Overview

overview

10

Static

static

3

4363463463...63.exe

windows7-x64

10

4363463463...63.exe

windows10-2004-x64

Resubmissions

10-01-2025 00:42

250110-a2rcwawlcz 8

08-01-2025 13:31

250108-qsdnes1qb1 10

17-12-2024 13:35

241217-qv6rzs1nhp 10

15-11-2024 19:06

241115-xr6q5szdnf 10

14-11-2024 23:35

241114-3lfknavfqg 10

14-11-2024 23:26

241114-3eysnavfje 10

14-11-2024 23:12

241114-26znlavdqq 10

Analysis

  • max time kernel
    137s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-11-2024 19:06

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    4363463463464363463463463.exe

  • Size

    10KB

  • MD5

    2a94f3960c58c6e70826495f76d00b85

  • SHA1

    e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

  • SHA256

    2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

  • SHA512

    fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

  • SSDEEP

    192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score
10/10
lummametasploitphorphiexstealcdefault2qllbackdoorcredential_accessdefense_evasiondiscoveryevasionexecutionloaderpersistencespywarestealertrojanupxworm

Malware Config

Extracted

Family

stealc

Botnet

QLL

C2

http://85.28.47.70

Attributes
  • url_path

    /744f169d372be841.php

Extracted

Family

lumma

C2

https://caffegclasiqwp.shop/api

https://stamppreewntnq.shop/api

https://stagedchheiqwo.shop/api

https://millyscroqwp.shop/api

https://evoliutwoqm.shop/api

https://condedqpwqm.shop/api

https://traineiwnqo.shop/api

https://locatedblsoqp.shop/api

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://91.202.233.141/
Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LTK4xdKPAgFHPLan8kriAD7eY4heyy73mB

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4BB7ckkaPTyADc8trtuwDoZxywaR4eNL5cDJ3KBjq9GraN4mUFztf7mLS7WgT7Bh7uPqpjvA4ypVwXKCJ1vvLWWAFvSmDoD

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3BiS1jaRpWtkqtfZGp9f1rXXts5DyUkaBX

