asyncrat | 12fce52d084a8c7efa638c88fa2307bca7c038a49fe566ebb05533cacf17efbd

max time kernel
150s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
22/01/2025, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

764KB
MD5

85e3d4ac5a6ef32fb93764c090ef32b7
SHA1

adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA256

4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
SHA512

a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP

12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

lumma

https://covvercilverow.shop/api

https://surroundeocw.shop/api

https://abortinoiwiam.shop/api

https://pumpkinkwquo.shop/api

https://priooozekw.shop/api

https://deallyharvenw.shop/api

https://defenddsouneuw.shop/api

https://racedsuitreow.shop/api

https://roaddrermncomplai.shop/api

Extracted

Family

quasar

Version

1.4.1

Botnet

Main

tpinauskas-54803.portmap.host:54803

Mutex

8422dcc2-b8bd-4080-a017-5b62524b6546

Attributes

encryption_key
2EFF7393DC1BD9FBDDD61A780B994B8166BAB8EC
install_name
Win64.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Win64
subdirectory
SubDir

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

interestingsigma.hopto.org:20

Mutex

11bbf22e-826e-486b-b024-adbd86228a9e

Attributes

encryption_key
7A589EDBC6A581E125BF830EF0D05FC74BB75E30
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
ctfmon
subdirectory
SubDir

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:8080

127.0.0.1:18274

6.tcp.eu.ngrok.io:6606

6.tcp.eu.ngrok.io:7707

6.tcp.eu.ngrok.io:8808

6.tcp.eu.ngrok.io:8080

6.tcp.eu.ngrok.io:18274

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

192.168.0.14:4343

Mutex

a1OON3Evw1pM

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

assistance-arbitration.gl.at.ply.gg:12152

Attributes

Install_directory
%AppData%
install_file
svchost.exe

Extracted

Family

vidar

Version

11.8

Botnet

41d35cbb974bc2d1287dcd4381b4a2a8

https://t.me/fu4chmo

https://steamcommunity.com/profiles/76561199802540894

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0005000000025b47-546.dat	family_vidar_v7
behavioral1/memory/4532-549-0x00000000000F0000-0x0000000000349000-memory.dmp	family_vidar_v7
behavioral1/memory/4532-628-0x00000000000F0000-0x0000000000349000-memory.dmp	family_vidar_v7

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00050000000006a1-536.dat	family_xworm
behavioral1/memory/2176-541-0x0000000000190000-0x00000000001A6000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 4 IoCs

resource	yara_rule
behavioral1/files/0x001900000002ab5c-266.dat	family_quasar
behavioral1/memory/664-275-0x0000000000C10000-0x0000000000F50000-memory.dmp	family_quasar
behavioral1/files/0x001900000002ab5a-286.dat	family_quasar
behavioral1/memory/1512-295-0x0000000000180000-0x00000000004A4000-memory.dmp	family_quasar

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/files/0x0006000000025a12-364.dat	family_asyncrat
behavioral1/files/0x0004000000025a10-388.dat	family_asyncrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3688	powershell.exe
1808	powershell.exe
3756	powershell.exe
5000	powershell.exe
2704	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe	dllhost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.url	dllhost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dllhost.exe	dllhost.exe

Executes dropped EXE 45 IoCs

pid	Process
1392	._cache_4363463463464363463463463.exe
1916	Synaptics.exe
784	._cache_Synaptics.exe
804	ExtremeInjector.exe
664	Amogus.exe
2256	Journal.exe
1512	runtimebroker.exe
2084	Win64.exe
2792	Client.exe
3508	Win64.exe
3884	Client.exe
3628	Client.exe
1544	Win64.exe
2076	leetspoofer.exe
1116	aaa%20(3).exe
3120	Win64.exe
2040	Client.exe
1996	Client.exe
3212	Client.exe
2848	Win64.exe
564	Client.exe
2948	Win64.exe
1536	Client.exe
2468	Win64.exe
4680	main.exe
1664	xdd.exe
4928	Client.exe
3196	Win64.exe
2680	dllhost.exe
976	Client.exe
2504	Win64.exe
3160	Client.exe
3704	Win64.exe
2176	XClient.exe
4532	nthnaedltg.exe
4944	Client.exe
1176	Win64.exe
3424	Client.exe
2160	Win64.exe
1604	Client.exe
2812	Win64.exe
2160	Win64.exe
4788	Client.exe
2964	dllhost.exe
3044	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
804	ExtremeInjector.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost.exe = "\"C:\\ProgramData\\dllhost.exe\" .."	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dllhost.exe = "\"C:\\ProgramData\\dllhost.exe\" .."	dllhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe"	XClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	4363463463464363463463463.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
4	raw.githubusercontent.com
6	raw.githubusercontent.com
13	raw.githubusercontent.com
27	6.tcp.eu.ngrok.io

