phorphiex | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 19:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe(1).exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

phorphiex discovery evasion execution loader persistence spyware stealer trojan worm

Malware Config

Extracted

Family

phorphiex

185.215.113.66

Attributes

mutex
6246464

Extracted

Family

phorphiex

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LTK4xdKPAgFHPLan8kriAD7eY4heyy73mB

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4BB7ckkaPTyADc8trtuwDoZxywaR4eNL5cDJ3KBjq9GraN4mUFztf7mLS7WgT7Bh7uPqpjvA4ypVwXKCJ1vvLWWAFvSmDoD

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd

Attributes

mutex
l9ll8dd6x
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

sysppvrdnvs.exesysvplervcs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	sysvplervcs.exe

Phorphiex family
phorphiex

Phorphiex payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe	family_phorphiex
\Users\Admin\AppData\Local\Temp\Files\a.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

Earl.pif

description pid process target process

PID 2292 created 1216 2292 Earl.pif Explorer.EXE

description	pid	process	target process
PID 2292 created 1216	2292	Earl.pif	Explorer.EXE

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysvplervcs.exesysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1280 powershell.exe
1608 powershell.exe
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VibeStream.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VibeStream.url	cmd.exe

Executes dropped EXE 10 IoCs

Processes:

newtpp.exesysppvrdnvs.exepeinf.exeVidsUsername.exeEarl.pifEarl.pifa.exesysvplervcs.exetstory.exeExplorer.EXE

pid	process
2704	newtpp.exe
576	sysppvrdnvs.exe
2180	peinf.exe
2156	VidsUsername.exe
2292	Earl.pif
2084	Earl.pif
2300	a.exe
856	sysvplervcs.exe
1020	tstory.exe
1216	Explorer.EXE

Loads dropped DLL 11 IoCs

Processes:

4363463463464363463463463.exe(1).exeVidsUsername.execmd.exeEarl.pifExplorer.EXE

pid	process
2512	4363463463464363463463463.exe(1).exe
2512	4363463463464363463463463.exe(1).exe
2512	4363463463464363463463463.exe(1).exe
2512	4363463463464363463463463.exe(1).exe
2156	VidsUsername.exe
1088	cmd.exe
2292	Earl.pif
2512	4363463463464363463463463.exe(1).exe
2512	4363463463464363463463463.exe(1).exe
2512	4363463463464363463463463.exe(1).exe
1216	Explorer.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 14 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysvplervcs.exesysppvrdnvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysppvrdnvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysvplervcs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysppvrdnvs.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

newtpp.exea.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysppvrdnvs.exe"	newtpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysvplervcs.exe"	a.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

tstory.exe

description	ioc	process
File opened (read-only)	\??\I:	tstory.exe
File opened (read-only)	\??\R:	tstory.exe
File opened (read-only)	\??\X:	tstory.exe
File opened (read-only)	\??\Z:	tstory.exe
File opened (read-only)	\??\P:	tstory.exe
File opened (read-only)	\??\Y:	tstory.exe
File opened (read-only)	\??\E:	tstory.exe
File opened (read-only)	\??\G:	tstory.exe
File opened (read-only)	\??\H:	tstory.exe
File opened (read-only)	\??\J:	tstory.exe
File opened (read-only)	\??\N:	tstory.exe
File opened (read-only)	\??\S:	tstory.exe
File opened (read-only)	\??\T:	tstory.exe
File opened (read-only)	\??\A:	tstory.exe
File opened (read-only)	\??\B:	tstory.exe
File opened (read-only)	\??\L:	tstory.exe
File opened (read-only)	\??\M:	tstory.exe
File opened (read-only)	\??\V:	tstory.exe
File opened (read-only)	\??\W:	tstory.exe
File opened (read-only)	\??\K:	tstory.exe
File opened (read-only)	\??\O:	tstory.exe
File opened (read-only)	\??\Q:	tstory.exe
File opened (read-only)	\??\U:	tstory.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

1312 tasklist.exe
1540 tasklist.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Earl.pif

description pid process target process

PID 2292 set thread context of 2084 2292 Earl.pif Earl.pif

pid	process
1312	tasklist.exe
1540	tasklist.exe

description	pid	process	target process
PID 2292 set thread context of 2084	2292	Earl.pif	Earl.pif