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
Attributes
  • mutex

    0t6rv5xwbh

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

metasploit

Version

metasploit_stager

C2

144.34.162.13:3333

Extracted

Family

stealc

Botnet

default2

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

    trojanbackdoormetasploit
  • Metasploit family
    metasploit
  • Modifies security service 2 TTPs 4 IoCs
    evasion
  • Phorphiex family
    phorphiex
  • Phorphiex payload 4 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Windows security bypass 2 TTPs 24 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 8 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 29 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 28 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 8 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Launches sc.exe 21 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 62 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
    "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\Files\11.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\11.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3992
      • C:\Windows\sysarddrvs.exe
        C:\Windows\sysarddrvs.exe
        3⤵
        • Modifies security service
        • Windows security bypass
        • Checks computer location settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3948
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4216
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1572
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4996
          • C:\Windows\SysWOW64\sc.exe
            sc stop UsoSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4784
          • C:\Windows\SysWOW64\sc.exe
            sc stop WaaSMedicSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3888
          • C:\Windows\SysWOW64\sc.exe
            sc stop wuauserv
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4720
          • C:\Windows\SysWOW64\sc.exe
            sc stop DoSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:8
          • C:\Windows\SysWOW64\sc.exe
            sc stop BITS
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2060
    • C:\Users\Admin\AppData\Local\Temp\Files\Amadeus.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Amadeus.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4988
      • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4488
    • C:\Users\Admin\AppData\Local\Temp\Files\Charter.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Charter.exe"
      2⤵
      • Executes dropped EXE
      PID:4344
    • C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      PID:2904
    • C:\Users\Admin\AppData\Local\Temp\Files\4434.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\4434.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:764
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3032
    • C:\Users\Admin\AppData\Local\Temp\Files\random.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4888
    • C:\Users\Admin\AppData\Local\Temp\Files\o.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\o.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3696
      • C:\Windows\sysklnorbcv.exe
        C:\Windows\sysklnorbcv.exe
        3⤵
        • Modifies security service
        • Windows security bypass
        • Checks computer location settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: SetClipboardViewer
        PID:4288
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:888
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4852
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
          4⤵
          • System Location Discovery: System Language Discovery
          PID:656
          • C:\Windows\SysWOW64\sc.exe
            sc stop UsoSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1396
          • C:\Windows\SysWOW64\sc.exe
            sc stop WaaSMedicSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:2608
          • C:\Windows\SysWOW64\sc.exe
            sc stop wuauserv
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1488
          • C:\Windows\SysWOW64\sc.exe
            sc stop DoSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4528
          • C:\Windows\SysWOW64\sc.exe
            sc stop BITS
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:8
    • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2804
      • C:\Windows\sysppvrdnvs.exe
        C:\Windows\sysppvrdnvs.exe
        3⤵
        • Modifies security service
        • Windows security bypass
        • Checks computer location settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: SetClipboardViewer
        PID:3580
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4932
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1116
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3800
          • C:\Windows\SysWOW64\sc.exe
            sc stop UsoSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1288
          • C:\Windows\SysWOW64\sc.exe
            sc stop WaaSMedicSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3928
          • C:\Windows\SysWOW64\sc.exe
            sc stop wuauserv
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1488
          • C:\Windows\SysWOW64\sc.exe
            sc stop DoSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:1304
          • C:\Windows\SysWOW64\sc.exe
            sc stop BITS /wait
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:4128
    • C:\Users\Admin\AppData\Local\Temp\Files\c.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\c.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3496
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\Files\c.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3436
    • C:\Users\Admin\AppData\Local\Temp\Files\payload.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\payload.exe"
      2⤵
      • Executes dropped EXE
      PID:3012
    • C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2456
    • C:\Users\Admin\AppData\Local\Temp\Files\LedgerUpdater.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\LedgerUpdater.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2700
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C ping 2.2.2.2 -n 1 -w 3000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\Files\LedgerUpdater.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:3104
        • C:\Windows\SysWOW64\PING.EXE
          ping 2.2.2.2 -n 1 -w 3000
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:3040
    • C:\Users\Admin\AppData\Local\Temp\Files\svc.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\svc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:4324
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3748
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          4⤵
          • Checks SCSI registry key(s)
          PID:5700
    • C:\Users\Admin\AppData\Local\Temp\Files\stealc_daval.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\stealc_daval.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4888
    • C:\Users\Admin\AppData\Local\Temp\Files\update.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\update.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:556
      • C:\Users\Admin\AppData\Local\Temp\zdwfitnkkt.exe
        "C:\Users\Admin\AppData\Local\Temp\zdwfitnkkt.exe" "C:\Users\Admin\AppData\Local\Temp\kpadcjpkso.exe" "C:\Users\Admin\AppData\Local\Temp\Files\update.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2400
        • C:\Users\Admin\AppData\Local\Temp\Files\update.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\update.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3024
      • C:\Users\Admin\AppData\Local\Temp\etcaxfcywl.exe
        C:\Users\Admin\AppData\Local\Temp\etcaxfcywl.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2172
        • C:\Windows\System32\cmd.exe
          /c sc config msdtc obj= LocalSystem
          4⤵
            PID:3996
            • C:\Windows\system32\sc.exe
              sc config msdtc obj= LocalSystem
              5⤵
              • Launches sc.exe
              PID:2660
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\pNGuY9D2.bat"
            4⤵
              PID:4600
            • C:\Windows\System32\bindsvc.exe
              "C:\Windows\System32\bindsvc.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4380
        • C:\Users\Admin\AppData\Local\Temp\Files\c1.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\c1.exe"
          2⤵
          • Executes dropped EXE
          PID:1464
        • C:\Users\Admin\AppData\Local\Temp\Files\a.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\a.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:6200
          • C:\Windows\sysvplervcs.exe
            C:\Windows\sysvplervcs.exe
            3⤵
            • Modifies security service
            • Windows security bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            PID:6340
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:6584
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:6668
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
              4⤵
              • System Location Discovery: System Language Discovery
              PID:6616
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:6692
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:6716
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:6732
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:6760
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS /wait
                5⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:6836
        • C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe"
          2⤵
          • Executes dropped EXE
          PID:6440
        • C:\Users\Admin\AppData\Local\Temp\Files\r.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\r.exe"
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:6676
      • C:\Windows\regedit.exe
        "regedit.exe" "C:\Users\Admin\Desktop\UpdateOptimize.reg"
        1⤵
        • Runs .reg file with regedit
        PID:4120
      • C:\Program Files\mesuau\svchost.exe
        "C:\Program Files\mesuau\svchost.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        PID:548
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvc
        1⤵
          PID:4128
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3040
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:3548
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
            2⤵
            • Modifies data under HKEY_USERS
            PID:1756
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          1⤵
            PID:232
            • C:\Windows\system32\whoami.exe
              whoami
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1096
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5576
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x4 /state0:0xa38a1055 /state1:0x41c64e6d
            1⤵
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:5004

