metasploit | 12fce52d084a8c7efa638c88fa2307bca7c038a49fe566ebb05533cacf17efbd

max time kernel
77s
max time network
79s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
21/01/2025, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

764KB
MD5

85e3d4ac5a6ef32fb93764c090ef32b7
SHA1

adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA256

4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
SHA512

a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP

12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH

Score

10^/10

metasploit stealc vidar xred xworm 41d35cbb974bc2d1287dcd4381b4a2a8 a21440e9f7223be06be5f5e2f94969c7 backdoor credential_access discovery execution persistence pyinstaller rat spyware stealer trojan

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

metasploit

Version

windows/reverse_tcp

89.197.154.116:7810

Extracted

Family

xworm

Version

5.0

police-turkish.gl.at.ply.gg:46359

Mutex

98LKJ8osZWR75pSw

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

vidar

Version

11.8

Botnet

41d35cbb974bc2d1287dcd4381b4a2a8

https://t.me/fu4chmo

https://steamcommunity.com/profiles/76561199802540894

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Extracted

Family

vidar

Version

11.3

Botnet

a21440e9f7223be06be5f5e2f94969c7

https://t.me/asg7rd

https://steamcommunity.com/profiles/76561199794498376

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

Detect Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0005000000025dac-464.dat	family_vidar_v7
behavioral1/memory/396-467-0x0000000000F30000-0x0000000001189000-memory.dmp	family_vidar_v7
behavioral1/memory/396-646-0x0000000000F30000-0x0000000001189000-memory.dmp	family_vidar_v7
behavioral1/files/0x00030000000006a3-673.dat	family_vidar_v7
behavioral1/memory/6060-681-0x0000000000A40000-0x0000000000D40000-memory.dmp	family_vidar_v7
behavioral1/memory/6060-698-0x0000000000A40000-0x0000000000D40000-memory.dmp	family_vidar_v7

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x001900000002abea-316.dat	family_xworm
behavioral1/memory/2496-323-0x00000000002C0000-0x00000000002CE000-memory.dmp	family_xworm

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1240	powershell.exe
964	powershell.exe
2604	powershell.exe
4128	powershell.exe
2748	powershell.exe
3112	powershell.exe
4468	powershell.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 7 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
5620	chrome.exe
4436	chrome.exe
3184	chrome.exe
3196	chrome.exe
6060	msedge.exe
5812	msedge.exe
5464	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Fast%20Download.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\afaa3c0e.exe	explorer.exe

Executes dropped EXE 16 IoCs

pid	Process
3380	._cache_4363463463464363463463463.exe
2988	Synaptics.exe
2948	._cache_Synaptics.exe
3164	Tracker.exe
3560	1.exe
4440	evetbeta.exe
3804	mimilove.exe
2496	svchost.exe
4804	Fast%20Download.exe
3828	TT18.exe
396	ZNC3xlsr8.exe
440	VB.NET%20CRYPTER%20V2.exe
6060	njrtdhadawt.exe
1912	main.exe
5468	main.exe
1584	CryptoWall.exe

Loads dropped DLL 41 IoCs

pid	Process
6060	njrtdhadawt.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe
5468	main.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*faa3c0 = "C:\\afaa3c0e\\afaa3c0e.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\afaa3c0e = "C:\\Users\\Admin\\AppData\\Roaming\\afaa3c0e.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*faa3c0e = "C:\\Users\\Admin\\AppData\\Roaming\\afaa3c0e.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	4363463463464363463463463.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Windows\CurrentVersion\Run\afaa3c0 = "C:\\afaa3c0e\\afaa3c0e.exe"	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
9	raw.githubusercontent.com
36	raw.githubusercontent.com
40	raw.githubusercontent.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-addr.es
77	ip-addr.es

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00030000000006a1-700.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TT18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VB.NET%20CRYPTER%20V2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tracker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	njrtdhadawt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mimilove.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZNC3xlsr8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	evetbeta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fast%20Download.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ZNC3xlsr8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ZNC3xlsr8.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	njrtdhadawt.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	njrtdhadawt.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
5852	timeout.exe
4584	timeout.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
5556	taskkill.exe
5124	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133818988817616364"	chrome.exe