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	ip-api.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	xdd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 804 set thread context of 1116	804	ExtremeInjector.exe	87

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3548	sc.exe
3200	sc.exe
3504	sc.exe
4568	sc.exe
3232	sc.exe
3196	sc.exe
3544	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nthnaedltg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaa%20(3).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExtremeInjector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_regiis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 28 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3676	PING.EXE
3152	PING.EXE
4776	PING.EXE
4680	PING.EXE
2896	PING.EXE
3440	PING.EXE
1980	PING.EXE
1384	PING.EXE
2848	PING.EXE
1224	PING.EXE
1068	PING.EXE
2004	PING.EXE
2848	PING.EXE
1344	PING.EXE
752	PING.EXE
1992	PING.EXE
2116	PING.EXE
2312	PING.EXE
2776	PING.EXE
1920	PING.EXE
3372	PING.EXE
5080	PING.EXE
1600	PING.EXE
2040	PING.EXE
1384	PING.EXE
4896	PING.EXE
1972	PING.EXE
2768	PING.EXE

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	nthnaedltg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	nthnaedltg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1556	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4472	taskkill.exe
3200	taskkill.exe
3444	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	4363463463464363463463463.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Runs ping.exe 1 TTPs 28 IoCs

Remote System Discovery

T1018

pid	Process
4896	PING.EXE
1972	PING.EXE
2896	PING.EXE
1344	PING.EXE
2768	PING.EXE
1920	PING.EXE
2848	PING.EXE
3440	PING.EXE
1384	PING.EXE
2116	PING.EXE
2040	PING.EXE
1384	PING.EXE
2312	PING.EXE
1068	PING.EXE
1992	PING.EXE
2848	PING.EXE
2776	PING.EXE
752	PING.EXE
3676	PING.EXE
4776	PING.EXE
1600	PING.EXE
2004	PING.EXE
1224	PING.EXE
3372	PING.EXE
5080	PING.EXE
4680	PING.EXE
3152	PING.EXE
1980	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 34 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1484	schtasks.exe
1108	schtasks.exe
5116	schtasks.exe
3540	schtasks.exe
1808	schtasks.exe
1076	schtasks.exe
2056	schtasks.exe
4996	schtasks.exe
1424	schtasks.exe
1444	schtasks.exe
484	schtasks.exe
4452	schtasks.exe
1780	schtasks.exe
5060	schtasks.exe
1992	schtasks.exe
3992	schtasks.exe
4920	schtasks.exe
4776	schtasks.exe
2940	schtasks.exe
4284	schtasks.exe
2160	schtasks.exe
1928	schtasks.exe
3904	schtasks.exe
1484	schtasks.exe
4600	schtasks.exe
4748	schtasks.exe
2896	schtasks.exe
3148	schtasks.exe
200	schtasks.exe
1712	schtasks.exe
4956	schtasks.exe
3940	schtasks.exe
3992	schtasks.exe
2776	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1908	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe
4680	main.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