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          System Services

          1
          T1569

          Service Execution

          1
          T1569.002

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          2
          T1543

          Windows Service

          2
          T1543.003

          Defense Evasion

          Impair Defenses

          3
          T1562

          Disable or Modify Tools

          2
          T1562.001

          Indicator Removal

          1
          T1070

          File Deletion

          1
          T1070.004

          Modify Registry

          4
          T1112

          Virtualization/Sandbox Evasion

          2
          T1497

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          4
          T1552

          Credentials In Files

          4
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          7
          T1012

          Remote System Discovery

          1
          T1018

          System Information Discovery

          5
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          System Network Configuration Discovery

          1
          T1016

          Internet Connection Discovery

          1
          T1016.001

          Virtualization/Sandbox Evasion

          2
          T1497

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Command and Control

          Exfiltration

          Impact

          Service Stop

          1
          T1489

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\mozglue.dll
            Filesize

            593KB

            MD5

            c8fd9be83bc728cc04beffafc2907fe9

            SHA1

            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

            SHA256

            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

            SHA512

            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            Download Submit

          • C:\ProgramData\nss3.dll
            Filesize

            2.0MB

            MD5

            1cc453cdf74f31e4d913ff9c10acdde2

            SHA1

            6e85eae544d6e965f15fa5c39700fa7202f3aafe

            SHA256

            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

            SHA512

            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            968cb9309758126772781b83adb8a28f

            SHA1

            8da30e71accf186b2ba11da1797cf67f8f78b47c

            SHA256

            92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

            SHA512

            4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            559fb739b94652a38445fffce7f76f26

            SHA1

            6cbf598f80ffd74cb93d9128dac04603968f6345

            SHA256

            961065de2b27860cbf42fb2cef722645818bf196a538013c0113a4bb195a156f

            SHA512

            03bde84ac7882f376256e77e537381cad50bb17955a4f6a9aafa34bb0ee491b9d1ae76ef12ad710fe7ec8c994736d1ad2b4508a3245a3427e2b67d6458411d07

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            18KB

            MD5

            ce6c5351e28f6f8e6c243e8b386a3c75

            SHA1

            de5bdf97bb8432587e344e292b9337d76596ec9d

            SHA256

            3334f4a582e9afad8a766e1496c0a1f24a6bfb2931c84d8d14e3ce94eb90bbc8

            SHA512

            76270a80150c585c192c5af2890263c3be93fc6db586d73832b559f910ce6f66ce0593cb338cf3e07228ed4ab40d12b78b3c158ec4610ede177bba26c0ec013b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\604728247.exe
            Filesize

            108KB

            MD5

            1fcb78fb6cf9720e9d9494c42142d885

            SHA1

            fef9c2e728ab9d56ce9ed28934b3182b6f1d5379

            SHA256

            84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02

            SHA512

            cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\11.exe
            Filesize

            79KB

            MD5

            e2e3268f813a0c5128ff8347cbaa58c8

            SHA1

            4952cbfbdec300c048808d79ee431972b8a7ba84

            SHA256

            d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

            SHA512

            cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\4434.exe
            Filesize

            413KB

            MD5

            607c413d4698582cc147d0f0d8ce5ef1

            SHA1

            c422ff50804e4d4e55d372b266b2b9aa02d3cfdd

            SHA256

            46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5

            SHA512

            d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\Amadeus.exe
            Filesize

            5.3MB

            MD5

            36a627b26fae167e6009b4950ff15805

            SHA1

            f3cb255ab3a524ee05c8bab7b4c01c202906b801

            SHA256

            a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a

            SHA512

            2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\Charter.exe
            Filesize

            321KB

            MD5

            03487ec0103b22c20bcc2f6864a705e7

            SHA1

            261e39572d4d1bbcab49586026daa886ea646a7a

            SHA256

            2082e3ef2d3644c643cfa108c0e0da774eda43bb6fbd721b3eed9d518e6f8936

            SHA512

            4dccab095fe000fadc4d56e58eed655bc3221f308ead6bc071e72c461ab851104d749cbc935955edecc5c3ce3fd6e41dac4272737a347c6bece769dd8c83e567