Modifies registry class 50 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff	VB.NET%20CRYPTER%20V2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3870231897-2573482396-1083937135-1000\{8A150ACC-CFA7-40FF-B35B-C533E9B0E52F}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1"	VB.NET%20CRYPTER%20V2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	VB.NET%20CRYPTER%20V2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	VB.NET%20CRYPTER%20V2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 500031000000000047598863100041646d696e003c0009000400efbe4759855e355ae7102e0000002c570200000001000000000000000000000000000000d3b69b00410064006d0069006e00000014000000	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 7e003100000000004759e56211004465736b746f7000680009000400efbe4759855e355ae8102e000000365702000000010000000000000000003e0000000000ea8f29014400650073006b0074006f007000000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370036003900000016000000	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	VB.NET%20CRYPTER%20V2.exe
Key created	\Registry\User\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\NotificationData	VB.NET%20CRYPTER%20V2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	VB.NET%20CRYPTER%20V2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	OpenWith.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	4363463463464363463463463.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	VB.NET%20CRYPTER%20V2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000004759855e1100557365727300640009000400efbec5522d60355ae7102e0000006c0500000000010000000000000000003a0000000000753f7d0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	VB.NET%20CRYPTER%20V2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	VB.NET%20CRYPTER%20V2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	VB.NET%20CRYPTER%20V2.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	VB.NET%20CRYPTER%20V2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	VB.NET%20CRYPTER%20V2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	VB.NET%20CRYPTER%20V2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	VB.NET%20CRYPTER%20V2.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5028	EXCEL.EXE
1764	vlc.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
1240	powershell.exe
1240	powershell.exe
2748	powershell.exe
2748	powershell.exe
2748	powershell.exe
3112	powershell.exe
3112	powershell.exe
3112	powershell.exe
4468	powershell.exe
4468	powershell.exe
4468	powershell.exe
964	powershell.exe
964	powershell.exe
964	powershell.exe
2604	powershell.exe
2604	powershell.exe
2604	powershell.exe
4128	powershell.exe
4128	powershell.exe
4128	powershell.exe
1296	chrome.exe
1296	chrome.exe
396	ZNC3xlsr8.exe
396	ZNC3xlsr8.exe
6060	njrtdhadawt.exe
6060	njrtdhadawt.exe
5620	chrome.exe
5620	chrome.exe
924	msedge.exe
924	msedge.exe
1368	msedge.exe
1368	msedge.exe
5864	msedge.exe
5864	msedge.exe
5464	msedge.exe
5464	msedge.exe
5812	msedge.exe
5812	msedge.exe
6060	msedge.exe
6060	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1764	vlc.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1584	CryptoWall.exe
4676	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeDebugPrivilege	3380	._cache_4363463463464363463463463.exe
Token: SeDebugPrivilege	2948	._cache_Synaptics.exe
Token: SeDebugPrivilege	1240	powershell.exe
Token: SeDebugPrivilege	3828	TT18.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeDebugPrivilege	3112	powershell.exe
Token: SeDebugPrivilege	2496	svchost.exe
Token: SeDebugPrivilege	4468	powershell.exe
Token: SeDebugPrivilege	964	powershell.exe
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	4128	powershell.exe
Token: SeDebugPrivilege	4804	Fast%20Download.exe
Token: 33	4804	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	4804	Fast%20Download.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: 33	4804	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	4804	Fast%20Download.exe
Token: SeShutdownPrivilege	1296	chrome.exe
Token: SeCreatePagefilePrivilege	1296	chrome.exe
Token: 33	4804	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	4804	Fast%20Download.exe
Token: 33	4804	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	4804	Fast%20Download.exe
Token: SeDebugPrivilege	5556	taskkill.exe
Token: SeShutdownPrivilege	5620	chrome.exe
Token: SeCreatePagefilePrivilege	5620	chrome.exe
Token: 33	4804	Fast%20Download.exe
Token: SeIncBasePriorityPrivilege	4804	Fast%20Download.exe
Token: SeShutdownPrivilege	5620	chrome.exe
Token: SeCreatePagefilePrivilege	5620	chrome.exe
Token: SeShutdownPrivilege	5620	chrome.exe
Token: SeCreatePagefilePrivilege	5620	chrome.exe
Token: SeShutdownPrivilege	5620	chrome.exe
Token: SeCreatePagefilePrivilege	5620	chrome.exe
Token: SeShutdownPrivilege	5620	chrome.exe
Token: SeCreatePagefilePrivilege	5620	chrome.exe
Token: SeDebugPrivilege	5124	taskkill.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
4440	evetbeta.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
5620	chrome.exe
5620	chrome.exe
6060	msedge.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
4440	evetbeta.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1764	vlc.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe
1296	chrome.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
5028	EXCEL.EXE
4468	OpenWith.exe
1764	vlc.exe
440	VB.NET%20CRYPTER%20V2.exe
440	VB.NET%20CRYPTER%20V2.exe
2296	AcroRd32.exe
2296	AcroRd32.exe
2296	AcroRd32.exe
2296	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 3380	3740	4363463463464363463463463.exe	78
PID 3740 wrote to memory of 3380	3740	4363463463464363463463463.exe	78
PID 3740 wrote to memory of 3380	3740	4363463463464363463463463.exe	78
PID 3740 wrote to memory of 2988	3740	4363463463464363463463463.exe	80
PID 3740 wrote to memory of 2988	3740	4363463463464363463463463.exe	80
PID 3740 wrote to memory of 2988	3740	4363463463464363463463463.exe	80
PID 2988 wrote to memory of 2948	2988	Synaptics.exe	81
PID 2988 wrote to memory of 2948	2988	Synaptics.exe	81
PID 2988 wrote to memory of 2948	2988	Synaptics.exe	81
PID 2948 wrote to memory of 3164	2948	._cache_Synaptics.exe	85
PID 2948 wrote to memory of 3164	2948	._cache_Synaptics.exe	85
PID 2948 wrote to memory of 3164	2948	._cache_Synaptics.exe	85
PID 2948 wrote to memory of 3560	2948	._cache_Synaptics.exe	86
PID 2948 wrote to memory of 3560	2948	._cache_Synaptics.exe	86
PID 3560 wrote to memory of 1508	3560	1.exe	87
PID 3560 wrote to memory of 1508	3560	1.exe	87
PID 1508 wrote to memory of 4828	1508	cmd.exe	89
PID 1508 wrote to memory of 4828	1508	cmd.exe	89
PID 4828 wrote to memory of 1444	4828	net.exe	90
PID 4828 wrote to memory of 1444	4828	net.exe	90
PID 1508 wrote to memory of 1240	1508	cmd.exe	91
PID 1508 wrote to memory of 1240	1508	cmd.exe	91
PID 2948 wrote to memory of 4440	2948	._cache_Synaptics.exe	94
PID 2948 wrote to memory of 4440	2948	._cache_Synaptics.exe	94
PID 2948 wrote to memory of 4440	2948	._cache_Synaptics.exe	94
PID 3380 wrote to memory of 3804	3380	._cache_4363463463464363463463463.exe	96
PID 3380 wrote to memory of 3804	3380	._cache_4363463463464363463463463.exe	96
PID 3380 wrote to memory of 3804	3380	._cache_4363463463464363463463463.exe	96
PID 3380 wrote to memory of 2496	3380	._cache_4363463463464363463463463.exe	98
PID 3380 wrote to memory of 2496	3380	._cache_4363463463464363463463463.exe	98
PID 3380 wrote to memory of 4804	3380	._cache_4363463463464363463463463.exe	99
PID 3380 wrote to memory of 4804	3380	._cache_4363463463464363463463463.exe	99
PID 3380 wrote to memory of 4804	3380	._cache_4363463463464363463463463.exe	99
PID 3380 wrote to memory of 3828	3380	._cache_4363463463464363463463463.exe	100
PID 3380 wrote to memory of 3828	3380	._cache_4363463463464363463463463.exe	100
PID 3380 wrote to memory of 3828	3380	._cache_4363463463464363463463463.exe	100
PID 3828 wrote to memory of 2748	3828	TT18.exe	102
PID 3828 wrote to memory of 2748	3828	TT18.exe	102
PID 3828 wrote to memory of 2748	3828	TT18.exe	102
PID 2748 wrote to memory of 3112	2748	powershell.exe	104
PID 2748 wrote to memory of 3112	2748	powershell.exe	104
PID 2748 wrote to memory of 3112	2748	powershell.exe	104
PID 3828 wrote to memory of 4468	3828	TT18.exe	105
PID 3828 wrote to memory of 4468	3828	TT18.exe	105
PID 3828 wrote to memory of 4468	3828	TT18.exe	105
PID 4468 wrote to memory of 964	4468	powershell.exe	107
PID 4468 wrote to memory of 964	4468	powershell.exe	107
PID 4468 wrote to memory of 964	4468	powershell.exe	107
PID 3828 wrote to memory of 2604	3828	TT18.exe	108
PID 3828 wrote to memory of 2604	3828	TT18.exe	108
PID 3828 wrote to memory of 2604	3828	TT18.exe	108
PID 2604 wrote to memory of 4128	2604	powershell.exe	110
PID 2604 wrote to memory of 4128	2604	powershell.exe	110
PID 2604 wrote to memory of 4128	2604	powershell.exe	110
PID 4804 wrote to memory of 3200	4804	Fast%20Download.exe	111
PID 4804 wrote to memory of 3200	4804	Fast%20Download.exe	111
PID 4804 wrote to memory of 3200	4804	Fast%20Download.exe	111
PID 4804 wrote to memory of 4144	4804	Fast%20Download.exe	112
PID 4804 wrote to memory of 4144	4804	Fast%20Download.exe	112
PID 4804 wrote to memory of 4144	4804	Fast%20Download.exe	112
PID 3828 wrote to memory of 396	3828	TT18.exe	115
PID 3828 wrote to memory of 396	3828	TT18.exe	115
PID 3828 wrote to memory of 396	3828	TT18.exe	115
PID 1296 wrote to memory of 1704	1296	chrome.exe	120

