Overview

overview

10

Static

static

10

RIP_YOUR_PC_LOL.exe

windows7-x64

10

RIP_YOUR_PC_LOL.exe

windows10-2004-x64

Resubmissions

25/11/2025, 20:48

251125-zlrq5sskhn10

27/09/2025, 04:16

250927-evwq8szycz10

24/09/2025, 18:13

250924-wt7ksabn4110

24/09/2025, 18:09

250924-wrpl7abn3w10

24/09/2025, 17:30

250924-v3fb8axlw710

07/12/2024, 03:49

241207-edgkzszrdj10

04/12/2024, 22:38

241204-2kv4aa1jgn10

04/12/2024, 20:50

241204-zmwrgszrgt

04/12/2024, 20:49

241204-zl1ztawnfk10

04/12/2024, 20:48

241204-zlmgeszrbt10

Analysis

  • max time kernel
    143s
  • max time network
    219s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2024, 19:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    RIP_YOUR_PC_LOL.exe
  • Size 22.5MB
  • Sample241204-xxpd2sslem
  • SHA256 37d8e1ce3b6e6488942717aa78cb54785edc985143bcc8d9ba9f42d73a3dbd7a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratazorultblackmoondcratfickerstealergh0strathawkeyenanocorenjratoskipurplefoxraccoonredlinexmrig5781468cedb3a203003fdf1f12e72fe98d6f1c0f@zhilsholidefaultmediagetbankercollectiondefense_evasiondiscoveryevasioninfostealerkeyloggerminerpersistenceprivilege_escalationratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

  • njrat

Version

  • im523

Botnet

  • mediaget

C2

  • kazya1.hopto.org:1470

Mutex

  • a797c6ca3f5e7aff8fa1149c47fe9466

Attributes
  • reg_key

    a797c6ca3f5e7aff8fa1149c47fe9466

  • splitter

    |'|'|

Extracted

Family

  • fickerstealer

C2

  • 80.87.192.115:80

Extracted

Family

  • asyncrat

Version

  • 0.5.7B

Botnet

  • Default

C2

  • gfhhjgh.duckdns.org:8050

Mutex

  • AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_file

    system32.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • 172.98.92.42:58491

  • 127.0.0.1:58491

Mutex

  • c5a0b6d8-d1f7-45cd-943b-d5fda411e988

Attributes
  • activate_away_mode

    true

  • backup_connection_host

    127.0.0.1

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2021-09-20T02:48:09.651743436Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    58491

  • default_group

    Default

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    c5a0b6d8-d1f7-45cd-943b-d5fda411e988

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    172.98.92.42

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Extracted

Family

  • redline

Botnet

  • @zhilsholi

C2

  • yabynennet.xyz:81

Attributes
  • auth_value

    c2d0b7a2ede97b91495c99e75b4f27fb

Extracted

Family

  • raccoon

Version

  • 1.8.3-hotfix

Botnet

  • 5781468cedb3a203003fdf1f12e72fe98d6f1c0f

Attributes
  • url4cnc

    http://194.180.174.53/brikitiki

    http://91.219.236.18/brikitiki

    http://194.180.174.41/brikitiki

    http://91.219.236.148/brikitiki

    https://t.me/brikitiki

rc4.plain
rc4.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Azorult family
    azorult
  • Blackmoon family
    blackmoon
  • Blackmoon, KrBanker

    Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

    trojanbankerblackmoon
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Detect Blackmoon payload 3 IoCs
  • Detect PurpleFox Rootkit 9 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

    infostealerfickerstealer
  • Fickerstealer family
    fickerstealer
  • Gh0st RAT payload 10 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye
  • Hawkeye family
    hawkeye
  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Nanocore family
    nanocore
  • Njrat family
    njrat
  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski
  • Oski family
    oski
  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Raccoon

    Raccoon is an infostealer written in C++ and first seen in 2019.