Drops file in Windows directory 6 IoCs

Processes:

VidsUsername.exea.exenewtpp.exe

description	ioc	process
File opened for modification	C:\Windows\DpiRachel	VidsUsername.exe
File opened for modification	C:\Windows\TargetSki	VidsUsername.exe
File created	C:\Windows\sysvplervcs.exe	a.exe
File opened for modification	C:\Windows\sysvplervcs.exe	a.exe
File created	C:\Windows\sysppvrdnvs.exe	newtpp.exe
File opened for modification	C:\Windows\sysppvrdnvs.exe	newtpp.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2860 sc.exe
988 sc.exe
1208 sc.exe
944 sc.exe
1384 sc.exe
1552 sc.exe
1640 sc.exe
1756 sc.exe
1364 sc.exe
2760 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2860	sc.exe
988	sc.exe
1208	sc.exe
944	sc.exe
1384	sc.exe
1552	sc.exe
1640	sc.exe
1756	sc.exe
1364	sc.exe
2760	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

sysppvrdnvs.exesc.exefindstr.execmd.exesc.exea.execmd.exesc.exe4363463463464363463463463.exe(1).exesc.exesysvplervcs.exesc.exesc.exefindstr.exetasklist.exefindstr.exechoice.exeEarl.pifsc.exesc.exesc.execmd.exenewtpp.execmd.execmd.exepowershell.execmd.exepowershell.exeVidsUsername.exetasklist.execmd.exeEarl.pifcmd.exesc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysppvrdnvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe(1).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysvplervcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Earl.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	newtpp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VidsUsername.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Earl.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

powershell.exeEarl.pifpowershell.exe

pid	process
1280	powershell.exe
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
1608	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

tstory.exe

pid process

1020 tstory.exe

pid	process
1020	tstory.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

4363463463464363463463463.exe(1).exepowershell.exetasklist.exetasklist.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2512	4363463463464363463463463.exe(1).exe
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	1312	tasklist.exe
Token: SeDebugPrivilege	1540	tasklist.exe
Token: SeDebugPrivilege	1608	powershell.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Earl.piftstory.exe

pid process

2292 Earl.pif
2292 Earl.pif
2292 Earl.pif
1020 tstory.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Earl.piftstory.exe

pid process

2292 Earl.pif
2292 Earl.pif
2292 Earl.pif
1020 tstory.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

tstory.exe

pid process

1020 tstory.exe

pid	process
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
1020	tstory.exe

pid	process
2292	Earl.pif
2292	Earl.pif
2292	Earl.pif
1020	tstory.exe

pid	process
1020	tstory.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4363463463464363463463463.exe(1).exenewtpp.exesysppvrdnvs.execmd.execmd.exeVidsUsername.execmd.exe