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\Guide2018.exe
            Filesize

            11.8MB

            MD5

            35d0a7832aad0c50eaccdba337def8cc

            SHA1

            8bd73783e808ddfd50e29aff1b8395ea39853552

            SHA256

            f2f007107f2d2fffe5328114661c79535b991e6f25fe8cc8e1157dd0b6a2723b

            SHA512

            f77055a833ba6171088ee551439a7686208f46ccb7377be3f4ed3d8c03304ca61b867e82db4241ea11763f5dfbdda0b9a589de65d1629b1ea6c100b515f29ff0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\LedgerUpdater.exe
            Filesize

            106KB

            MD5

            ba38615ab308efbdb2a877277ab76cd0

            SHA1

            db1a7fb291820b7581f98cf0623462c431288e5e

            SHA256

            06a5989061aac0564c43d883c74dc603f4489e149e04142d1bb7074b7e661bd1

            SHA512

            5fb878c7875c6f38664bf56389d432883933b2ff956fd9fa7475da7926c4289c738ff7a1fb8a244d5e69f485b9520f678fff90ae6673a9c15a4de50a20518f54

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\RuntimeBroker.exe
            Filesize

            625KB

            MD5

            dec397e36e9f5e8a47040adbbf04e20b

            SHA1

            643f2b5b37723ebc493ba6993514a4b2d9171acb

            SHA256

            534fd2d6da5c361831eb7fbfd1b203fbb80cd363d33f69abc4eafc384bafdc5e

            SHA512

            b2cdd06c044ae8b4cf7ae5c32b65f2b03f733b93061b9076cf29103da53573460c7e5d53da72220055cdafb084c63019d4a134d562a06af81c1eaad30892845b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\a.exe
            Filesize

            96KB

            MD5

            930c41bc0c20865af61a95bcf0c3b289

            SHA1

            cecf37c3b6c76d9a79dd2a97cfc518621a6ac924

            SHA256

            1f2e9724dfb091059ae16c305601e21d64b5308df76ddef6b394573e576ef1ff

            SHA512

            fa1f33c71da608b3980038981220fcebee0b0cc44331e52f5198dd2761c97631ee8286756c2cc16245a1370c83bb53cc8ea8ef64e0fcdd30af51f023973986b2

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\c.exe
            Filesize

            96KB

            MD5

            c71eacf3ffaf82787a533eb452bcf3e7

            SHA1

            c9149fdc1eacf2c61e606050d5d3e82284578ffb

            SHA256

            927d0f45bf59f19e915b8a8807372f547d151b60455a7fe40f696b8742d3ae3a

            SHA512

            26c9deb31071f1606b2eb8c09e3c1ea761701be0c8ba99673986abd44bb42affb9e8787e46059a277e9c2e40827f3619cbeaf39fefdedeb20a2a4e6925ca815e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\c1.exe
            Filesize

            547KB

            MD5

            2609215bb4372a753e8c5938cf6001fb

            SHA1

            ef1d238564be30f6080e84170fd2115f93ee9560

            SHA256

            1490105c73976217f35fe31d65939d1d9711d370c61f3d7d892afbb07eaaec63

            SHA512

            3892f3e4188250ab0d3508dd9c1825fa6dfab4fc50b4bc858703123e5512071d710fd8431f94912e74eaa4ca29b40c0b1b97805a5432a07fc09c35a87e6b23d2

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe
            Filesize

            54KB

            MD5

            3bd08acd4079d75290eb1fb0c34ff700

            SHA1

            84d4d570c228271f14e42bbb96702330cc8c8c2d

            SHA256

            4d3d060d8ec7089acfb4ba233d6f2a00a910503be648709a97714c84a80cccd8

            SHA512

            42309b28e5bf15ee9a4708ffcdb18ef2925d4b51151dab75168d3578db538b658c706cd77bfceae9a927516d3fb4b4bd3356e0ee066af5aaeadaa00ecff9a760

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\o.exe
            Filesize

            84KB

            MD5

            a775d164cf76e9a9ff6afd7eb1e3ab2e

            SHA1

            0b390cd5a44a64296b592360b6b74ac66fb26026

            SHA256

            794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979

            SHA512

            80b2d105d2fac2e56b7ea9e1b56057e94ffe594c314ea96668d387ab120b24be580c58d68d37aca07273d3ce80f0d74f072102469f35cb02e2295817e1f16808