    stealerraccoon
  • Raccoon Stealer V1 payload 2 IoCs
  • Raccoon family
    raccoon
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Redline family
    redline
  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • Xmrig family
    xmrig
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Async RAT payload 2 IoCs
    rat
  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Detected Nirsoft tools 4 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • NirSoft MailPassView 4 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • XMRig Miner payload 1 IoCs
    miner
  • Downloads MZ/PE file
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 20 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 57 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
    defense_evasion
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 7 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 6 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 12 IoCs
  • Drops file in Windows directory 8 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 7 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe
    "C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Users\Admin\AppData\Roaming\healastounding.exe
      "C:\Users\Admin\AppData\Roaming\healastounding.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3636
      • C:\Users\Admin\AppData\Roaming\test.exe
        "C:\Users\Admin\AppData\Roaming\test.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2908
      • C:\Users\Admin\AppData\Roaming\gay.exe
        "C:\Users\Admin\AppData\Roaming\gay.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:400
        • C:\Users\Admin\AppData\Roaming\mediaget.exe
          "C:\Users\Admin\AppData\Roaming\mediaget.exe"
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:3624
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\mediaget.exe" "mediaget.exe" ENABLE
            5⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4896
      • C:\Users\Admin\AppData\Roaming\Opus.exe
        "C:\Users\Admin\AppData\Roaming\Opus.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:3032
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /create /f /tn "SCSI Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCCD5.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3620
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /create /f /tn "SCSI Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpD543.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2384
      • C:\Users\Admin\AppData\Roaming\aaa.exe
        "C:\Users\Admin\AppData\Roaming\aaa.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1512
        • C:\Users\Admin\AppData\Roaming\aaa.exe
          "C:\Users\Admin\AppData\Roaming\aaa.exe"
          4⤵
          • Executes dropped EXE
          PID:2660
      • C:\Users\Admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe
        "C:\Users\Admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        PID:4092
        • C:\Users\Admin\AppData\Local\Temp\FFDvbcrdfqs.exe
          "C:\Users\Admin\AppData\Local\Temp\FFDvbcrdfqs.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:4764
          • C:\Users\Admin\AppData\Local\Temp\FFDvbcrdfqs.exe
            "C:\Users\Admin\AppData\Local\Temp\FFDvbcrdfqs.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:5080
        • C:\Users\Admin\AppData\Local\Temp\Dcvxaamev.exe
          "C:\Users\Admin\AppData\Local\Temp\Dcvxaamev.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetWindowsHookEx
          PID:5108
          • C:\Users\Admin\AppData\Local\Temp\Dcvxaamev.exe
            "C:\Users\Admin\AppData\Local\Temp\Dcvxaamev.exe"
            5⤵
            • Executes dropped EXE
            PID:4848
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4848 -s 1340
              6⤵
              • Program crash
              PID:1628
        • C:\Users\Admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe
          "C:\Users\Admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3636
      • C:\Users\Admin\AppData\Roaming\4.exe
        "C:\Users\Admin\AppData\Roaming\4.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3928
        • C:\Users\Admin\AppData\Roaming\3.exe
          "C:\Users\Admin\AppData\Roaming\3.exe"
          4⤵
          • UAC bypass
          • Checks computer location settings
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • System policy modification
          PID:1492
          • C:\Windows\Resources\Ease of Access Themes\schtasks.exe
            "C:\Windows\Resources\Ease of Access Themes\schtasks.exe"
            5⤵
            • UAC bypass
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • System policy modification
            PID:4644
      • C:\Users\Admin\AppData\Roaming\a.exe
        "C:\Users\Admin\AppData\Roaming\a.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        PID:4812
    • C:\Users\Admin\AppData\Roaming\Pluto Panel.exe
      "C:\Users\Admin\AppData\Roaming\Pluto Panel.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:4828
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        3⤵
        • Accesses Microsoft Outlook accounts
        • System Location Discovery: System Language Discovery
        PID:4464
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1008
    • C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
      "C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4208
      • C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
        "C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5052
    • C:\Users\Admin\AppData\Roaming\22.exe
      "C:\Users\Admin\AppData\Roaming\22.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add policy name=Block
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2780
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filterlist name=Filter1
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:32
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=TCP
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2264
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=135 protocol=UDP
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4772
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=TCP
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:696
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=139 protocol=UDP
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:512
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=TCP
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2360
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDP
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:4480
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add filteraction name=FilteraAtion1 action=block
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:2524
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static add rule name=Rule1 policy=Block filterlist=Filter1 filteraction=FilteraAtion1
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:1496
      • C:\Windows\SysWOW64\netsh.exe
        netsh ipsec static set policy name=Block assign=y
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Location Discovery: System Language Discovery
        PID:220
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c del "C:\Users\Admin\AppData\Roaming\22.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4344
    • C:\Users\Admin\AppData\Roaming\___11.19.exe
      "C:\Users\Admin\AppData\Roaming\___11.19.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1168
      • C:\Users\Admin\AppData\Local\Temp\svchost.exe
        C:\Users\Admin\AppData\Local\Temp\\svchost.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:4420
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 2 127.0.0.1
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1872
      • C:\Users\Admin\AppData\Local\Temp\svchos.exe
        C:\Users\Admin\AppData\Local\Temp\\svchos.exe
        3⤵
        • Server Software Component: Terminal Services DLL
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        PID:692
      • C:\Users\Admin\AppData\Roaming\HD____11.19.exe
        C:\Users\Admin\AppData\Roaming\HD____11.19.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4448