description	pid	process	target process
PID 2512 wrote to memory of 2704	2512	4363463463464363463463463.exe(1).exe	newtpp.exe
PID 2512 wrote to memory of 2704	2512	4363463463464363463463463.exe(1).exe	newtpp.exe
PID 2512 wrote to memory of 2704	2512	4363463463464363463463463.exe(1).exe	newtpp.exe
PID 2512 wrote to memory of 2704	2512	4363463463464363463463463.exe(1).exe	newtpp.exe
PID 2704 wrote to memory of 576	2704	newtpp.exe	sysppvrdnvs.exe
PID 2704 wrote to memory of 576	2704	newtpp.exe	sysppvrdnvs.exe
PID 2704 wrote to memory of 576	2704	newtpp.exe	sysppvrdnvs.exe
PID 2704 wrote to memory of 576	2704	newtpp.exe	sysppvrdnvs.exe
PID 576 wrote to memory of 568	576	sysppvrdnvs.exe	cmd.exe
PID 576 wrote to memory of 568	576	sysppvrdnvs.exe	cmd.exe
PID 576 wrote to memory of 568	576	sysppvrdnvs.exe	cmd.exe
PID 576 wrote to memory of 568	576	sysppvrdnvs.exe	cmd.exe
PID 576 wrote to memory of 1488	576	sysppvrdnvs.exe	cmd.exe
PID 576 wrote to memory of 1488	576	sysppvrdnvs.exe	cmd.exe
PID 576 wrote to memory of 1488	576	sysppvrdnvs.exe	cmd.exe
PID 576 wrote to memory of 1488	576	sysppvrdnvs.exe	cmd.exe
PID 1488 wrote to memory of 1640	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 1640	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 1640	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 1640	1488	cmd.exe	sc.exe
PID 568 wrote to memory of 1280	568	cmd.exe	powershell.exe
PID 568 wrote to memory of 1280	568	cmd.exe	powershell.exe
PID 568 wrote to memory of 1280	568	cmd.exe	powershell.exe
PID 568 wrote to memory of 1280	568	cmd.exe	powershell.exe
PID 1488 wrote to memory of 2760	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 2760	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 2760	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 2760	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 2860	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 2860	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 2860	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 2860	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 1756	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 1756	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 1756	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 1756	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 988	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 988	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 988	1488	cmd.exe	sc.exe
PID 1488 wrote to memory of 988	1488	cmd.exe	sc.exe
PID 2512 wrote to memory of 2180	2512	4363463463464363463463463.exe(1).exe	peinf.exe
PID 2512 wrote to memory of 2180	2512	4363463463464363463463463.exe(1).exe	peinf.exe
PID 2512 wrote to memory of 2180	2512	4363463463464363463463463.exe(1).exe	peinf.exe
PID 2512 wrote to memory of 2180	2512	4363463463464363463463463.exe(1).exe	peinf.exe
PID 2512 wrote to memory of 2156	2512	4363463463464363463463463.exe(1).exe	VidsUsername.exe
PID 2512 wrote to memory of 2156	2512	4363463463464363463463463.exe(1).exe	VidsUsername.exe
PID 2512 wrote to memory of 2156	2512	4363463463464363463463463.exe(1).exe	VidsUsername.exe
PID 2512 wrote to memory of 2156	2512	4363463463464363463463463.exe(1).exe	VidsUsername.exe
PID 2156 wrote to memory of 1088	2156	VidsUsername.exe	cmd.exe
PID 2156 wrote to memory of 1088	2156	VidsUsername.exe	cmd.exe
PID 2156 wrote to memory of 1088	2156	VidsUsername.exe	cmd.exe
PID 2156 wrote to memory of 1088	2156	VidsUsername.exe	cmd.exe
PID 1088 wrote to memory of 1312	1088	cmd.exe	tasklist.exe
PID 1088 wrote to memory of 1312	1088	cmd.exe	tasklist.exe
PID 1088 wrote to memory of 1312	1088	cmd.exe	tasklist.exe
PID 1088 wrote to memory of 1312	1088	cmd.exe	tasklist.exe
PID 1088 wrote to memory of 1244	1088	cmd.exe	findstr.exe
PID 1088 wrote to memory of 1244	1088	cmd.exe	findstr.exe
PID 1088 wrote to memory of 1244	1088	cmd.exe	findstr.exe
PID 1088 wrote to memory of 1244	1088	cmd.exe	findstr.exe
PID 1088 wrote to memory of 1540	1088	cmd.exe	tasklist.exe
PID 1088 wrote to memory of 1540	1088	cmd.exe	tasklist.exe
PID 1088 wrote to memory of 1540	1088	cmd.exe	tasklist.exe
PID 1088 wrote to memory of 1540	1088	cmd.exe	tasklist.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216
- C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(1).exe
  "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe(1).exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\sysppvrdnvs.exe
      C:\Windows\sysppvrdnvs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:576
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:568
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1280
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1488
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1640
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2760
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2860
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1756
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:988
- - C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
    3⤵
    - Executes dropped EXE
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Files\VidsUsername.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\VidsUsername.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c move Recreation Recreation.bat & Recreation.bat
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1312
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1244
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1540
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 195197
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "RESOLVEPHONESBLESSFRANK" Donated
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1536
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Arthritis + ..\Canyon + ..\Knights + ..\Movies + ..\Sequence + ..\Nascar + ..\Solve + ..\Cio + ..\Strategy + ..\Amounts + ..\Hans + ..\America + ..\Provincial + ..\Downtown + ..\Browser + ..\Afford + ..\Info + ..\Ll + ..\Intersection + ..\Rj + ..\Poetry + ..\Reality + ..\Cliff l
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\195197\Earl.pif
        