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3200	attrib.exe
4144	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3804
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:3200
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Views/modifies file attributes
      PID:4144
- - C:\Users\Admin\AppData\Local\Temp\Files\TT18.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\TT18.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3828
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\ISxnozSOF'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\ISxnozSOF
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4468
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:964
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4128
  - - C:\ISxnozSOF\ZNC3xlsr8.exe
      "C:\ISxnozSOF\ZNC3xlsr8.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:396
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\ISxnozSOF\ZNC3xlsr8.exe" & rd /s /q "C:\ProgramData\EGHCBKKKFHCG" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Files\njrtdhadawt.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\njrtdhadawt.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:6060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\njrtdhadawt.exe" & rd /s /q "C:\ProgramData\GIIIECBGDHJJ" & exit
      4⤵
      System Location Discovery: System Language Discovery
      PID:5276
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4584
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Users\Admin\AppData\Local\Temp\Files\Tracker.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Tracker.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Files\1.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3560
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c "yo.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1508
      - C:\Windows\system32\net.exe
        
        net session
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        7⤵
        
        PID:1444
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\AddExclusion.ps1"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\Files\evetbeta.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\evetbeta.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Files\VB.NET%20CRYPTER%20V2.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\VB.NET%20CRYPTER%20V2.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:440
  - - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
      4⤵
      Executes dropped EXE
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5468
      - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5556
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5620
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8dcc6cc40,0x7ff8dcc6cc4c,0x7ff8dcc6cc58
        7⤵
        
        PID:5500
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1936,i,9317342818212235020,18190764213760169499,262144 --variations-seed-version=20250119-180455.285000 --mojo-platform-channel-handle=1932 /prefetch:2
        7⤵
        
        PID:3644
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-appcompat-clear --field-trial-handle=1752,i,9317342818212235020,18190764213760169499,262144 --variations-seed-version=20250119-180455.285000 --mojo-platform-channel-handle=1952 /prefetch:3
        7⤵
        
        PID:2960
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-appcompat-clear --field-trial-handle=1996,i,9317342818212235020,18190764213760169499,262144 --variations-seed-version=20250119-180455.285000 --mojo-platform-channel-handle=2320 /prefetch:8
        7⤵
        