  • C:\Windows\SysWOW64\TXPlatforn.exe
    C:\Windows\SysWOW64\TXPlatforn.exe -auto
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:764
    • C:\Windows\SysWOW64\TXPlatforn.exe
      C:\Windows\SysWOW64\TXPlatforn.exe -acsi
      2⤵
      • Drops file in Drivers directory
      • Sets service image path in registry
      • Executes dropped EXE
      • Suspicious behavior: LoadsDriver
      • Suspicious use of AdjustPrivilegeToken
      PID:788
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
    1⤵
      PID:1556
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"
      1⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:1852
      • C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
        C:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\240629765.txt",MainThread
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4544
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\SearchApp.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3832
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\schtasks.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:4892
    • C:\Windows\system32\schtasks.exe
      schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default User\winlogon.exe'" /rl HIGHEST /f
      1⤵
      • Process spawned unexpected child process
      • Scheduled Task/Job: Scheduled Task
      PID:3888
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /0
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4384
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4848 -ip 4848
      1⤵
        PID:4156
      • C:\Windows\Help\Winlogon.exe
        C:\Windows\Help\Winlogon.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        PID:1372
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:244
          • C:\Windows\Cursors\WUDFhosts.exe
            C:\Windows\Cursors\WUDFhosts.exe -o pool.usa-138.com:80 -u 4B7yFmYw2qvEtWZDDnZVeY16HHpwTtuYBg6EMn5xdDbM3ggSEnQFDWDHH6cqdEYaPx4iQvAwLNu8NLc21QxDU84GGxZEY7S -p x
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:3888
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\system32\svchost.exe
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3508
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 448
          2⤵
          • Program crash
          PID:2400
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1372 -ip 1372
        1⤵
          PID:512
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
          1⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2936
          • C:\Users\Admin\AppData\Local\Temp\svchost.exe
            C:\Users\Admin\AppData\Local\Temp\\svchost.exe
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:4784
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul
              3⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              PID:1372
              • C:\Windows\SysWOW64\PING.EXE
                ping -n 2 127.0.0.1
                4⤵
                • System Location Discovery: System Language Discovery
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:5708
          • C:\Users\Admin\AppData\Local\Temp\svchos.exe
            C:\Users\Admin\AppData\Local\Temp\\svchos.exe
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2556
          • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Checks system information in the registry
            • Enumerates system info in registry
            • Modifies system certificate store
            • NTFS ADS
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • System policy modification
            PID:4632
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9757c46f8,0x7ff9757c4708,0x7ff9757c4718
              3⤵
              • Executes dropped EXE
              PID:2264
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
              3⤵
              • Executes dropped EXE
              PID:1680
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
              3⤵
              • Executes dropped EXE
              PID:2708
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
              3⤵
              • Executes dropped EXE
              PID:812
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:1336
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:1656
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:5348
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:5360
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:5488
            • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              PID:6032
            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 /prefetch:8
              3⤵
                PID:1728
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 /prefetch:8
                3⤵
                  PID:2616
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:5624
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:5888
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:5912
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:5896
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:5940
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:5704
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1700 /prefetch:8
                  3⤵
                  • Executes dropped EXE
                  PID:5532
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=renderer --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:5552
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6168 /prefetch:8
                  3⤵
                  • Executes dropped EXE
                  PID:2556
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6200 /prefetch:8
                  3⤵
                  • Executes dropped EXE
                  PID:5772
                • C:\Users\Admin\Downloads\HitmanPro_x64.exe
                  "C:\Users\Admin\Downloads\HitmanPro_x64.exe"
                  3⤵
                  • Drops file in Drivers directory
                  • Executes dropped EXE
                  • Impair Defenses: Safe Mode Boot
                  • Enumerates connected drives
                  • Modifies system certificate store
                  PID:5796
                • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4768 /prefetch:2
                  3⤵
                    PID:1044
                  • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3780 /prefetch:2
                    3⤵
                      PID:5604
                    • C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\HD_msedge.exe" --type=gpu-process --field-trial-handle=2056,17449007700291390702,18394526988265309972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2344 /prefetch:2
                      3⤵
                        PID:4176
                  • C:\Windows\SysWOW64\TXPlatforn.exe
                    C:\Windows\SysWOW64\TXPlatforn.exe -auto
                    1⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:872
                    • C:\Windows\SysWOW64\TXPlatforn.exe
                      C:\Windows\SysWOW64\TXPlatforn.exe -acsi
                      2⤵
                      • Executes dropped EXE
                      PID:4860
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:412
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:5168
                      • C:\Windows\system32\dwm.exe
                        "dwm.exe"
                        1⤵
                          PID:1608
                        • C:\Windows\system32\dwm.exe
                          "dwm.exe"
                          1⤵
                            PID:4580
                          • C:\Windows\system32\dwm.exe
                            "dwm.exe"
                            1⤵
                              PID:5696
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:5316
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:5256
                                • C:\Windows\system32\dwm.exe
                                  "dwm.exe"
                                  1⤵
                                    PID:4600
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:3744
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:5576