        Earl.pif l
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\195197\Earl.pif
        
        C:\Users\Admin\AppData\Local\Temp\195197\Earl.pif
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2084
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Files\a.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\a.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:2300
  - - C:\Windows\sysvplervcs.exe
      C:\Windows\sysvplervcs.exe
      4⤵
      Modifies security service
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      System Location Discovery: System Language Discovery
      PID:856
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2904
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
        6⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1364
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1208
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:944
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop DoSvc
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1384
      - C:\Windows\SysWOW64\sc.exe
        
        sc stop BITS /wait
        6⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1552
- - C:\Users\Admin\AppData\Local\Temp\Files\tstory.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\tstory.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1020
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VibeStream.url" & echo URL="C:\Users\Admin\AppData\Local\StreamFlow Dynamics\VibeStream.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VibeStream.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65d5488c9b686298444b09b2c385cfeb

SHA1
2aab8731308b1d7e916ba5fc82f48205a2bb2509

SHA256
a3dfe9baf0d38bf78e2a07ffb753c5d8e5317d3768b638ad80cba7cc250e9932

SHA512
daf480cc73e3039a3775bed36b42791ec11cc23053cf2d42d75b10f57a90c6875878c5e36cf2f64567f2322c7a1a3fdf64f692f221555cdbef265b0a4b52bc70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
235f5895cae3ee6143137f4e6ff804b5

SHA1
30ad338220cf9a3fb1b644965f4c45b8e931a54a

SHA256
e1193e1e63c69e99d762838a0ba77b6d449863fb9724105b8942977da56097b5

SHA512
fc3f149e6cb004180e5e4ff0070ebfe3bf79ba3dd72519e75b00d3c6ebe70a68cf23fb7f8979a6f2d15fc8b9aa9c16101026cf1c99d8576e129e7324cc614228

Download Submit
C:\Users\Admin\AppData\Local\Temp\195197\l

Filesize
1.7MB

MD5
f2ff6600c9909ad0716e570f618a68a7

SHA1
cd4b1382056a697240bb774b8ca762c587206933

SHA256
262159342c92d101cd2a19346f0399e76e83fa12e629d5c836d14200fd791b16

SHA512
126afa416aa92e4634731e592881c29686f3d5e499cdf90b86b6febaaf98612348488f55985c857e416b3f7a2f3e0c7ee4f87d66227abde94f059a86fdec0dcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\970413986.exe

Filesize
108KB

MD5
1fcb78fb6cf9720e9d9494c42142d885

SHA1
fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

SHA256
84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

SHA512
cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Afford

Filesize
88KB

MD5
a96b1b87758a9f43a774614af8911425

SHA1
4f086b3d11f1e78728583cf47896bf0afdc5060c

SHA256
6cbbf062a904c97c883d386e976978e8c7123223048de25d2e9155516d72eefc

SHA512
e902087091b3dce986efbcde6f3f77c2a56d77680dbf2e3d3c67bb1195fd4b4fb2f2b5f9d1c78f52cfc6d1b3e54e5204fa1212e1059864af9fe3e2e28ffbbe25

Download Submit
C:\Users\Admin\AppData\Local\Temp\America

Filesize
68KB

MD5
3030876c831e1198f69f60cd58728f19

SHA1
d1a086eac5de039aa86b85b133485416a2a16933

SHA256
c05d0946d6b82aceafc93c22eba94d7751f46a7e60a9beb854dc0882abc53cb7

SHA512
d8a9d0b79c29e9f54894a7d89bee5451dfc11dce00e53b31715b5f08f231a9fa3eab6daea591804e3bed8de0f07be7a4053a932ce0bf0217048c87b4399a6bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Amounts

