                                                                                                                    40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\HpsrSpoof.exe
                                                                                                                                                    Filesize

                                                                                                                                                    905KB

                                                                                                                                                    MD5

                                                                                                                                                    dd1313842898ffaf72d79df643637ded

                                                                                                                                                    SHA1

                                                                                                                                                    93a34cb05fdf76869769af09a22711deea44ed28

                                                                                                                                                    SHA256

                                                                                                                                                    81b27a565d2eb4701c404e03398a4bca48480e592460121bf8ec62c5f4b061df

                                                                                                                                                    SHA512

                                                                                                                                                    db8cdcbfca205e64f1838fc28ea98107c854a4f31f617914e45c25d37da731b876afc36f816a78839d7b48b3c2b90f81856c821818f27239a504ab4253fe28f9

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
                                                                                                                                                    Filesize

                                                                                                                                                    2.9MB

                                                                                                                                                    MD5

                                                                                                                                                    507acc8f3249adef7468989fee931211

                                                                                                                                                    SHA1

                                                                                                                                                    4d66286973a21e76b0e2c746bac00fa28d446ca9

                                                                                                                                                    SHA256

                                                                                                                                                    6abb77dce6d4af42005e673cb089b6d41e0ef0b88a6411f4d5dfd8e8b4858154

                                                                                                                                                    SHA512

                                                                                                                                                    2faee963523b401bf1e588c86bfeef899067456f22848d299525acde5d2ce28a66f769d741deea2e6b218b4e1b0c0f7f4cc08cfc1c2fd8eac5375b3c183b7ee3

                                                                                                                                                    Download Submit

                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\sWsmPty.exe
                                                                                                                                                    Filesize

                                                                                                                                                    328KB

                                                                                                                                                    MD5

                                                                                                                                                    ea6989e3a607d753377b05bae55140d8

                                                                                                                                                    SHA1

                                                                                                                                                    5c67ca11e96875c9beb0d320170e000698a65148

                                                                                                                                                    SHA256

                                                                                                                                                    9e857e6656ff0d6da789faa05f9fb49c323bdcea03b0b7887bbac919122f32fb

                                                                                                                                                    SHA512

                                                                                                                                                    80b021d768456c797e8ff1e44f6e1c4699705917cb4b735d1286e470251c279cf4273fc0ff8360e77142bdec02e5213aa251a0cedfbb1bc315810ea89f32e1c2

                                                                                                                                                    Download Submit

                                                                                                                                                  • \ProgramData\Microsoft\Windows\DevManView.exe
                                                                                                                                                    Filesize

                                                                                                                                                    162KB

                                                                                                                                                    MD5

                                                                                                                                                    33d7a84f8ef67fd005f37142232ae97e

                                                                                                                                                    SHA1

                                                                                                                                                    1f560717d8038221c9b161716affb7cd6b14056e

                                                                                                                                                    SHA256

                                                                                                                                                    a1be60039f125080560edf1eebee5b6d9e2d6039f5f5ac478e6273e05edadb4b

                                                                                                                                                    SHA512

                                                                                                                                                    c059db769b9d8a9f1726709c9ad71e565b8081a879b55d0f906d6927409166e1d5716c784146feba41114a2cf44ee90cf2e0891831245752238f20c41590b3f5

                                                                                                                                                    Download Submit

                                                                                                                                                  • memory/2104-5-0x0000000000560000-0x0000000000566000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    24KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2104-0-0x000007FEF55A3000-0x000007FEF55A4000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2104-1-0x00000000008A0000-0x0000000000D1A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2104-2-0x0000000000550000-0x0000000000556000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    24KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2104-28-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2104-3-0x000007FEF55A0000-0x000007FEF5F8C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    9.9MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2104-4-0x000000001B630000-0x000000001BA8C000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    4.4MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2288-15-0x0000000000FA0000-0x0000000001204000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.4MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2288-141-0x0000000000FA0000-0x0000000001204000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    2.4MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2300-21-0x0000000000400000-0x0000000000B78000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    7.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2300-22-0x0000000077380000-0x0000000077382000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    8KB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2300-77-0x0000000000400000-0x0000000000B78000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    7.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2300-23-0x0000000000400000-0x0000000000B78000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    7.5MB

                                                                                                                                                    Download

                                                                                                                                                  • memory/2300-24-0x0000000000400000-0x0000000000B78000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    7.5MB

                                                                                                                                                    Download