                                      Network

                                            MITRE ATT&CK Enterprise v15

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Command and Scripting Interpreter

                                            1
                                            T1059

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            2
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Event Triggered Execution

                                            1
                                            T1546

                                            Netsh Helper DLL

                                            1
                                            T1546.007

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Server Software Component

                                            1
                                            T1505

                                            Terminal Services DLL

                                            1
                                            T1505.005

                                            Privilege Escalation

                                            Abuse Elevation Control Mechanism

                                            1
                                            T1548

                                            Bypass User Account Control

                                            1
                                            T1548.002

                                            Boot or Logon Autostart Execution

                                            2
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            2
                                            T1547.001

                                            Create or Modify System Process

                                            1
                                            T1543

                                            Windows Service

                                            1
                                            T1543.003

                                            Event Triggered Execution

                                            1
                                            T1546

                                            Netsh Helper DLL

                                            1
                                            T1546.007

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Defense Evasion

                                            Abuse Elevation Control Mechanism

                                            1
                                            T1548

                                            Bypass User Account Control

                                            1
                                            T1548.002

                                            Impair Defenses

                                            3
                                            T1562

                                            Disable or Modify System Firewall

                                            1
                                            T1562.004

                                            Disable or Modify Tools

                                            1
                                            T1562.001

                                            Safe Mode Boot

                                            1
                                            T1562.009

                                            Indicator Removal

                                            1
                                            T1070

                                            File Deletion

                                            1
                                            T1070.004

                                            Modify Registry

                                            5
                                            T1112

                                            Subvert Trust Controls

                                            1
                                            T1553

                                            Install Root Certificate

                                            1
                                            T1553.004

                                            Virtualization/Sandbox Evasion

                                            1
                                            T1497

                                            Credential Access

                                            Credentials from Password Stores

                                            1
                                            T1555

                                            Credentials from Web Browsers

                                            1
                                            T1555.003

                                            Unsecured Credentials

                                            1
                                            T1552

                                            Credentials In Files

                                            1
                                            T1552.001

                                            Discovery

                                            Browser Information Discovery

                                            1
                                            T1217

                                            Peripheral Device Discovery

                                            2
                                            T1120

                                            Query Registry

                                            9
                                            T1012

                                            Remote System Discovery

                                            1
                                            T1018

                                            System Information Discovery

                                            8
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            System Network Configuration Discovery

                                            1
                                            T1016

                                            Internet Connection Discovery

                                            1
                                            T1016.001

                                            Virtualization/Sandbox Evasion

                                            1
                                            T1497

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            1
                                            T1005