Filesize
68KB

MD5
4e75d600bbd0c012f79c30dac8656393

SHA1
757384127b81401ecd28cb1ddfb6146402d9c421

SHA256
77735f7614c6914ba91e8acdf5c36fd61388e38ffc47d86eefec8a76fa30b55a

SHA512
e1ba65a07635b9026f3c43254456ff7d162d54cd83b79e6371cd905e62bab883e37601716f2507e7b6865a05ad79de44ddb79ba8a9f52f6cd8dbe0043c2baedf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Arthritis

Filesize
62KB

MD5
4950f64a5414d85b3ec2cf61045d32ea

SHA1
3ce6e6dcad721886a668536089e10063d98ddbbd

SHA256
691c8c5c152388448790f8c53cc7bd39da0fd8a75d3a9541bd155a845a11458a

SHA512
45febcad334afa94c23b61237f7c987818b3fff212ad504d219f1bdd8f7711146c69f5955c4f6f044f3a140fe992c2d648d9b612a3d4948d97468d58e2cbe9d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Browser

Filesize
57KB

MD5
1befcc21c9801a19b06a70d409a3c4b4

SHA1
f28c600f099bd50f5dfd82afbdb36aa8b47cc875

SHA256
fdb66fb759e79e281afebfea4ad57850be3f2e56833b7c8dbeec200e0231a70d

SHA512
31beff28d6b466c27df7234bc60837070a6f8f592cf4df7c955fba0b91bb1e0e8282010f092de905006866801cad0d9080983ce0d344cf645a20126154bfee83

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8BC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Canyon

Filesize
97KB

MD5
2716136c97efe29a63a9668536c803ac

SHA1
3c626f1e00e0dc9f373d9d2219cff69c8cc78bfa

SHA256
841ad5ea09367ba75aac16299c6787700ceef3b3197b0f282c78f1510d9c34ec

SHA512
fbb3e2d03fd52fb10587386c136a9d95758ef03a619a267606771a501468587d2e6e599d58d1f2df75b0fc7bff744ff948634e323bbbd16b0c4bbff9dadbf370

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cio

Filesize
69KB

MD5
6ad64ed1496ab23636bdbb07358dff07

SHA1
e4a4e74f41feec3940ab548de20d9156c8d56a99

SHA256
c27b5257210d5d66fda64c2004ab5a383ca81e57be7bb994182e39035ea7822f

SHA512
15edb503547cb9911f33be66605298699990d64b3cd08950eb78c139f43a4d7cea335dbd14ed450abc0ccf0f8318c32842af01f4bf8cd21f347557397c862bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cliff

Filesize
51KB

MD5
72bac76dede0bd82a01ef0669eef1ff3

SHA1
8087302214c329c4038dbd1c6a14ee5b8616e6bc

SHA256
3446957d810fc7b2228689da61c2b1a134e127cec8a9cef31f1348b11b58e925

SHA512
f5e0e3ac2821efc623d904c7f4d2e5500e2f2d0f05cc9e06779fcc8f81769a3b38a6a3f56493351db426214cd9a891c434c2e2adf944724850f89d364ae74dbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Donated

Filesize
6KB

MD5
f2793c1c3285bdf47757ef67001fa6f8

SHA1
43d00fac0468b64def3710d036cecdc4d139ba5c

SHA256
2dd0bf3e2a623f9a5316d998628729a6666a5bac320d71d19645226e5696bdc2

SHA512
09da22bc228c9fce36270e4f42df3eddbc25dbb1371c4fbc670c3edf4e24d5a7ac5a88227a6db4284925347558cca4c13fd7273716b6defd5704cd8172b9aa96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Downtown

Filesize
97KB

MD5
789d60a6003eefa8c4fbee4412ffc0de

SHA1
305cc72ca3df9f6f23e39334528ebf85c3b956db

SHA256
a8428d072b153983e0ee6666bf916f99411e8c5c33e5c0eec82099ba34ae993a

SHA512
6991fb99c1a472941b3cd6e6f12dd61a29bbbce76bda2537e99f625bd61f1e3e125410378e7a1a3b4943de0b32c0838c5f9b9fec0e0d24f2eb9ce58cce6fafd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Enemy