description	pid	Process
Token: SeDebugPrivilege	1392	._cache_4363463463464363463463463.exe
Token: SeDebugPrivilege	784	._cache_Synaptics.exe
Token: SeDebugPrivilege	664	Amogus.exe
Token: SeDebugPrivilege	1512	runtimebroker.exe
Token: SeDebugPrivilege	2084	Win64.exe
Token: SeDebugPrivilege	2792	Client.exe
Token: SeDebugPrivilege	3508	Win64.exe
Token: SeDebugPrivilege	3884	Client.exe
Token: SeDebugPrivilege	3628	Client.exe
Token: SeDebugPrivilege	1544	Win64.exe
Token: SeDebugPrivilege	3120	Win64.exe
Token: SeDebugPrivilege	2040	Client.exe
Token: SeDebugPrivilege	3212	Client.exe
Token: SeDebugPrivilege	2848	Win64.exe
Token: SeDebugPrivilege	564	Client.exe
Token: SeDebugPrivilege	2948	Win64.exe
Token: SeDebugPrivilege	1536	Client.exe
Token: SeDebugPrivilege	2468	Win64.exe
Token: SeDebugPrivilege	4680	main.exe
Token: SeDebugPrivilege	4928	Client.exe
Token: SeDebugPrivilege	3196	Win64.exe
Token: SeDebugPrivilege	2680	dllhost.exe
Token: SeDebugPrivilege	2504	Win64.exe
Token: SeDebugPrivilege	976	Client.exe
Token: SeDebugPrivilege	3688	powershell.exe
Token: 33	2680	dllhost.exe
Token: SeIncBasePriorityPrivilege	2680	dllhost.exe
Token: SeDebugPrivilege	3160	Client.exe
Token: SeDebugPrivilege	3704	Win64.exe
Token: 33	2680	dllhost.exe
Token: SeIncBasePriorityPrivilege	2680	dllhost.exe
Token: SeDebugPrivilege	2176	XClient.exe
Token: 33	2680	dllhost.exe
Token: SeIncBasePriorityPrivilege	2680	dllhost.exe
Token: SeDebugPrivilege	4944	Client.exe
Token: SeDebugPrivilege	1176	Win64.exe
Token: SeDebugPrivilege	1808	powershell.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	2704	powershell.exe
Token: SeDebugPrivilege	2176	XClient.exe
Token: 33	2680	dllhost.exe
Token: SeIncBasePriorityPrivilege	2680	dllhost.exe
Token: SeDebugPrivilege	3424	Client.exe
Token: SeDebugPrivilege	2160	Win64.exe
Token: 33	2680	dllhost.exe
Token: SeIncBasePriorityPrivilege	2680	dllhost.exe
Token: SeDebugPrivilege	1604	Client.exe
Token: SeDebugPrivilege	2812	Win64.exe
Token: 33	2680	dllhost.exe
Token: SeIncBasePriorityPrivilege	2680	dllhost.exe
Token: 33	2680	dllhost.exe
Token: SeIncBasePriorityPrivilege	2680	dllhost.exe
Token: SeDebugPrivilege	2160	Win64.exe
Token: SeDebugPrivilege	4788	Client.exe
Token: SeDebugPrivilege	3044	svchost.exe
Token: SeDebugPrivilege	2964	dllhost.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
2792	Client.exe
3884	Client.exe
3628	Client.exe
2040	Client.exe
3212	Client.exe
564	Client.exe
1536	Client.exe
4928	Client.exe
976	Client.exe
3160	Client.exe
4944	Client.exe
3424	Client.exe
1604	Client.exe
4788	Client.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
2792	Client.exe
3884	Client.exe
3628	Client.exe
2040	Client.exe
3212	Client.exe
564	Client.exe
1536	Client.exe
4928	Client.exe
976	Client.exe
3160	Client.exe
4944	Client.exe
3424	Client.exe
1604	Client.exe
4788	Client.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
1908	EXCEL.EXE
2176	XClient.exe
1604	Client.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 1392	4892	4363463463464363463463463.exe	78
PID 4892 wrote to memory of 1392	4892	4363463463464363463463463.exe	78
PID 4892 wrote to memory of 1392	4892	4363463463464363463463463.exe	78
PID 4892 wrote to memory of 1916	4892	4363463463464363463463463.exe	80
PID 4892 wrote to memory of 1916	4892	4363463463464363463463463.exe	80
PID 4892 wrote to memory of 1916	4892	4363463463464363463463463.exe	80
PID 1916 wrote to memory of 784	1916	Synaptics.exe	81
PID 1916 wrote to memory of 784	1916	Synaptics.exe	81
PID 1916 wrote to memory of 784	1916	Synaptics.exe	81
PID 1392 wrote to memory of 804	1392	._cache_4363463463464363463463463.exe	85
PID 1392 wrote to memory of 804	1392	._cache_4363463463464363463463463.exe	85
PID 1392 wrote to memory of 804	1392	._cache_4363463463464363463463463.exe	85
PID 804 wrote to memory of 1116	804	ExtremeInjector.exe	87
PID 804 wrote to memory of 1116	804	ExtremeInjector.exe	87
PID 804 wrote to memory of 1116	804	ExtremeInjector.exe	87
PID 804 wrote to memory of 1116	804	ExtremeInjector.exe	87
PID 804 wrote to memory of 1116	804	ExtremeInjector.exe	87
PID 804 wrote to memory of 1116	804	ExtremeInjector.exe	87
PID 804 wrote to memory of 1116	804	ExtremeInjector.exe	87
PID 804 wrote to memory of 1116	804	ExtremeInjector.exe	87
PID 804 wrote to memory of 1116	804	ExtremeInjector.exe	87
PID 784 wrote to memory of 664	784	._cache_Synaptics.exe	88
PID 784 wrote to memory of 664	784	._cache_Synaptics.exe	88
PID 784 wrote to memory of 2256	784	._cache_Synaptics.exe	89
PID 784 wrote to memory of 2256	784	._cache_Synaptics.exe	89
PID 1392 wrote to memory of 1512	1392	._cache_4363463463464363463463463.exe	90
PID 1392 wrote to memory of 1512	1392	._cache_4363463463464363463463463.exe	90
PID 664 wrote to memory of 4600	664	Amogus.exe	91
PID 664 wrote to memory of 4600	664	Amogus.exe	91
PID 664 wrote to memory of 2084	664	Amogus.exe	93
PID 664 wrote to memory of 2084	664	Amogus.exe	93
PID 1512 wrote to memory of 1992	1512	runtimebroker.exe	94
PID 1512 wrote to memory of 1992	1512	runtimebroker.exe	94
PID 2084 wrote to memory of 1712	2084	Win64.exe	96
PID 2084 wrote to memory of 1712	2084	Win64.exe	96
PID 1512 wrote to memory of 2792	1512	runtimebroker.exe	98
PID 1512 wrote to memory of 2792	1512	runtimebroker.exe	98
PID 2084 wrote to memory of 3592	2084	Win64.exe	99
PID 2084 wrote to memory of 3592	2084	Win64.exe	99
PID 3592 wrote to memory of 2284	3592	cmd.exe	101
PID 3592 wrote to memory of 2284	3592	cmd.exe	101
PID 3592 wrote to memory of 2040	3592	cmd.exe	102
PID 3592 wrote to memory of 2040	3592	cmd.exe	102
PID 2792 wrote to memory of 3992	2792	Client.exe	103
PID 2792 wrote to memory of 3992	2792	Client.exe	103
PID 2792 wrote to memory of 4228	2792	Client.exe	105
PID 2792 wrote to memory of 4228	2792	Client.exe	105
PID 4228 wrote to memory of 2384	4228	cmd.exe	107
PID 4228 wrote to memory of 2384	4228	cmd.exe	107
PID 4228 wrote to memory of 752	4228	cmd.exe	108
PID 4228 wrote to memory of 752	4228	cmd.exe	108
PID 3592 wrote to memory of 3508	3592	cmd.exe	109
PID 3592 wrote to memory of 3508	3592	cmd.exe	109
PID 3508 wrote to memory of 4996	3508	Win64.exe	110
PID 3508 wrote to memory of 4996	3508	Win64.exe	110
PID 4228 wrote to memory of 3884	4228	cmd.exe	112
PID 4228 wrote to memory of 3884	4228	cmd.exe	112
PID 3884 wrote to memory of 1484	3884	Client.exe	113
PID 3884 wrote to memory of 1484	3884	Client.exe	113
PID 3884 wrote to memory of 936	3884	Client.exe	115
PID 3884 wrote to memory of 936	3884	Client.exe	115
PID 936 wrote to memory of 4180	936	cmd.exe	117
PID 936 wrote to memory of 4180	936	cmd.exe	117
PID 936 wrote to memory of 1920	936	cmd.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1116
- - C:\Users\Admin\AppData\Local\Temp\Files\runtimebroker.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\runtimebroker.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1992
  - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3992
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\mcsPicsbF98b.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4228
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2384
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:752
      - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xW3QUZGeQEoY.bat" "
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:936
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4180
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1920
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3628
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4920
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9f5lewhCkLfn.bat" "
        9⤵
        