        PID:3112
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2852,i,9317342818212235020,18190764213760169499,262144 --variations-seed-version=20250119-180455.285000 --mojo-platform-channel-handle=2872 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:4436
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2876,i,9317342818212235020,18190764213760169499,262144 --variations-seed-version=20250119-180455.285000 --mojo-platform-channel-handle=3048 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3184
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3988,i,9317342818212235020,18190764213760169499,262144 --variations-seed-version=20250119-180455.285000 --mojo-platform-channel-handle=4000 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3196
      - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5124
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:/Program Files (x86)/Microsoft/Edge/Application/msedge.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
        6⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:6060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8dbab3cb8,0x7ff8dbab3cc8,0x7ff8dbab3cd8
        7⤵
        
        PID:1380
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1836,11384901476525558636,17642951258771275432,131072 --no-sandbox --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1888 /prefetch:2
        7⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:1368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1836,11384901476525558636,17642951258771275432,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --mojo-platform-channel-handle=1992 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:924
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1836,11384901476525558636,17642951258771275432,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --mojo-platform-channel-handle=2456 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5864
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=1836,11384901476525558636,17642951258771275432,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2872 /prefetch:1
        7⤵
        Uses browser remote debugging
        Suspicious behavior: EnumeratesProcesses
        
        PID:5464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-sandbox --remote-debugging-port=9222 --field-trial-handle=1836,11384901476525558636,17642951258771275432,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
        7⤵
        Uses browser remote debugging
        Suspicious behavior: EnumeratesProcesses
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      PID:1584
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\syswow64\explorer.exe"
        5⤵
        Drops startup file
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: MapViewOfSection
        
        PID:4676
      - C:\Windows\SysWOW64\svchost.exe
        
        -k netsvcs
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5992

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5028

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4236

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4468

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\CloseConfirm.M2TS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ff8dcc6cc40,0x7ff8dcc6cc4c,0x7ff8dcc6cc58
  2⤵
  PID:1704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1876,i,464191971452773083,17378218445490331749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1924,i,464191971452773083,17378218445490331749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1940 /prefetch:3
  2⤵
  PID:872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2124,i,464191971452773083,17378218445490331749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2188 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,464191971452773083,17378218445490331749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3088,i,464191971452773083,17378218445490331749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4416,i,464191971452773083,17378218445490331749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4672,i,464191971452773083,17378218445490331749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4736 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4764,i,464191971452773083,17378218445490331749,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:5200

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5132

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2296

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ISxnozSOF\ZNC3xlsr8.exe

Filesize
275KB

MD5
0a7b3454fdad8431bd3523648c915665

SHA1
800a97a7c1a92a92cac76afc1fe5349895ee5287

SHA256
baf217d7bb8f3a86856def6891638318a94ed5d7082149d4dd4cb755d90d86ce

SHA512
020e45eaeee083d6739155d9a821ab54dd07f1320b8efb73871ee5d29188122fdbb7d39b34a8b3694a8b0c08ae1801ec370e40ff8d837c9190a72905f26baff9

Download Submit
C:\ProgramData\Synaptics\Synaptics.exe

Filesize
764KB

MD5
85e3d4ac5a6ef32fb93764c090ef32b7

SHA1
adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52

SHA256
4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1

SHA512
a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab

Download Submit
C:\ProgramData\chrome.dll

Filesize
676KB

MD5
eda18948a989176f4eebb175ce806255

SHA1
ff22a3d5f5fb705137f233c36622c79eab995897

SHA256
81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

SHA512
160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
2KB

MD5
981cda4f86cd04153bbd5acba3f500cb

SHA1
4399652cc167a54c3a6261eef6363c240e0a029b

SHA256
87b46f555675999742ecf4b2fefe257831d6bcca5a2219ad6eec8485788c3363

SHA512
82746eab8497af1935b6da210568998bb55720819703dea3779d59ed3e555302eea784f29deecdea6f1ed1361fa505c0bf77dbb54a058627a24a699867ba850e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E3D1101CFA1A79AF305FD7C55E37649_A8EAC700FEE71EDD327E06BEAA0C7F96

Filesize
2KB

MD5
535b4fb89b5a6fbc6568c6bf767ad55d

SHA1
13e6b4c75556049046e8c2f5eb517c2a2483169f

SHA256
b13d2692d9438f3b49c6f62de13d82179e22e0b63683d203d6db27f0685ba724

SHA512
1c5f9578ad9ba834642416c5ae295eb3c892b745cb10c81367487122a81e2d38f3686e4cb69b3b120d618d9c2f4a52704f563d2b8d2237a0fad8841002b159b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
1KB

MD5
0061875e53e6218b9e6112f605d69a27

SHA1
ca679bf6ffb12a423be22703edcfe52865fe1443

SHA256
83a62344b7ae512cb1cf60864a45ad4299e616d4b804e2193854e95932d8c5ab

SHA512
c0c5362ad06c77525399bffcd92886bcaa9807c1211d320facd8a84399d5eec9f251ce4e50c22d05c81c416bc3e4b006ab672d232747c9b5952de97a9ddf4af7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
ecb11866baf048b1c880357281ab4630

SHA1
da031312a9dee71e7a5f8f1c8e7e63f3f4a5a187

SHA256
412b14d7df4eeff78b512ce6b176aba00e100bdc3fa94ded5fd15ae3076e3f25

SHA512
7d22a5d6378df9cee1216678a442a2cdedd2bf4814e3976950ea93c92dce9f565a2258bbdc41f93878bfb3c6288f8b2303e0e30e335e652bcab811f5da2db0c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Filesize
450B