Filesize
866KB

MD5
694060104edde6bc9a90326300db8f7b

SHA1
c1dfa0d1e85522cd4fa6d09be36a759efdeb5c7e

SHA256
8f1a4b44c2c59f6ae167c0384b8f2e7867118d0f293c4e39f103665bf8bda415

SHA512
ed980c431b4836f88a7f20cbe1b61b888d56674deaf602f7f253276730ef81b2f7b48f066923eb502f80da2123c11255be56bad7bbe9ceb10e63a3f130957799

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\VidsUsername.exe

Filesize
2.5MB

MD5
081c87c612e074a69ed34d7102543bbc

SHA1
ab54e6cae05b483b89badd3f11e72efdbf229771

SHA256
2808948b635ccf20d4bf679457e45bfe21a783ec99e095e55382bede47f6579f

SHA512
caeca5e66b0f11d46f2b83ad2c56f20f95aaf8ba1f1e7c235dcc39361a6d9dfce838231617fb23f653711e3dcfcd5ec073d9922553f9f42a8242c58d0161b23d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\newtpp.exe

Filesize
83KB

MD5
06560b5e92d704395bc6dae58bc7e794

SHA1
fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

SHA256
9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

SHA512
b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe

Filesize
20KB

MD5
c2159769dc80fa8b846eca574022b938

SHA1
222a44b40124650e57a2002cd640f98ea8cb129d

SHA256
d9cb527841e98bb1a50de5cf1c5433a05f14572a3af3be4c10d3a4708d2419e0

SHA512
7a8b4f0b5c020277b4446e4ff2223de413bd6be4c7dad3179f988cb5d3849435a85acfbda7d41d3ef15d22554cd722a8b657d978426b79dc1495a81ab270e870

Download Submit
C:\Users\Admin\AppData\Local\Temp\Hans

Filesize
60KB

MD5
273b13b1fc944a193d570d6b74488580

SHA1
cf378ba2c9537423994faa5ba9d1912aa22e11f3

SHA256
57592663c0bb30deccd5b53668866ebc3eceecc6c11ca0fe6ecc2cf9b6e06320

SHA512
6baa0b9264240bab707e0b24f62a31621fb26c69b0cc264351c02d791d8492d2caf1db702eb4c3080bd781881caf7c626e917dd755cc880d22b616462113fdfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Info

Filesize
80KB

MD5
d1d5f516bc8d3a7a059a06e1aafcb4a2

SHA1
434230fa8c10ccc6a67cd56b0c0f4255457a4ae0

SHA256
7f2957735b118b5063d0499c0caa77c6cdb71c65b94822006b73ce87e255fb77

SHA512
4453c8c164d70071cc123db2eef7869821361161e7fb4c7d21e6b2025ca05b079e73ddd2157bd81aee1b671227b2f59fd35e351dd3d5543262cfd0f64892ebff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Intersection

Filesize
91KB

MD5
4e1622b490d653ba5094673c3dd8ebe3

SHA1
2c73522f0ca9caa089527f8faf1e8179bdb0ba4d

SHA256
8a928aa1da2d4e18cdb87573652223b25e5e909c0d0632e67abf82a58ee717e3

SHA512
063b9f9a187602965afb407d247c9f74ce00bd94e98c8e45970975a370b37e6ad641cd00536bf02f9c7bc48237aa102c750334d7f9f646d0212b436054d336d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Knights

Filesize
82KB

MD5
a03534b304f36e5956d00d6b86d27020

SHA1
09cd1b4f052fabd5194b76f59970e861875a3de7

SHA256
a93c3be5b67a44e403ed9c1b31d9168ed702bec23b0b028de98bfbfefa6ed3e9

SHA512
4848c416d95e3b0f525564ac061fa7d75032511a4b65480052de7bc42d0d78e5feed246630853f408bddf6953a79f55010f07dae4fa99e8aea544792cd6905b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ll

Filesize
76KB

MD5
ca65e5e8056d353213efa898c47d2c48

SHA1
3c00d54334bb78fef02673ae22a9ded13336fcb7

SHA256
dbf095857c5905da943c7b7c265a252f4821edf25b9739f068f24f75e0bfa460

SHA512
677289e9eabd2947a979894a2fc132f555808d227f497fe0a3de8e219cd6ac64ff11f4c19765c54fc087ec0b29474d25c011b7a380a31d22ad28244ba1c7d384