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\payload.exe
            Filesize

            7KB

            MD5

            ca6ae34bf2b35aacb25a27f94fb1f7d5

            SHA1

            267e8948660634859cd6cd021df6be33f3713e8a

            SHA256

            fc69cdadc5ef79a1ba2b40189ecd6af230b7d9e8076f98f9fbb7a880b2b1b236

            SHA512

            8f5fc64f8399c4337ce5e41d85e1cd32aabc2465e0b44d52741025958c1641e23a08ea67d2d01a6847cf3faa13681a21160b3ea7f248c5ea41ba80626c246f5c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\random.exe
            Filesize

            1.8MB

            MD5

            25eda07b817c7417799d153d629e1d94

            SHA1

            cd63373ad66528e6dc7653d9ef49e95172dcc4ad

            SHA256

            02ac6b117ee0d8a84f659b64162addac4e20be7f07db000a8f8e62b9f2ca4d9f

            SHA512

            e040c4eb8f918ec47093729e4344db125b595eb25fe83f7f2d16d35747282aa7e0772662d85040ea55160cafe2961340680e72a97fb0ac9524e936c0c17dc3d1

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\stealc_daval.exe
            Filesize

            187KB

            MD5

            7a02aa17200aeac25a375f290a4b4c95

            SHA1

            7cc94ca64268a9a9451fb6b682be42374afc22fd

            SHA256

            836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

            SHA512

            f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\svc.exe
            Filesize

            929KB

            MD5

            1e05a317170e161ce41edd9576a12112

            SHA1

            3c51bfe359199206e0179f39ce8657a50a33b452

            SHA256

            8b9dde8c155521ce2361bee1ebc58d8ef579128bf51a69248cc2a155e575abf7

            SHA512

            374215799741f0495fa7ad78253e3b1ac904c4d1d91728269ab58cdb9b41d653a8caaa3a5fa1c39ab2422de64c89f3c68bc0bdee7860ed65e94a454f687fdf43

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
            Filesize

            83KB

            MD5

            06560b5e92d704395bc6dae58bc7e794

            SHA1

            fbd3e4ae28620197d1f02bfc24adaf4ddacd2372

            SHA256

            9eaaadf3857e4a3e83f4f78d96ab185213b6528c8e470807f9d16035daadf33d

            SHA512

            b55b49fc1bd526c47d88fcf8a20fcaed900bfb291f2e3e1186ec196a87127ed24df71385ae04fedcc802c362c4ebf38edfc182013febf4496ddeb66ce5195ee3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Files\update.exe
            Filesize

            7.8MB

            MD5

            2f7548098416cbe47d675b1d61b6c334

            SHA1

            f5a20d7e5b04aaf27fac94c27ebae6bf30d03b07

            SHA256

            c6b56d104ad74e587a58acc64b68b603d1786d07c3054d82ca29d6820f215f16

            SHA512

            9098091b972788da8527762a9794509a9413928ff0411c8f67e3e168efb1028ac13d25e5aa61f75ec5513581b6322de8a7217aa5094d8ae9d5aaf387309aa8a8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\detailcompetitive.exe
            Filesize

            927KB

            MD5

            5d99042376131355be8579bd56100a82

            SHA1

            7cab6bbd33fbb030fc78b81466a387a1921d8dad

            SHA256

            fff0fecf9639148a95a39b9763361c1f3ceb2d4a54bce118b1c357504db6b9d8

            SHA512

            a168a70e6ff710b822d302579d8226901b637fdb1938b4a4846d8010572b2349abc3664aafff21366f3f6fa7957455ca5fa95a418ca674ca8442d6705d45acc7

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2lonwhw5.5ln.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\etcaxfcywl.exe
            Filesize

            580KB

            MD5

            2c2029588ad8b86759c17b7ae885ee03

            SHA1

            91653b5344d4c210201218e2f215dd5228d76799

            SHA256

            3ab288c47914e33cc61985e46502158400faa9d7187b55c19039b8795504a290

            SHA512

            88531fe6b0f2d66ada368a431f912868f74f9ed8ade9dc88887807b761490fe2cc317e1b6b40e7070411924c80971f237dca68ad2faafa7b4b1ecd2ec90c860f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\kpadcjpkso.exe
            Filesize