        PID:3688
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1044
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5080
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2040
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        11⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1424
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ZU0wBsGYBkUt.bat" "
        11⤵
        
        PID:5116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:4944
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3676
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3212
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        13⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4284
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SQN5JXM5Imgs.bat" "
        13⤵
        
        PID:1432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:3748
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4680
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        14⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:564
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        15⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\e3s7SqeKWpcd.bat" "
        15⤵
        
        PID:4480
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        16⤵
        
        PID:4228
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        16⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1224
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        16⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:1536
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        17⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2160
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UEgEl7GFT9RK.bat" "
        17⤵
        
        PID:760
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        18⤵
        
        PID:2044
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        18⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1068
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        18⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4928
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        19⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\LQTk3pEdefhF.bat" "
        19⤵
        
        PID:2924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        20⤵
        
        PID:2192
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        20⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3152
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        20⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:976
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        21⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4452
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PrcF5pkqE3ze.bat" "
        21⤵
        
        PID:3348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        22⤵
        
        PID:1972
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        22⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1992
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        22⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3160
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        23⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2896
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TkVpoZsl0QKZ.bat" "
        23⤵
        
        PID:4400
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        24⤵
        
        PID:3344
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        24⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2848
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        24⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4944
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        25⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3148
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\xnVwE2wNJd0A.bat" "
        25⤵
        
        PID:3232
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        26⤵
        
        PID:4176
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        26⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2896
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        26⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3424
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        27⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2940
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tMMoH1mi34eg.bat" "
        27⤵
        