MD5
f00b8a8f78643c7363f7f2735893b901

SHA1
25252d6b82bb42a9e5209c3573126583642c8361

SHA256
8fddd814abacfb62262d02409824944edcdf430d80866bcb0ee9a5e7b85bf27c

SHA512
f933fc9c4586eea47f77dab752107aaac65383f3238b0d7c04cbafdf97e6506ca307ff806249df74a061c3d0f3c4f246856183300df4119eec5fafa3fa249147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E3D1101CFA1A79AF305FD7C55E37649_A8EAC700FEE71EDD327E06BEAA0C7F96

Filesize
474B

MD5
027a53cf95d0e4e247d29b1dd30b0db2

SHA1
37114adb3451223e73fe2d4f98b05bb9058dc9c5

SHA256
b7fdae31b779b02cc83d339ab42628056a5129f18404048b2453e60c66306689

SHA512
de9e442b03149149df429d39b79ce9406aae4fd0ab50abb132987d5b22bd29afada8eaa96ec9c3588f2cefb5a40958122c5efc55fee3a140a71c5cb67ac0c3ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Filesize
458B

MD5
1947f32be508bb03a3e971f40f83c3f9

SHA1
5f3643315b6c77a69cc1ae9741c4c0eb0c839093

SHA256
da7394f62b2667d7d07a104460cf50329d6dd8bb0e4fb303ac5ebf507243e2c8

SHA512
226f258f36ad2463ab29e69702abc8f90414a65699528ae3937f2cc4377b4786f918d30e192b8dd42f8e5188c7331a86ed7ea1d481d73ac7bad8164673e54f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
87815ec76d383a410f75a5064cd92c98

SHA1
cd64febf40433b3287574b0dd3c2a0ed909af1c5

SHA256
e859a31a5a83f20ee09d695c7e542b80330bc1afc49ddea85d67291835470127

SHA512
0141ec25061a2c19e1a010b71c3b02848270d1fc546593ce3c6cdf4135913a2abf9000759ff52b93736bc864214ac9391062b184f661c7b4e28b280845c822d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
46b257e2db3a3cab4fe4e8b36a53c612

SHA1
2327a773bca75530bc9bd7c74ef0ec3acbf99adf

SHA256
e7c310337da9c0b11f73414f116c230092a508f82fe7a57d2fb80a16d1d0973f

SHA512
6c9cdbac647aa323073edce54767cff14c7d54ae4b41034980833ccf8567d05985fb9a148772241f9a070622951af71e0cd943dddc1bbf445dc1c217393855e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
377c06fdbad3a9369e4cb019902dab94

SHA1
557182f1b48ea70f55aa6b96bbae6b705720787a

SHA256
ca97ca669129e5936a8533a000bc1decd5e577e8740ab614aa9ab1198f7b3b5b

SHA512
baeb91160dc0ad1ad340c0dc2aabc5d2b7700bf3bd7e9e63e392a3507e959d56fa17192983e2792084aceb5e8b9246f198e64cd1fe7a2f8fe471d58eca4ad424

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
3f2895487bedb6b68ca5b408f48c2a5f

SHA1
82fa271eff905af18949ec770dc9f402a984c3e9

SHA256
6499fb766d5f6bd3228a000a0c26982e4c84b851738cd92195ddaef3200b46d4

SHA512
9eb2022c2f987078282bf6670d22633d5420d0ecd9ad40943f3b4bb1e9a3f57c16db2857d609302e211fadb64b2ab82800c9c10fc359b74cac3385a57f6fb355

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
66c3575c909b2c74d1391fb2190bc1fb

SHA1
7aa98eeed0c134b94c7895d46e42ac29f383567c

SHA256
09855db0384bb219f74fc5d53beb1b775d66fb33b1d26c818e1fa75005360d54

SHA512
bc1b4e78b092eaeae8ea2122c54876952d0bc9dab7aff029848875b1e0c40596e700b4a7a50f9844ca3df5fda0f607e815271e91019179c6026e891618e69890

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
9cf799b0808b4c8459b530e6fd76c5a2

SHA1
50ce4eadff7a704cba0afe7c3729fd85672faa8f

SHA256
82fb611c02e285e5d1dde5e1e6cf0efb0516ded5d14cf79c62fe52d2ab043b88

SHA512
1e7c35d514a32c83c91ad968c1df39cfa9ee510d05e1e64d404327be13c4b5f64b858511dc5305009a748cc95b9117ee37538bf237fb08fe2f793ff18863358a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
9f9057ba62f159994092cecc8449fb39

SHA1
1a528f8bb08aefb2362a1ac54d6f08edfc6d4079

SHA256
4423f17be8112a4239d7a7c5d6dcef0de58ecda9404a89ff69ea120980f612ff

SHA512
07f82bfa64ee8c2045a4cf6894f2400beb4cd3f779173d18cfa7e8e0bb1a5f5c635db4ef18a5b09f288a0855935470c769fd7a6abf26daa3c98cf5229f196104

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
230KB

MD5
2ddcad9db2a9c1cfdb320b7bd9e8fe27

SHA1
828bc8419ea29c8471ec90a8faf4197ba2315519

SHA256
380beed788e7ccb59a64c092047a2c447473999ab88f8cdc52cd2b85170312ad

SHA512
b3be7e0ffad70c2992411fa2b3924126a532625554c807bf8993011acfd34c341e7c7c5ceb580eaa2da157b42eae3a81ae5d2522edd6444e8a70b547c947642b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\758163ab-887b-4be8-a261-09b05b647016.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8fce2147b91af6d365091e4ddb7855cd