            7.1MB

            MD5

            b83f61aa51a36f48610bfcda20dd82fd

            SHA1

            a069a376489bc55649ba1ef8f0d8799d75288002

            SHA256

            9bfe94178387ca65b1a5a65701a5b4a2edb109248bf3030cb3f75c6512e21f18

            SHA512

            8dbe667f5c71fa055f48bcf395487ac94c4b276bc6af081969b7a977e79e0b975c0a294ea23746259ddcb8af58dd29bb61b93ae47d7918da2fad03aac7913227

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\pNGuY9D2.bat
            Filesize

            196B

            MD5

            4c6f5b01d3ad4a17bd1b585f43b675ee

            SHA1

            17922f4770792c753a1e27283238af2c94702561

            SHA256

            de67a25de3626c4f6840039fbfce85176a595943b5116cb4518a5bfc6eac8017

            SHA512

            3ab83838dbece89fff18abfe100834b2f7d3c71bb3f16a901eaa6bdca9a0e88adab97a7793d62c567938b4b77e4b9f9a3056c4ae8972d4e71643d0851a67b9a0

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\zdwfitnkkt.exe
            Filesize

            51KB

            MD5

            e48b89715bf5e4c55eb5a1fed67865d9

            SHA1

            89a287da39e14b02cdc284eb287549462346d724

            SHA256

            c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e

            SHA512

            4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\UserSetting\trnmg.sdb
            Filesize

            988B

            MD5

            f2dc31cff41033f6af683b2d3a02349e

            SHA1

            c34ed23f84821948d7878e9d467ccbd3faeee634

            SHA256

            dce6840877ba27074d4e16614284958d6070a1c770d37124e7147e9b58eca039

            SHA512

            cc9de7a8ec4cee8eb138721d66cfe3490021d2a2496d8eee9b178edd8804f549105afa11ecc51487dbc9776868de56930af6c9fe49746fc68aa7a525f18b9ca0

            Download Submit

          • C:\Users\Admin\tbtnds.dat
            Filesize

            3KB

            MD5

            eee5858a682c4f16d61458e135d95853

            SHA1

            5512676bcc88f701107d5008a14483abf4bf7e34

            SHA256

            dc130b4e51508fe89b2c9d1f1a70867686c8d4f047e603c40e841ed12a320944

            SHA512

            7bf3f93fc7d497d0281c4f3ac8a1aa6767db07d090b9d8bfe646869bf4bc790b40196415b2f882d1f6f200c885ddfffda5bd68bd2612c3f4ed21ce06488465e5

            Download Submit

          • C:\Users\Admin\tbtnds.dat
            Filesize

            4KB

            MD5

            59abdbfcd1f499fa50f74f4545d7d8e8

            SHA1

            e973376dad1ce20fb5f99baafa01d24fad871c73

            SHA256

            da36bd31b59bca771aa0ce07817b0a1c66da60665bb6924e784f28add9fe8528

            SHA512

            4b57f0b5cc4ea9129790ce5ced4f7cdbe6c97c2fe82cfcae45efe74fb06c9357862d2dd6e68139fe5cd435e7655bdca1447a0887a7590e439df24da724587ee4

            Download Submit

          • C:\Users\Admin\tbtnds.dat
            Filesize

            4KB

            MD5

            8c1a9a4b0a4225d1ef8788fb456c688e

            SHA1

            d833c0afda5932d6adc42c1f0ec64e17b489d857

            SHA256

            d2994d908b9f60d043ebfe8afda2108fe56a02daec4453710db517fe807c4766

            SHA512

            3b9480bdbc1fc5881f2739af9eece7c956db9be70e93186d4bd11cf0c424c97a57f7c3537f9dd92e20da9698c897707fdc80c3b92fcc712263a89779b18d8240

            Download Submit

          • C:\Windows\System32\bindsvc.exe
            Filesize

            291KB

            MD5

            7c5b397fb54d5aa06bd2a6fb99c62fee

            SHA1

            a9e0bf7bbabf6ab9e294156985537ae972ebd743

            SHA256

            d032bdc64c9451bbb653b346c5bd6ac9f83a91edeb0155497f098c8d6182ddee

            SHA512

            daa4702eff625b5dd1edca358c653338cff4eeca4e43d12dfd39bbc52acf8dfde3b963d190cf4426e405d9db8bcc9817cd50868055aa0d4a9efe4d1042beaf0c