        PID:1284
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        28⤵
        
        PID:432
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        28⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3440
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        28⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:1604
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        29⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\lEqUOIcLPDxF.bat" "
        29⤵
        
        PID:2312
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        30⤵
        
        PID:4328
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        30⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2768
        
        C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        30⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:4788
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "ctfmon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        31⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:200
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\w7hpjI6uhvOq.bat" "
        31⤵
        
        PID:2712
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        32⤵
        
        PID:4480
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        32⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2116
- - C:\Users\Admin\AppData\Local\Temp\Files\leetspoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\leetspoofer.exe"
    3⤵
    - Executes dropped EXE
    PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Files\aaa%20(3).exe
    "C:\Users\Admin\AppData\Local\Temp\Files\aaa%20(3).exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
  - - C:\ProgramData\dllhost.exe
      "C:\ProgramData\dllhost.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2680
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:4472
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4008
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1928
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:3200
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4984
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3904
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f im Wireshark.exe
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        
        PID:3444
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\ProgramData\dllhost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:5060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3232
    - - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 5
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1520
- - C:\Users\Admin\AppData\Local\Temp\Files\xdd.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\xdd.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1664
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:3688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3520
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2056
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:3196
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:3544
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:3548
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:3200
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:3504
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "PPTBMYWF"
      4⤵
      Launches sc.exe
      PID:4568
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "PPTBMYWF" binpath= "C:\ProgramData\wxiftyzsteng\qpgcxlhnvaqc.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:3232
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:784
  - - C:\Users\Admin\AppData\Local\Temp\Files\Amogus.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Amogus.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:664
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4600
    - - C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2084
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1712
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0sTQTbaC94uR.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2284
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2040
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        8⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4996
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TUXyoERaFxNq.bat" "
        8⤵
        
        PID:1352
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1604
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2848
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1544
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4748
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6foUxvrrmaa3.bat" "
        10⤵
        
        PID:2644
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:3504
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3372
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        11⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3120
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        12⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1108
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A8zxAzFEFxQ2.bat" "
        12⤵
        
        PID:4628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2192
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        13⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4776
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        13⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        14⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1444
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BYVgxiWt2898.bat" "
        14⤵
        
        PID:1664
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:3088
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        15⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1384
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2948
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        16⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4956
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bqELlwNO6xE3.bat" "
        16⤵
        
        PID:4708
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        17⤵
        
        PID:1412
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        17⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2312
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        17⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2468
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        18⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4776
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BIuBCuDNdUBL.bat" "
        18⤵
        
        PID:2088
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        19⤵
        
        PID:1440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        19⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1600
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        19⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3196
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        20⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3992
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RaXxUNbnraeN.bat" "
        20⤵
        
        PID:1344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        21⤵
        
        PID:3580
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        21⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2004
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2504
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        22⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5116
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JJomjGD2wAG4.bat" "
        22⤵
        
        PID:4808
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        23⤵
        
        PID:2448
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        23⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4896
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        23⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3704
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        24⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3540
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UOj7JPiOC7Zo.bat" "
        24⤵
        
        PID:5116
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        25⤵
        
        PID:1440
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        25⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1972
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        25⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1176
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        26⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1076
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dUMeBtwpphly.bat" "
        26⤵
        
        PID:4204
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        27⤵
        
        PID:2948
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        27⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1344
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        27⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        28⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1780
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yq5GtsFlSaJU.bat" "
        28⤵
        
        PID:3140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        29⤵
        
        PID:3928
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        29⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1980
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2812
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        30⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1484
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yM0NxtAf2m8D.bat" "
        30⤵
        
        PID:1156
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        31⤵
        
        PID:1992
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        31⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1384
        
        C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:2160
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Win64" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Win64.exe" /rl HIGHEST /f
        32⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1808
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bxhTFSoFfRyU.bat" "
        32⤵
        
        PID:3140
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        33⤵
        
        PID:3504
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        33⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\Files\Journal.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Journal.exe"
      4⤵
      Executes dropped EXE
      PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\Files\Client.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\Client.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2176
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3756
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2704
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Files\nthnaedltg.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\nthnaedltg.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:4532
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Files\nthnaedltg.exe" & rd /s /q "C:\ProgramData\KKFCFBKFCFBF" & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2936
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1556

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1908

C:\ProgramData\dllhost.exe
C:\ProgramData\dllhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Users\Admin\AppData\Roaming\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Synaptics\Synaptics.exe