                                            Email Collection

                                            1
                                            T1114

                                            Command and Control

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            kaosdma.txt
                                            • Path C:\ProgramData\kaosdma.txt
                                            • Size 14B
                                            • SHA256 3c4fae56f61b7cdf09709c2aaf65ca47d3bf9077b1e5eb0eb1e6c5c34923eb9b
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            settings.dat
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 152B
                                            • SHA256 4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            settings.dat
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                            • Size 152B
                                            • SHA256 38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            f_000002
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
                                            • Size 47KB
                                            • SHA256 51b37ee622ba3e2210a8175ecd99d26d3a3a9e991368d0efbb705f21ff9ac609
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            f_000003
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                            • Size 62KB
                                            • SHA256 df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            f_000004
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                            • Size 67KB
                                            • SHA256 1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            f_000005
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                            • Size 19KB
                                            • SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            f_000006
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                            • Size 65KB
                                            • SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            f_000007
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
                                            • Size 25KB
                                            • SHA256 349cc041df29f65fd7ffe2944a8872f66b62653bbfbd1f38ce8e6b7947f99a69
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            f_00000b
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
                                            • Size 215KB
                                            • SHA256 1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            the-real-index
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                            • Size 1KB
                                            • SHA256 92cd2d831dbdb080d30c06feef0149335202908e9475eb2b8319d5ed1f3c0a07
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            data_1
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
                                            • Size 264KB
                                            • SHA256 d6eea1ffa740c7842deed381ad338175ec14fecd7ca25245342ca8930ffd0b79
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Network Persistent State
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                            • Size 1KB
                                            • SHA256 3c4d4d142d4130295ac28fd97855c7d25f989dbf6ca7a90277f03619d092e762
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 7KB
                                            • SHA256 88764f2c0db9a95848272cc02c5f14923d9e3e30aefa4df817cbc94101c8519d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 7KB
                                            • SHA256 38c643957086b960a1d4b303224ce2aeeccaff63a521e329fb798d32974251d0
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 7KB
                                            • SHA256 cfa4188133a9e40364d8c32f96e354c35eecb0a65df22ad974fcab1fb919b3ce
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 5KB
                                            • SHA256 706a2eaf2e8d892373ae7643d53c89e6b4bd9e34de07c93ce72d7f045847810d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 6KB
                                            • SHA256 41fc2934bcd8509c15634adc63d4f83359c945e5418805d24ccba93c545b14f3
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Preferences
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                            • Size 6KB
                                            • SHA256 ec15ae480e6e8546236693850695b73254ea2b24b007f1ab7014836ddc665fad
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            TransportSecurity
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 538B
                                            • SHA256 ddeea2f0bc19336d7cb8cd2f87aee0faacefd87ff640a76b7a3284a32da8e4d8
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            TransportSecurity
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                            • Size 1KB
                                            • SHA256 cec1988e72fc7b1f74a63cc0d29950517527f395783289d8ba0cdf211e93f113
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            TransportSecurity~RFe591b5e.TMP
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe591b5e.TMP
                                            • Size 538B
                                            • SHA256 d0791ca45ea1015edab4511607c50f29e0adf95ce23e104c4d133275951a78bf
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            CURRENT
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                            • Size 16B
                                            • SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            f_000001
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001
                                            • Size 22KB
                                            • SHA256 4564be03e04002c5f6eaeaea0aff16c5d0bbdad45359aef64f4c199cda8b195e
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            f_000002
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000002
                                            • Size 16KB
                                            • SHA256 ac33d8bc6d9a5e769472877d7dd3d035f8088274b886b16cb1898b106da48560
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            f_000003
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000003
                                            • Size 17KB
                                            • SHA256 2d4f19e670e3081e0039b061c8d80c8037605d5f8a01a9bd58c4ed1537a253c3
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            f_000005
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000005
                                            • Size 17KB
                                            • SHA256 6388415a307a208b0a43b817ccd9e5fcdda9b6939ecd20ef4c0eda1aa3a0e49e
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 11KB
                                            • SHA256 f8ab4ff2e5cb6cb4be3e3806abe5449d4d3756b93f36e0225c993743c1942640
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Local State
                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                            • Size 10KB
                                            • SHA256 c0b87ec1d43dc3db6c307b9e36f298cab5424a88bae1d524f12b6cc49c1cce73
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Dcvxaamev.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\Dcvxaamev.exe
                                            • Size 328KB
                                            • SHA256 6d50833895b2e3eb9d6f879a6436660127c270b6a516cda0253e56a3d8b7fba0
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            FFDvbcrdfqs.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\FFDvbcrdfqs.exe
                                            • Size 284KB
                                            • SHA256 308a15dabdc4ce6b96dd54954a351d304f1fcb59e8c93221ba1c412bcdfd1c44
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            holderwb.txt
                                            • Path C:\Users\Admin\AppData\Local\Temp\holderwb.txt
                                            • Size 3KB
                                            • SHA256 a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            svchos.exe
                                            • Path C:\Users\Admin\AppData\Local\Temp\svchos.exe
                                            • Size 93KB
                                            • SHA256 62954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            tmpCCD5.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpCCD5.tmp
                                            • Size 1KB
                                            • SHA256 d3035bd90ad0e9fedeecb44da09e78421b5e6e1e0bbed1afc624750043355540
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            tmpD543.tmp
                                            • Path C:\Users\Admin\AppData\Local\Temp\tmpD543.tmp
                                            • Size 1KB
                                            • SHA256 d4ba6219d0aff5a36d129a8475cf35b00043d205f751f63ddd56a5c7d4a03ff3
                                            • MD5 SHA1 SHA512
                                            Submit Download