SHA1
b7b8a661d8c053e05834886abff5357be071253a

SHA256
43f8d26d627fe35055d1ce9aca20e9b7fe896784213ac651816b8b15670e8c65

SHA512
83524aba2f33a5c057115578c2b357e209d20f1891ace5573a0a51ac0b8d9d595f62045bfc14513789b075ed5682b6adea97dadc0c47e6651b3ff79893c7f7d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
14KB

MD5
12244afab43c2c736d8ec3af5b89f228

SHA1
ed5f39c2db3f454a3764c5393b3927e07ae0f7e6

SHA256
7ef4891d4509fb3f5c84eebc7f87556e8262d2aa6d9e814ab657c548175ee601

SHA512
b93e255cc9bb74f72fb67ea85b72b86d4868cce0e43c8a8bb5751edb2a32d7d9cd68a1da4ca0113d09237d9bb56b170026556a4346572eecd0ed1470fc789022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
3fba69e4a2cc16e362649c3df8a35804

SHA1
5e7a850c53beb9a36ef3b00d0322e4ead84a66b7

SHA256
ce894778e6294feb6c9759555b618f18f53338b91995e2106ad7b4d0b8d412a1

SHA512
fe073e027aa4ba76b8ce526c91ed6b59e9b72a5010a6a1e9df204b261e3a64ed9889aae5282b11684629515501a6d8a2ea8e021488119ed0f0cd7dea8901ad0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
ea1dd45f8cd899f97ff32f60ce9cbdfb

SHA1
622a66cfd54438f7db1b746399d6ea2ca065bf9f

SHA256
11e8b8417a705745e50aadaa5c788d14281f9b62b32308f51fad6445422521b2

SHA512
d8cf615b01d52a998b993bbc6a1b5ce6ede02febdeb6dde4e401757dc37ae9f9ce2f490f1a3063f74ec30254594ccaced497528b7767cc302f50b46e563d7f2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
812ff943c4d32083841e2e14bd532785

SHA1
b304e4db6d565eb302935be2edd403f54fecabf4

SHA256
47b38c77b86e77f8ebfc8664b516ae16c79e05c11dbf41271eb020a47475dc1e

SHA512
4d47eed5bb2400371d26c58cd048a0e1f46327ae7601ee3cb5ab53c4701d986c54a8570807ecd06d3c45beb031e91e35bf9b05589a4a72e5cb53d129c7ec4aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe

Filesize
10KB

MD5
2a94f3960c58c6e70826495f76d00b85

SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\74A75E00

Filesize
23KB

MD5
f47c688c6f14a8f4024ccf61b14a0bcd

SHA1
f92c0161f935204196e3227cf536976dd123ad3b

SHA256
65d9902fcfcbcaf2f18781ce5e18d475b828be373032d387332d925d7213de7e

SHA512
1ee4c502c53c481193a2900fc6d454f911306e49b78d7b8e7f4564dd8d8fc5f2ac963e973f4a0f88d08f84949e2f32140bd343c41c7675d0b584ca2440d453e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\AddExclusion.ps1

Filesize
72B

MD5
bff23a9ba114f3a0a93710bbafc667ca

SHA1
b24d77d2b9fc06f6493a846dc97d61b30048d461

SHA256
8acfdd50f5146cf11c1a5ae8ccfe935b05395f9600e3889dc548a41f82cec6d6

SHA512
674bb88f5bfec52d409f53e1342007e9b595659d94cfa6b359b14b51f89a1c2f505ff061bffcfd84f0b6748b30143d0116f60ced4fd760391c400a5ad2634521

Download Submit
C:\Users\Admin\AppData\Local\Temp\AtD7rInh.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\1.exe

Filesize
154KB

MD5
2d019540d9821037f1c96050cf7f551b

SHA1
e11ad8ed9c9ec6491ee87d845c7676eea2d57b06

SHA256
b451357babe39ec8af9b1a56e8c981ed55b2941094940da50abd70222cb5f8a7

SHA512
884df45aa8d83aadb82f331fa4488419e43b7c774ce2b853913cc8178746d8f48d1c86966e689397a0df114ce8550dde9fb9303bd86fb18d73442b4f89243add

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe

Filesize
132KB

MD5
919034c8efb9678f96b47a20fa6199f2

SHA1
747070c74d0400cffeb28fbea17b64297f14cfbd

SHA256
e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

SHA512
745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Fast%20Download.exe

Filesize
27KB

MD5
97d80681daef809909ac1b1e3b9898ba

SHA1
f0ecc4ef701ea6ff61290f6fd4407049cd904e60

SHA256
345d5d2759abd08a84c4c2e2a337a1babd02b5eda3921db1b83eb5d5f5ccc011

SHA512
f90bb8868612f5bc52c07cf90c4e62daf47ba3a3418fae3a82030bff449d62cd83ce185b22fdae632abdb661c8e3a725cc5fa5c44e47ca34f9ccbda6fafd21da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\TT18.exe

Filesize
12KB

MD5
ceb5022b92f0429137dc0fb67371e901

SHA1
999932b537591401dfa1a74df00dae99264bd994

SHA256
8d2f2dce701f8dc555e74b53bfaf7a1337027adc7fadc094b2eba3bb5b688f1b

SHA512
a7acdf417ef81f131c050bc8bd364edddf7a2ebc446c69411d549c14ca8967af7b8c8a2d4556018f148d1b57bc985e10104cdc72e2bed518cfe3280b0254a3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Tracker.exe

Filesize
45KB

MD5
f230475fc30f6b8ab711a8582802c52d

SHA1
119b9985573bbc5ee98e454ba250bfc7e559c06d

SHA256
e1a9999e84e103771d0616d102f4d3e87c4228a081a0d93c0d59dba8b9a5678d

SHA512
3bc8ba17af9e5aafe3791c7280e5680080771140a13fc93685961dfb4b549c10964f6f39efbe50df48e2ca116c969d0e5896f85954175cab823b22a04006f412