Filesize
764KB

MD5
85e3d4ac5a6ef32fb93764c090ef32b7

SHA1
adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52

SHA256
4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1

SHA512
a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Win64.exe.log

Filesize
2KB

MD5
15eab799098760706ed95d314e75449d

SHA1
273fb07e40148d5c267ca53f958c5075d24c4444

SHA256
45030bd997f50bb52c481f7bc86fac5f375d08911bcc106b98d9d8f0c2ce9778

SHA512
50c125e2a98740db0a0122d7f4de97c50d84623e800b3d3e173049c8e28ff0fbe4add7677bc56cb2228f78ed17522f67ae8f1b85f62824012414ce38ce0b500c

Download Submit
C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe

Filesize
10KB

MD5
2a94f3960c58c6e70826495f76d00b85

SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\0sTQTbaC94uR.bat

Filesize
206B

MD5
6cfaf133a38f07ad3d6d6971ea9541d8

SHA1
3804ba95c549b2bc5bbcdd520c165e60987c00e7

SHA256
9a31c63ee56da686e59dbd015ac42f64a4b5e5ac54feacde3658fb29039d0776

SHA512
be6861814a9526caa27eca04035a64bc94e670afa50effa600bf8e4521cbc985f3c7b80420d9a509e2c92d33ead4785633d3f5c1b78ed2931f7fa2c1d954678b

Download Submit
C:\Users\Admin\AppData\Local\Temp\27085E00

Filesize
22KB

MD5
09b0dcbf9d2c5a8995b18e3e985de529

SHA1
bc3de0eae84a87b6d1d92a53cf5aa1ece3b75f84

SHA256
0a89d9299cf4f146cbf9d133087dee31e3053e1ad1ed76256d5677f7bba4ceac

SHA512
4449896d8446e12e341d51cb20c3667c570d03c7c9aee21e92f8d446ecba3a7d5279b51721b4e65c3fc0b272d0158aa7ae145ec7f0cd28a025bcea6dcb99d1c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\6foUxvrrmaa3.bat

Filesize
206B

MD5
21b3fc9d29a4376fcf4b30bce18958f8

SHA1
9fd0ad7ec15b1adc077e975cd46829988c6cd47b

SHA256
e87149499098e93c58af8d81fd2cd7c3b53452928a28e0528bd4e31e57cddb51

SHA512
3f97d0d0eb59e45c74e57c5b7369e4157c17bfa3ef7df9e4c05a55e2cb1e9dc0ac6e41dc1978ceb738316d184d4c802383bf69cfb0258004ea25fe349cdc84d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\8rqI7dWF.xlsm

Filesize
17KB

MD5
e566fc53051035e1e6fd0ed1823de0f9

SHA1
00bc96c48b98676ecd67e81a6f1d7754e4156044

SHA256
8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

SHA512
a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

Download Submit
C:\Users\Admin\AppData\Local\Temp\9f5lewhCkLfn.bat

Filesize
207B

MD5
1de389b204285dcdc75a32d360a21001

SHA1
07e68ce5901aab33eff6ef3ed424dd11076db10f

SHA256
fa1ef5e46276ed7b28d5a6932bd3e56cdc1dde80f28270eea6ac689eecc834b2

SHA512
5e592981bbe329bd3e8c58a683b085b72893167c64e19078c2ee30071678122490ad090ae9d9e8b3aa108c0a8f3cd5e7a3ad8dab09a9f5e30fe9a9a9d9a5ade9

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8zxAzFEFxQ2.bat

Filesize
206B

MD5
b5ce9043ed4eb037d0f65705af778f43

SHA1
ef89298350cd971eb2af4de4d5078950e14925b1

SHA256
0cc5c83ee1bb0b3856102974ec496d6e281808c3bb677592ac42aa8787e02d99

SHA512
39d004bd770eab55177d3586ed3b8de07704b285ef387f5bb7df7bf2597956022e3ed0468d74f7d5972e64939c749eb3bb5dab5cc3707d40a41b7b613e4026d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\BIuBCuDNdUBL.bat

Filesize
206B

MD5
3112b2c4ed066cb1dac174f0862f2a4f

SHA1
5f886f7c99cf82c17166e889f8ee5f8e85c3d448

SHA256
a24de16f43c46001027475677566924f2aea0031ffedd4866a3d37115946b08d

SHA512
8e1d5abb5846c98baf13bb3603b4fe7d9a9fb7d3fb341b11c651ce96e45389e055c1f7c181ed309695053a2c279559d6db332c70f281f4ccb611e9351d45fa5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\BYVgxiWt2898.bat

Filesize
206B

MD5
26b410018fee4a477e4319424c2f896d

SHA1
d8cededceab46f8c2c9c47954627ebcc7324c64c

SHA256
251b43cdcb346f09429a444b594cb6a91ab1e63b3e519cc8f1741549c8f19150

SHA512
f32d3bee7698f6a73b347e1a25efd4c7c791b825a1edaf493d28b348f1b6bede9da7911bfd0e8ce58f4dbf066506d6bead04628ba19c806add6c57f24125bc1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe

Filesize
208KB

MD5
4700e950db3b114e91e237ed11d2f9e0

SHA1
44aac69a91378e768cd8237c65f5e990a0394436

SHA256
72b38061644ebae315151affd95b314880c79f3963e1be30c6027d3977e36786

SHA512
ad92f9ab3ca82022772cf226380d10138e51eed932f78c108bc45b061e000fd5597dcf9a09740d5fc689172e86c537acf63cf6c8f4f679d9262a792faad0cb02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Amogus.exe

Filesize
3.2MB

MD5
23c072bdc1c5fe6c2290df7cd3e9abf8

SHA1
e10c6f7843e89f787866aac99c0cb7a3b2c7a902

SHA256
8c7fd294ec6500a01038f916ecab9ec6a92c9f71f02400a47dc73b34fee7f490

SHA512
5e18db624ec40d90776a80d90fa80a8a39f7fcd56a523e2d831942934b00e501e7009cc37b17fa4b29a2c2e5c1895c65fdc3259421fb3ce6ea9da50048c50e0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Client.exe

Filesize
47KB

MD5
d3ed1c2da2065809f44ef00d759e125e

SHA1
21600d2f5475563e79b52004daa4fe77f4c6cf4b

SHA256
bdef6f54af01f98f107e189fb07b2159177d25bd80077b87b5f83f18959b7e42

SHA512
e7809edc41ee0c3e4e00bb9370b37e3f431bec715563f94f0fb9a702e93b71876089016d9a075a8fb4fcebbe0493c9b6565a18b7e8e55a748cdb9e8a53bcc51a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ExtremeInjector.exe

Filesize
550KB

MD5
ee6be1648866b63fd7f860fa0114f368

SHA1
42cab62fff29eb98851b33986b637514fc904f4b

SHA256
e17bf83e09457d8cecd1f3e903fa4c9770e17e823731650a453bc479591ac511

SHA512
d6492d3b3c1d94d6c87b77a9a248e8c46b889d2e23938ddb8a8e242caccb23e8cd1a1fbeffee6b140cf6fd3ea7e8da89190286a912032ce4a671257bd8e3e28a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Journal.exe

Filesize
321KB

MD5
3db33784eb4a2c5ff0d97237bd25d4ce

SHA1
e1ee87f9353ff1438e860ef695b5e022a83ac298

SHA256
e0fad6ad403b01fb99b906403d2abb21ffd1adf78e88477568291bb0cf392deb

SHA512
7394150c055ec7c42f7f28a7f0fceedd6a32da68502ff7d2c5ecf32f48f3899c4416cc0ca1223d5d173033fb047c34e9ba31c91c12a26bf0d4758d338f179937

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe

Filesize
59KB

MD5
cf14fac9fa45e4989ad1db2910ed98fd

SHA1
9e6381b831257bebf6356984e6ac3764aee72a84

SHA256
3df057f43a8c20c88fe2a2266ac09414fcf9dac4037e9a4f6e95ab66e6409636

SHA512
184a88c77ee9e8254cbe4489447d89a710b057efa6fe9f0510a93da91e200dd6717416b275140b31301fed6800884cc62b7941854565c96462f109dd7f972e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\aaa%20(3).exe

Filesize
45KB

MD5
8123d15bb6100a19ac103b4ec3d592bf

SHA1
713d2344beb28d34864768e7b2c0463044bdc014

SHA256
68e92585378abdd8a5e6ba42c20a66558ebbcc964c08ba3ce56d020568ebf16d

SHA512
ca048fc1aa53af7b517c2b894e038ed7e413690f2a9e9838c0a5624f9530b20ec8ca22c8d99b8b7ed1e049753970880ee047de984557e2e6c28a55ba2c974351

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\leetspoofer.exe

Filesize
2.0MB

MD5
be799584483e20f3789f6e14e9b1cbcb

SHA1
795621142e849101658ebd281d475043d4076da6

SHA256
d387263b9117417e83b25313230f833ad68080bc9ff92c2d9de70e7fb39004d1

SHA512
d63a5b5913bb1a1bf0480b0575fe3689bfe67019a24c238f11becf144e995a0774fd94e3e0a97d477b805917650f39a1a7512a4d60a37f0e286f93f09f982901

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\main.exe

Filesize
65KB

MD5
915756ae44759560e8476467163b0f5d

SHA1
02c6eeb6a68c4fab801061321645c3cf118b823a

SHA256
0a5fe6735794d87d1cb917aa4b92947f571eff6b5541008cc1f76a666df4fbfb

SHA512
4d7b862f7e4dd4856eac8e5982eb7ed10afddb943661b84cd8f06293fed80e26a65595a89b6abdd1d99bd6154791169006a6d0a4f572de756a691cfb9889049c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\nthnaedltg.exe