Download Submit
C:\Users\Admin\AppData\Local\Temp\Movies

Filesize
50KB

MD5
51c289e99fa6459bdf66d92c06b0ff1f

SHA1
be3f73d2fd8d7b0d27e5fe4956d71758413c9dcf

SHA256
60c508408bf966c7a01a2099d31e28180834afca29a18a53ae8f682ca93376f9

SHA512
0dee4c6f0e6371e11e259de1f3e2f7d0cec7e268f251d60f40bf633faa1e9ea888f0023e587454e439a23c30044cf77dbe29ab7606029eb7c590fcc507a45cc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Nascar

Filesize
67KB

MD5
7616a0e18bda4b60b741e02701fe8028

SHA1
24fc2bca0dee1d61da7a2c02ed68c5132d72246d

SHA256
3ee8879a01567abb7eaf89682e2a1cc00d2ce9970bff0bfad44928c371403193

SHA512
695dcf48abe5f431f9f2b6555a614a07430ab83d1a4de6d453e24a29a76ee884edff627281c238b61df6716a2a64b631968bf635fd011a6a1baf1921cdc30137

Download Submit
C:\Users\Admin\AppData\Local\Temp\Poetry

Filesize
85KB

MD5
8e1e704626a31954fb14362a0b852b12

SHA1
4289c43f6e0be875545871de60a1104c1ba227a3

SHA256
a078163291aece061c51fdb331a3c4b015333df14648cdd0c99f5e90e956789f

SHA512
ad60d71778a70cae024181c5d23a0584e9f9e2939370733cd9e7b860a0246c825ebebe8b66f7e13f0569716750aa1eb8290e60fc1fa36d9bcc0ce1ddbf4e0888

Download Submit
C:\Users\Admin\AppData\Local\Temp\Provincial

Filesize
86KB

MD5
306aa5e19e750cfa1d8d28cf00051df2

SHA1
ec2833d14ba593903a445f71a2ffc359ef50500e

SHA256
bcac25ce1e8f31116e842c45a436cb11e47ad491597e184a8d0f3342300ed920

SHA512
ed677ba464b702b13ca23c92c0c3b9a5c78461168d40898597149e5f1c84d663597a5a1254a2de36d72297f86b336bdb14dfb2ac8247c2c7380ca3a9159f2d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Reality

Filesize
56KB

MD5
31515b1312764ce9a7194576a21b42e7

SHA1
5f4953ed917dbf99204a680bbbb0b4a948993a80

SHA256
ea776198630e2451400b02f7e63e850fda3f5c48d5d568a8172fb4ac506b10b0

SHA512
757ba4127ae0009b9f883bcaac1804e0e1d4dcddbb91a8bc6fdaadfcc388d1b42e0a322d877870d75663a63f41434230f690e7fdb947d53cfe4afd6f6a2c8cb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Recreation

Filesize
8KB

MD5
5c2cea571098864ed304e30bae6852bd

SHA1
f7a14f739c53f9bbad5a60e4ea2ad589510e71f8

SHA256
2d023fff6f0ce3c9f87137db7e1ff2ca74db25b0455c660db717ddf29be289a0

SHA512
7bee9dda25684563a5b6ee1e19cb0862d60e235e701101862f1623f198cba321ee19c3cecfe1725a6046f7898b40d4417158596c396bb9231ec4e99b50918870

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rj

Filesize
98KB

MD5
aa1ff0ae3815af86b58ab3d46412ec6d

SHA1
af14fb0bec29936e7ced4337ccc9254c29cdbe63

SHA256
fae8a3729c3513ffe02cd3406108d58648cd9a698b76e12be0d93fb2ceab68f0

SHA512
c6e76603448a06814cd787ef758cbf972b03f1c73f1ab1a58cbb1cee6073c88f6a50ced58abb11cede54521f9a9b079486baf830a8110e261b81ecfd8ede8322