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\VB.NET%20CRYPTER%20V2.exe

Filesize
44KB

MD5
36a3818dffb495845e8fd5d5c2037062

SHA1
2a0371fca65de0bac719e714ea0edfedba9fa19e

SHA256
937bad41776f92db2be7b231b184bac310570c3e031b01d024e9f0f5a0116e88

SHA512
e4873847693266f8f130db266e91d449db95620d5238a73a179e35495242b16cd438f1466e19d8673654f960855968666bcedb0eaed3336cc6c688bc7572d063

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\evetbeta.exe

Filesize
92KB

MD5
6f6137e6f85dc8dac7ff87ca4c86af4c

SHA1
fc047ad39f8f2f57fa6049e1883ccab24bea8f82

SHA256
a370eacabf4af9caa5502c39b40c95eda6be23666231e24da1b56277a222f3e9

SHA512
2a3d60bac0a40730b49d361d13000115539c448ef1ecbbffafa22ebe78fc9009db0846e84e7f3c3526d22d5531cedddae8fae7678f453e48876581824cd9dea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\main.exe

Filesize
10.4MB

MD5
9b3fafa68ef718b5b7bf3f1f46c698df

SHA1
cd2de4a0a94d42c278bab73d29d716369ec644f4

SHA256
2443d1fe25f8afbd5b9cd95fdb45e7c6c5b688e815f44f93158e534308d9f9fb

SHA512
a8f180bdf01a59a36e69708420774c2a8607869f8c34ae1e0d40b8298db3b9d88efd0251aa3444b9cdbadad1bf6d8b9d61fb270a41be18f81b10a0505b1b1f28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\mimilove.exe

Filesize
24KB

MD5
c67f3497c310c01018f599b3eebae99e

SHA1
d73e52e55b1ad65015886b3a01b1cc27c87e9952

SHA256
cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef

SHA512
1205b5a9a9d2f3fabcce7e53e70e4efce08b21469ae64120beaee67a828d12eeeecddc623b453105ed15990fcc7bbce53175eca6545007f9d68c0aee66e55bc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\njrtdhadawt.exe

Filesize
943KB

MD5
96e4917ea5d59eca7dd21ad7e7a03d07

SHA1
28c721effb773fdd5cb2146457c10b081a9a4047

SHA256
cab6c398667a4645b9ac20c9748f194554a76706047f124297a76296e3e7a957

SHA512
3414450d1a200ffdcc6e3cb477a0a11049e5e86e8d15ae5b8ed3740a52a0226774333492279092134364460b565a25a7967b987f2304355ecfd5825f86e61687

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe

Filesize
32KB

MD5
41138d08c05c7c0fc7d23c2364d8d90b

SHA1
3abfe164faf8597e4c2a9f27883f0a31238bcb13

SHA256
7e229099c42890098639bb0c37fe56ab5020b237884f039d3428a9d9018a84b2

SHA512
aea8d6f1294d8ee418a14022f638b6334f7b16675fa92b3705cf6493d7a0371b7acfaa375fefddcc9d12f869087d7a78ff767a679ca684a235bd17528ae9df53

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yo.bat

Filesize
466B

MD5
18b38d63fc221213d032e3dfc11566a3

SHA1
0e28db3426f495088c17da65fb124ef0609710ac

SHA256
87f13ab6599266825bc38f3288074e8bdcb191a14f5cf582dd076a0d15838900

SHA512
3c86c585bbf52d68e3fb00fde7d2b3fdca9ae983bf1c8e26dbb7aaf031463ad467cb2936552232f99f3e50c458ff9361d2a26c61958f457c180deaa0a0b4a7d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19122\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19122\_ctypes.pyd

Filesize
121KB

MD5
565d011ce1cee4d48e722c7421300090

SHA1
9dc300e04e5e0075de4c0205be2e8aae2064ae19

SHA256
c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7

SHA512
5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19122\base_library.zip

Filesize
1.4MB

MD5
18bc0b09751b5b52fbde8f7ddd7ddf82

SHA1
8b5899829110e730990ada7d0fe7899a96cc3fba

SHA256
cc41b4f03c4adca6aa46223cd57f39b23a45e3fc21de217df0ca4f409437d546

SHA512
363c188a443e0d7428f4d937c0cbbaccfbe04cff3dbf8d7d57e1fd842b0a07809d78b481fb880ba0b199b3d39ffda3e0e39578f5bcfcf322d45be0b5caea602b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI19122\python311.dll

Filesize
5.5MB

MD5
387bb2c1e40bde1517f06b46313766be

SHA1
601f83ef61c7699652dec17edd5a45d6c20786c4

SHA256
0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364

SHA512
521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fxbwr3co.m5r.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/396-646-0x0000000000F30000-0x0000000001189000-memory.dmp