                                            0fd7de5367376231a788872005d7ed4f.exe
                                            • Path C:\Users\Admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
                                            • Size 536KB
                                            • SHA256 9083992637e90e412e6f4e77331eb69ee8db821c54bbc38533e0f889cc4ca9dd
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            22.exe
                                            • Path C:\Users\Admin\AppData\Roaming\22.exe
                                            • Size 2.0MB
                                            • SHA256 a604a3ff78644533fac5ee9f198e9c5f2fa1ae2a5828186367a9e00935cff6b6
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            3.exe
                                            • Path C:\Users\Admin\AppData\Roaming\3.exe
                                            • Size 564KB
                                            • SHA256 220d8f8ff82d413c81bd02dfa001e1c478e8fbea44bad24f21b3a5284e15632e
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            4.exe
                                            • Path C:\Users\Admin\AppData\Roaming\4.exe
                                            • Size 565KB
                                            • SHA256 8b4b846fe1023fa173ab410e3a5862a4c09f16534e14926878e387092e7ffb63
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            8f1c8b40c7be588389a8d382040b23bb.exe
                                            • Path C:\Users\Admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe
                                            • Size 1.2MB
                                            • SHA256 ed58ffee46a583c177c792b56c9fc20ccd9509d125f2e3fc90c4f48de7e2c2a1
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            HD____11.19.exe
                                            • Path C:\Users\Admin\AppData\Roaming\HD____11.19.exe
                                            • Size 14.3MB
                                            • SHA256 d987bd57582a22dfc65901ff256eda635dc8dad598c93b200002130b87fcfd97
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Opus.exe
                                            • Path C:\Users\Admin\AppData\Roaming\Opus.exe
                                            • Size 203KB
                                            • SHA256 9384798985672c356a8a41bf822443f8eb0d3747bfca148ce814594c1a894641
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Pluto Panel.exe
                                            • Path C:\Users\Admin\AppData\Roaming\Pluto Panel.exe
                                            • Size 892KB
                                            • SHA256 d1330d349bfbd3aea545fa08ef63339e82a3f4d04e27216ecc4c45304f079264
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            ___11.19.exe
                                            • Path C:\Users\Admin\AppData\Roaming\___11.19.exe
                                            • Size 15.6MB
                                            • SHA256 8ecdfe60eacb5bf647ae69bcbc41dd727ea3089e92b4b08ebca3a8d162e50745
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            a.exe
                                            • Path C:\Users\Admin\AppData\Roaming\a.exe
                                            • Size 1.4MB
                                            • SHA256 5975e737584ddf2601c02e5918a79dad7531df0e13dca922f0525f66bec4b448
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            aaa.exe
                                            • Path C:\Users\Admin\AppData\Roaming\aaa.exe
                                            • Size 120KB
                                            • SHA256 5430565c4534b482c7216a0ae75d04e201ee0db0386682c0c010243083c28d29
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            gay.exe
                                            • Path C:\Users\Admin\AppData\Roaming\gay.exe
                                            • Size 37KB
                                            • SHA256 0184983a425fef55d46b7e0eb729a245730ee26414ebe4b155917c0124a19c2d
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            healastounding.exe
                                            • Path C:\Users\Admin\AppData\Roaming\healastounding.exe
                                            • Size 3.6MB
                                            • SHA256 b4f86ff48c5f6b01e0ad4543fb78e0435e81f3ec2aaca89866862157c0dacf4f
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            test.exe
                                            • Path C:\Users\Admin\AppData\Roaming\test.exe
                                            • Size 45KB
                                            • SHA256 a8dde4e60db080dfc397d7e312e7e9f18d9c08d6088e8043feeae9ab32abdbb8
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Unconfirmed 694643.crdownload
                                            • Path C:\Users\Admin\Downloads\Unconfirmed 694643.crdownload
                                            • Size 13.6MB
                                            • SHA256 be5389a28e952d7ab2d9447c1bdb8eb7d11b24cb02e4b18da367715c2acfdd15
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Winlogon.exe
                                            • Path C:\Windows\Help\Winlogon.exe
                                            • Size 74KB
                                            • SHA256 6e81d7c71b3e8d731e11ad75d3dac02a4210c9f90fac618af5c00cbce3718658
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            active_desktop_render.dll
                                            • Path C:\Windows\Help\active_desktop_render.dll
                                            • Size 972KB
                                            • SHA256 1fb4cee4d83d424e0bfcbfd97169ef717b3ebdcc5d01ba7c7c547ae606ad5c3c
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            240629765.txt
                                            • Path C:\Windows\SysWOW64\240629765.txt
                                            • Size 50KB
                                            • SHA256 4d53ccb9a375d968ac7bd0670f3cda71d195bae334445d97c46e96b6dbe34a84
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            TXPlatforn.exe
                                            • Path C:\Windows\SysWOW64\TXPlatforn.exe
                                            • Size 377KB
                                            • SHA256 6156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
                                            • Path C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe
                                            • Size 60KB
                                            • SHA256 6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            hitmanpro37.sys
                                            • Path C:\Windows\System32\drivers\hitmanpro37.sys
                                            • Size 41KB
                                            • SHA256 eb5d9df12ae2770d0e5558e8264cbb1867c618217d10b5115690ab4dcfe893c6
                                            • MD5 SHA1 SHA512 SSDEEP
                                            Submit Download