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sequence

Filesize
53KB

MD5
00921eca4c412c8ecc0af60bc9967758

SHA1
dd5ce6f06a33d6747d48db05e21257e4e7ed7d61

SHA256
ad6000d350e743e0f1fb4cad48f4961a05a70e233a89d46d84c1ba8f729331f6

SHA512
1ce7460c9e854b2d78d8730c60d37b17a395c4a38b2df1109968bbeb568414f1c89853fd37186306d9cb8a67b55686569d394524897633b3fb89bde1e47f4e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Solve

Filesize
99KB

MD5
4d674245d1059cb7c9bc65912229548c

SHA1
fab66682e1c4b05838506e59a5b5b676b63cea70

SHA256
d9256b9261a910b20c2ea24535f500a20546bb44b6067165abacebc494e2e06d

SHA512
f0363f63691e2b36e2d0452a40a6e9575757b2d21b7e5a1b440e186b4116b493576131f999b386f241d3a6dea768bb921102f8e53d9e916d3abafbe40b6d0f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Strategy

Filesize
90KB

MD5
9d8229c0f4e4e80867c8cff03c1b0c4c

SHA1
5bc3b27a310fea571309bb3e22ee6eaaebbff41a

SHA256
c2b2f80156a7087c1d24dba1df6ac80a3290478f5bb58a566fa240e7c417eadb

SHA512
bd81adf49398360e681a81d590a1f2972ca06dc64e8ea30b5f8499aadd8b574f1d8ad010924dae13000b7fe67e1758f7ca7e7b3a8649be0a90e0daf23dcb6811

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE8DE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9EOS81UCJN4WUPHQZTH7.temp

Filesize
7KB

MD5
e9eaa37f3e072791fa7acf5616600928

SHA1
8056a4e361bb848e0308e3bf2f2cff1c26fb1b4a

SHA256
0f0d8d0de31d390bdb64e93fc2e77da72f9cf9c68bce10ba8a3f97d314cb72db

SHA512
2af6bb3a89d0dec2a003e8a19c21b617e4f728c98a25f983290670b5474a6396627497fb42626d84fe7dfe1771230ea7df89eb4a971f7c447abd56c166fc4521

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
af8731e5191b2aec0528dd7fe0dcbab6

SHA1
a12735657adc444ad4b09ca9ff9311b9f9a3cff5

SHA256
1b99f5723e3db7811c34eb3dae9a00638c4d9e04588b466ef53a6725d2c98aa5

SHA512
715961d8357a5ec677a65cd664f7e250c4525bb1b0b0747c4740f0da893fcf495ee277dbb1993a495259915c813ac2f60beb3a59fd2bf9a886a337a415aed500

Download Submit
\Users\Admin\AppData\Local\Temp\195197\Earl.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
\Users\Admin\AppData\Local\Temp\Files\a.exe

Filesize
96KB

MD5
930c41bc0c20865af61a95bcf0c3b289

SHA1
cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

SHA256
1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

SHA512
fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

Download Submit
\Users\Admin\AppData\Local\Temp\Files\tstory.exe

Filesize
1.4MB

MD5
2e440604cac15e233d3832e00251592e

SHA1
50df05d9f86c9383ca5e6adef0df4b89089bca04

SHA256
7e57e8caddb50f98bd8b3f17fb9fd21372cc32b0147d5e3853f043745e204a41

SHA512
33a737f4aca31cdfb241948c0af5080105f72506490eba2d6ab75728cffc11eeab4450581dbd52734183b22303392ed4f6272b46b51ff264e49914ad492ba806

Download Submit
memory/2084-165-0x00000000006D0000-0x000000000083A000-memory.dmp

Filesize
1.4MB

Download
memory/2084-186-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/2084-169-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/2084-168-0x00000000006D0000-0x000000000083A000-memory.dmp

Filesize
1.4MB

Download
memory/2084-166-0x00000000006D0000-0x000000000083A000-memory.dmp

Filesize
1.4MB

Download
memory/2512-0-0x000000007426E000-0x000000007426F000-memory.dmp

Filesize
4KB

Download
memory/2512-2-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-76-0x0000000074260000-0x000000007494E000-memory.dmp

Filesize
6.9MB

Download
memory/2512-1-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download