            Download Submit

          • memory/1116-312-0x000000006E910000-0x000000006E95C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1180-44-0x0000000074670000-0x0000000074E20000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1180-1-0x0000000000D20000-0x0000000000D28000-memory.dmp

            Filesize

            32KB

            Download

          • memory/1180-2-0x00000000056B0000-0x000000000574C000-memory.dmp

            Filesize

            624KB

            Download

          • memory/1180-3-0x0000000074670000-0x0000000074E20000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1180-790-0x0000000074670000-0x0000000074E20000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/1180-38-0x000000007467E000-0x000000007467F000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1180-0-0x000000007467E000-0x000000007467F000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1572-139-0x0000000006D00000-0x0000000006D1E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/1572-162-0x0000000007DA0000-0x0000000007DA8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/1572-128-0x0000000006D20000-0x0000000006D52000-memory.dmp

            Filesize

            200KB

            Download

          • memory/1572-129-0x000000006F240000-0x000000006F28C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1572-56-0x0000000006780000-0x00000000067CC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/1572-156-0x0000000007C90000-0x0000000007CA1000-memory.dmp

            Filesize

            68KB

            Download

          • memory/1572-55-0x0000000006750000-0x000000000676E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/1572-159-0x0000000007CC0000-0x0000000007CCE000-memory.dmp

            Filesize

            56KB

            Download

          • memory/1572-50-0x0000000006180000-0x00000000064D4000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/1572-160-0x0000000007CD0000-0x0000000007CE4000-memory.dmp

            Filesize

            80KB

            Download

          • memory/1572-41-0x00000000057C0000-0x00000000057E2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/1572-140-0x0000000007720000-0x00000000077C3000-memory.dmp

            Filesize

            652KB

            Download

          • memory/1572-42-0x0000000005860000-0x00000000058C6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/1572-43-0x0000000006010000-0x0000000006076000-memory.dmp

            Filesize

            408KB

            Download

          • memory/1572-40-0x00000000058F0000-0x0000000005F18000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/1572-141-0x0000000008120000-0x000000000879A000-memory.dmp

            Filesize

            6.5MB

            Download

          • memory/1572-161-0x0000000007DC0000-0x0000000007DDA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/1572-39-0x0000000003180000-0x00000000031B6000-memory.dmp

            Filesize

            216KB

            Download

          • memory/1572-153-0x0000000007D00000-0x0000000007D96000-memory.dmp

            Filesize

            600KB

            Download

          • memory/1572-152-0x0000000007AF0000-0x0000000007AFA000-memory.dmp

            Filesize

            40KB

            Download

          • memory/1572-142-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/1756-472-0x0000023C87A00000-0x0000023C87A10000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1756-471-0x0000023C87A00000-0x0000023C87A10000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1756-470-0x0000023C87A00000-0x0000023C87A10000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1756-469-0x0000023C87A00000-0x0000023C87A10000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1756-474-0x0000023C87A00000-0x0000023C87A10000-memory.dmp

            Filesize

            64KB

            Download

          • memory/1756-473-0x0000023C87A00000-0x0000023C87A10000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2172-629-0x0000000000FE0000-0x000000000115A000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2172-621-0x0000000000FE0000-0x000000000115A000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2172-402-0x0000000000FE0000-0x000000000115A000-memory.dmp

            Filesize

            1.5MB

            Download

          • memory/2456-457-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

            Download

          • memory/2456-374-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

            Download

          • memory/2456-386-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

            Download

          • memory/2456-232-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

            Download

          • memory/2700-245-0x0000000000370000-0x0000000000390000-memory.dmp

            Filesize

            128KB

            Download

          • memory/3012-352-0x0000000140000000-0x0000000140004278-memory.dmp

            Filesize

            16KB

            Download

          • memory/3012-209-0x0000000140000000-0x0000000140004278-memory.dmp

            Filesize

            16KB

            Download

          • memory/3024-467-0x0000000007650000-0x0000000007688000-memory.dmp

            Filesize

            224KB

            Download

          • memory/3024-468-0x0000000007620000-0x000000000762E000-memory.dmp

            Filesize

            56KB

            Download

          • memory/3024-455-0x00000000000C0000-0x00000000007D6000-memory.dmp

            Filesize

            7.1MB

            Download

          • memory/3024-460-0x00000000075C0000-0x00000000075C8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/3032-155-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