                                            memory/764-153-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/764-152-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/764-149-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/788-204-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/788-179-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/788-218-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/788-229-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/788-185-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/788-184-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/1492-301-0x0000000000980000-0x000000000098C000-memory.dmp
                                            Download

                                            memory/1492-325-0x00000000009B0000-0x00000000009BC000-memory.dmp
                                            Download

                                            memory/1492-265-0x0000000000140000-0x00000000001D4000-memory.dmp
                                            Download

                                            memory/1492-302-0x0000000000990000-0x000000000099A000-memory.dmp
                                            Download

                                            memory/1492-303-0x00000000009A0000-0x00000000009AC000-memory.dmp
                                            Download

                                            memory/1820-47-0x0000000000400000-0x0000000000625000-memory.dmp
                                            Download

                                            memory/2336-121-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/2336-118-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/2336-120-0x0000000010000000-0x00000000101B6000-memory.dmp
                                            Download

                                            memory/2908-109-0x00000000008B0000-0x00000000008C2000-memory.dmp
                                            Download

                                            memory/3636-30-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/3636-151-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/3636-50-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/3636-44-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/3636-364-0x0000000000400000-0x0000000000495000-memory.dmp
                                            Download

                                            memory/3636-362-0x0000000000400000-0x0000000000495000-memory.dmp
                                            Download

                                            memory/3888-427-0x00007FF612BA0000-0x00007FF613120000-memory.dmp
                                            Download

                                            memory/3888-451-0x00007FF612BA0000-0x00007FF613120000-memory.dmp
                                            Download