Filesize
2.3MB

Download
memory/396-467-0x0000000000F30000-0x0000000001189000-memory.dmp

Filesize
2.3MB

Download
memory/440-540-0x0000000005240000-0x000000000524A000-memory.dmp

Filesize
40KB

Download
memory/440-538-0x0000000005810000-0x0000000005DB6000-memory.dmp

Filesize
5.6MB

Download
memory/440-541-0x00000000053A0000-0x00000000053F6000-memory.dmp

Filesize
344KB

Download
memory/440-539-0x0000000005300000-0x0000000005392000-memory.dmp

Filesize
584KB

Download
memory/440-537-0x0000000000830000-0x0000000000842000-memory.dmp

Filesize
72KB

Download
memory/964-416-0x000000006CC30000-0x000000006CC7C000-memory.dmp

Filesize
304KB

Download
memory/1240-265-0x00000151F19B0000-0x00000151F19D2000-memory.dmp

Filesize
136KB

Download
memory/1764-498-0x00007FF720150000-0x00007FF720248000-memory.dmp

Filesize
992KB

Download
memory/1764-499-0x00007FF8F1E20000-0x00007FF8F1E54000-memory.dmp

Filesize
208KB

Download
memory/1764-501-0x00007FF8DB320000-0x00007FF8DC3D0000-memory.dmp

Filesize
16.7MB

Download
memory/1764-500-0x00007FF8DC810000-0x00007FF8DCAC6000-memory.dmp

Filesize
2.7MB

Download
memory/2496-323-0x00000000002C0000-0x00000000002CE000-memory.dmp

Filesize
56KB

Download
memory/2748-351-0x0000000005BD0000-0x0000000005C36000-memory.dmp

Filesize
408KB

Download
memory/2748-349-0x0000000005430000-0x0000000005452000-memory.dmp

Filesize
136KB

Download
memory/2748-362-0x00000000062D0000-0x00000000062EE000-memory.dmp

Filesize
120KB

Download
memory/2748-348-0x00000000054C0000-0x0000000005AEA000-memory.dmp

Filesize
6.2MB

Download
memory/2748-350-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Filesize
408KB

Download
memory/2748-347-0x0000000004E50000-0x0000000004E86000-memory.dmp

Filesize
216KB

Download
memory/2748-360-0x0000000005DA0000-0x00000000060F7000-memory.dmp

Filesize
3.3MB

Download
memory/2748-363-0x0000000006360000-0x00000000063AC000-memory.dmp

Filesize
304KB

Download
memory/2988-490-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2988-280-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/2988-281-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/2988-130-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/2988-817-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/3112-386-0x0000000006F70000-0x0000000006F7A000-memory.dmp

Filesize
40KB

Download
memory/3112-373-0x000000006CC30000-0x000000006CC7C000-memory.dmp

Filesize
304KB

Download
memory/3112-372-0x0000000006D70000-0x0000000006DA4000-memory.dmp

Filesize
208KB

Download
memory/3112-382-0x0000000006D30000-0x0000000006D4E000-memory.dmp

Filesize
120KB

Download
memory/3112-383-0x0000000006DB0000-0x0000000006E54000-memory.dmp

Filesize
656KB

Download
memory/3112-384-0x0000000007530000-0x0000000007BAA000-memory.dmp

Filesize
6.5MB

Download
memory/3112-385-0x0000000006EF0000-0x0000000006F0A000-memory.dmp

Filesize
104KB

Download
memory/3112-392-0x0000000007230000-0x0000000007238000-memory.dmp

Filesize
32KB

Download
memory/3112-387-0x0000000007180000-0x0000000007216000-memory.dmp

Filesize
600KB

Download
memory/3112-391-0x0000000007240000-0x000000000725A000-memory.dmp

Filesize
104KB

Download
memory/3112-390-0x0000000007150000-0x0000000007165000-memory.dmp

Filesize
84KB

Download
memory/3112-389-0x0000000007140000-0x000000000714E000-memory.dmp

Filesize
56KB

Download
memory/3112-388-0x0000000007100000-0x0000000007111000-memory.dmp

Filesize
68KB

Download
memory/3164-283-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3164-213-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/3380-279-0x00000000735AE000-0x00000000735AF000-memory.dmp

Filesize
4KB

Download
memory/3380-129-0x00000000735AE000-0x00000000735AF000-memory.dmp

Filesize
4KB

Download
memory/3380-133-0x00000000009D0000-0x00000000009D8000-memory.dmp

Filesize
32KB

Download
memory/3380-134-0x00000000054A0000-0x000000000553C000-memory.dmp

Filesize
624KB

Download
memory/3740-127-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/3740-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3828-346-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/4128-456-0x0000000007040000-0x0000000007055000-memory.dmp

Filesize
84KB

Download
memory/4128-454-0x0000000006D30000-0x0000000006DD4000-memory.dmp

Filesize
656KB

Download
memory/4128-455-0x0000000007010000-0x0000000007021000-memory.dmp

Filesize
68KB

Download
memory/4128-445-0x000000006CC30000-0x000000006CC7C000-memory.dmp

Filesize
304KB

Download
memory/4676-816-0x0000000000920000-0x0000000000945000-memory.dmp

Filesize
148KB

Download
memory/4676-783-0x0000000000920000-0x0000000000945000-memory.dmp

Filesize
148KB

Download
memory/5028-194-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5028-195-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5028-196-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5028-197-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5028-193-0x00007FF8CC530000-0x00007FF8CC540000-memory.dmp

Filesize
64KB

Download
memory/5028-198-0x00007FF8C9DA0000-0x00007FF8C9DB0000-memory.dmp

Filesize
64KB

Download
memory/5028-199-0x00007FF8C9DA0000-0x00007FF8C9DB0000-memory.dmp

Filesize
64KB

Download
memory/5992-815-0x0000000001070000-0x0000000001095000-memory.dmp

Filesize
148KB

Download
memory/6060-698-0x0000000000A40000-0x0000000000D40000-memory.dmp

Filesize
3.0MB

Download
memory/6060-681-0x0000000000A40000-0x0000000000D40000-memory.dmp

Filesize
3.0MB

Download