            Download

          • memory/3032-154-0x0000000000400000-0x0000000000643000-memory.dmp

            Filesize

            2.3MB

            Download

          • memory/3040-424-0x0000021E3A890000-0x0000021E3A8A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3040-408-0x0000021E3A790000-0x0000021E3A7A0000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3040-440-0x0000021E3ED80000-0x0000021E3ED88000-memory.dmp

            Filesize

            32KB

            Download

          • memory/3040-458-0x0000021E41920000-0x0000021E41928000-memory.dmp

            Filesize

            32KB

            Download

          • memory/3748-286-0x0000000004EA0000-0x0000000004F3E000-memory.dmp

            Filesize

            632KB

            Download

          • memory/3748-298-0x0000000005120000-0x000000000512A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/3748-288-0x0000000005140000-0x00000000051D2000-memory.dmp

            Filesize

            584KB

            Download

          • memory/3748-287-0x0000000005650000-0x0000000005BF4000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/3748-681-0x00000000064E0000-0x00000000064E6000-memory.dmp

            Filesize

            24KB

            Download

          • memory/3748-674-0x00000000064C0000-0x00000000064DA000-memory.dmp

            Filesize

            104KB

            Download

          • memory/3748-263-0x0000000000CC0000-0x0000000000DAC000-memory.dmp

            Filesize

            944KB

            Download

          • memory/4344-37-0x0000000000AF0000-0x0000000000B48000-memory.dmp

            Filesize

            352KB

            Download

          • memory/4344-36-0x0000000000760000-0x00000000007AB000-memory.dmp

            Filesize

            300KB

            Download

          • memory/4344-169-0x0000000000AF0000-0x0000000000B48000-memory.dmp

            Filesize

            352KB

            Download

          • memory/4344-168-0x0000000000400000-0x0000000000457000-memory.dmp

            Filesize

            348KB

            Download

          • memory/4488-167-0x0000000000400000-0x0000000000458000-memory.dmp

            Filesize

            352KB

            Download

          • memory/4488-172-0x0000000000400000-0x0000000000458000-memory.dmp

            Filesize

            352KB

            Download

          • memory/4852-299-0x000000006E910000-0x000000006E95C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4852-309-0x0000000007B50000-0x0000000007BF3000-memory.dmp

            Filesize

            652KB

            Download

          • memory/4852-310-0x0000000007E80000-0x0000000007E91000-memory.dmp

            Filesize

            68KB

            Download

          • memory/4852-283-0x00000000063D0000-0x0000000006724000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/4852-285-0x0000000006F10000-0x0000000006F5C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/4852-311-0x0000000007ED0000-0x0000000007EE4000-memory.dmp

            Filesize

            80KB

            Download

          • memory/4888-171-0x0000000000FD0000-0x0000000001463000-memory.dmp

            Filesize

            4.6MB

            Download

          • memory/4888-665-0x0000000000600000-0x0000000000843000-memory.dmp

            Filesize

            2.3MB

            Download

          • memory/4888-151-0x0000000000FD0000-0x0000000001463000-memory.dmp

            Filesize

            4.6MB

            Download

          • memory/4888-272-0x0000000000600000-0x0000000000843000-memory.dmp

            Filesize

            2.3MB

            Download

          • memory/4888-325-0x0000000061E00000-0x0000000061EF3000-memory.dmp

            Filesize

            972KB

            Download

          • memory/5576-686-0x0000023593570000-0x00000235935B4000-memory.dmp

            Filesize

            272KB

            Download

          • memory/5576-685-0x00000235934C0000-0x00000235934E2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/5576-687-0x00000235ABBE0000-0x00000235ABC56000-memory.dmp

            Filesize

            472KB

            Download

          • memory/6668-755-0x0000000007BB0000-0x0000000007BC1000-memory.dmp

            Filesize

            68KB

            Download

          • memory/6668-744-0x000000006F1A0000-0x000000006F1EC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/6668-754-0x0000000007900000-0x00000000079A3000-memory.dmp

            Filesize

            652KB

            Download

          • memory/6668-742-0x0000000006BE0000-0x0000000006C2C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/6668-756-0x0000000007BF0000-0x0000000007C04000-memory.dmp

            Filesize

            80KB

            Download

          • memory/6668-732-0x0000000005FD0000-0x0000000006324000-memory.dmp

            Filesize

            3.3MB

            Download