                                            memory/4068-1-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/4068-67-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/4068-0-0x0000000074E62000-0x0000000074E63000-memory.dmp
                                            Download

                                            memory/4068-2-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/4384-382-0x0000015BBDE20000-0x0000015BBDE21000-memory.dmp
                                            Download

                                            memory/4384-379-0x0000015BBDE20000-0x0000015BBDE21000-memory.dmp
                                            Download

                                            memory/4384-378-0x0000015BBDE20000-0x0000015BBDE21000-memory.dmp
                                            Download

                                            memory/4384-372-0x0000015BBDE20000-0x0000015BBDE21000-memory.dmp
                                            Download

                                            memory/4384-380-0x0000015BBDE20000-0x0000015BBDE21000-memory.dmp
                                            Download

                                            memory/4384-381-0x0000015BBDE20000-0x0000015BBDE21000-memory.dmp
                                            Download

                                            memory/4384-373-0x0000015BBDE20000-0x0000015BBDE21000-memory.dmp
                                            Download

                                            memory/4384-383-0x0000015BBDE20000-0x0000015BBDE21000-memory.dmp
                                            Download

                                            memory/4384-374-0x0000015BBDE20000-0x0000015BBDE21000-memory.dmp
                                            Download

                                            memory/4448-306-0x00000000060E0000-0x00000000064A2000-memory.dmp
                                            Download

                                            memory/4448-312-0x00000000060E0000-0x00000000064A2000-memory.dmp
                                            Download

                                            memory/4448-239-0x0000000000400000-0x00000000019AA000-memory.dmp
                                            Download

                                            memory/4448-361-0x0000000000400000-0x00000000019AA000-memory.dmp
                                            Download

                                            memory/4448-323-0x00000000060E0000-0x00000000064A2000-memory.dmp
                                            Download

                                            memory/4448-315-0x00000000060E0000-0x00000000064A2000-memory.dmp
                                            Download

                                            memory/4448-319-0x00000000060E0000-0x00000000064A2000-memory.dmp
                                            Download

                                            memory/4448-304-0x00000000060E0000-0x00000000064A2000-memory.dmp
                                            Download

                                            memory/4448-329-0x00000000060E0000-0x00000000064A2000-memory.dmp
                                            Download

                                            memory/4448-309-0x00000000060E0000-0x00000000064A2000-memory.dmp
                                            Download

                                            memory/4448-465-0x0000000000400000-0x00000000019AA000-memory.dmp
                                            Download

                                            memory/4464-356-0x0000000000400000-0x000000000041B000-memory.dmp
                                            Download

                                            memory/4464-354-0x0000000000400000-0x000000000041B000-memory.dmp
                                            Download

                                            memory/4464-353-0x0000000000400000-0x000000000041B000-memory.dmp
                                            Download

                                            memory/4464-355-0x0000000000420000-0x00000000004E9000-memory.dmp
                                            Download

                                            memory/4812-176-0x0000000000400000-0x00000000007C2000-memory.dmp
                                            Download

                                            memory/4812-146-0x0000000000400000-0x00000000007C2000-memory.dmp
                                            Download

                                            memory/4812-219-0x00000000064A0000-0x00000000064DC000-memory.dmp
                                            Download

                                            memory/4812-213-0x0000000006390000-0x000000000649A000-memory.dmp
                                            Download

                                            memory/4812-205-0x0000000005CB0000-0x00000000062C8000-memory.dmp
                                            Download

                                            memory/4812-211-0x0000000006370000-0x0000000006382000-memory.dmp
                                            Download

                                            memory/4812-174-0x0000000000400000-0x00000000007C2000-memory.dmp
                                            Download

                                            memory/4812-235-0x0000000006520000-0x000000000656C000-memory.dmp
                                            Download

                                            memory/4828-58-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/4828-62-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/4828-339-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/4828-344-0x0000000074E60000-0x0000000075411000-memory.dmp
                                            Download

                                            memory/5052-165-0x0000000000400000-0x000000000044F000-memory.dmp
                                            Download

                                            memory/5052-172-0x0000000000400000-0x000000000044F000-memory.dmp
                                            Download

                                            memory/5052-332-0x0000000000400000-0x000000000044F000-memory.dmp
                                            Download