Filesize
275KB

MD5
0a7b3454fdad8431bd3523648c915665

SHA1
800a97a7c1a92a92cac76afc1fe5349895ee5287

SHA256
baf217d7bb8f3a86856def6891638318a94ed5d7082149d4dd4cb755d90d86ce

SHA512
020e45eaeee083d6739155d9a821ab54dd07f1320b8efb73871ee5d29188122fdbb7d39b34a8b3694a8b0c08ae1801ec370e40ff8d837c9190a72905f26baff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\runtimebroker.exe

Filesize
3.1MB

MD5
a29d070abe87b2be24892421e0c763bb

SHA1
383104c7c6956a98ae5f63c743250f737700f509

SHA256
00bdef606eb20070701dfc27ed4578c25f5e3357e969ef25ba07ab251450c636

SHA512
6d2a161e8193ed3e05443bd76652b958990f01d2cc2452185f58a5bff3031d268e2fe71c009fa4938ac1cbc914ba2163133079f8218f1c67b0758f594a67f969

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\xdd.exe

Filesize
5.0MB

MD5
18eb87d99216dfd5b0771ea566663073

SHA1
5218b45e307d06f88b4a05b46a7fefc25ab92d64

SHA256
c6251dd1cecc17a699ad2f5598faa297b76d284f699309d44cfbfa24e020c74a

SHA512
3fd9cca40df23c73fa5c85be2ffbdb7af253e6e17ae38aeaaa0ff906d72b998ebf11b463e15aa0f6ca7a28e527f21b11c8ea70a87371302ea98070455a5efe6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\LQTk3pEdefhF.bat

Filesize
207B

MD5
a0bc80dce7d238f1781562534e3bc272

SHA1
6001a36daed260b54095994c20c25283db6a1f47

SHA256
d7ae5fee143693021522235bede00565d64db29d7d7403fc243eb9c165ceb47b

SHA512
d02a5bb4e7f23f069be6494288e0ec6bbcfdafbc3d3b7b4d9f2d006bd089ef63f5de923a841703a5e9907c08e0c0a39a78e7353a36ccaefb4333e3e0e2650a5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RaXxUNbnraeN.bat

Filesize
206B

MD5
fe202795d263224956848a51fac977a3

SHA1
051d470680d7c41e9f5111862c7f8b8e6145e610

SHA256
2b6bba6f83d45e5b36edf171363063a43403aeb507aa8f66280776e0bb1375a6

SHA512
edc642da569d6e097f1cb3173db0e7d34a55b4c335d4637573c791a62a569848c71ac74d04f2a2db602509161351eb09b926ed5123786d81273f4a128db29a72

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQN5JXM5Imgs.bat

Filesize
207B

MD5
76a2c5d7bbdea292e1fd2a3bb6b8ff19

SHA1
0d3e3b45d6e990b276dbbfd6532ae2ab56507c4e

SHA256
fafa8bbccd28386b3eb8eb2712e35562d6d1dc35e3270b414167f8d00138b370

SHA512
e81256dcdd5c6a6bb259ec8cc9fe19cfaf9c0448815a682aa1eda6311684080fe34b133f201f88a31fd807a5b7cd0afdc24e4d0396a7787a16433175ab221d46

Download Submit
C:\Users\Admin\AppData\Local\Temp\TUXyoERaFxNq.bat

Filesize
206B

MD5
66cb061646025afef48cd0907625e256

SHA1
31ab289eeb5907b7d365c39d0b3b3ac0ad3185b6

SHA256
e3408c68dcb7552328db443e68fa031f6d26a3e3b2673d570d893673c1a33c1a

SHA512
dec8a54a5c3dab2ae0bc23d0e90bde5571f83c99473f55f3aa6a635290b0681a5febfeeec4470df919e4bce67cca8cbd8a11370130d5f634e866c307692b8117

Download Submit
C:\Users\Admin\AppData\Local\Temp\UEgEl7GFT9RK.bat

Filesize
207B

MD5
1e7a358ad93ceb4cbf982702acd17908

SHA1
3cc0fd2b031009ce45b08e14d7224df579855a0a

SHA256
c12d27a53e2d50fbf7f97ad82e5da004b4cb0b0b787eb2ee9050e31390c6f3c2

SHA512
b6ada6ef9f52ecfc1af7bc0c2e0c02d82923d3a675a1c1ae637199739d28d50a6f18ab02cbf063b4f345fc66a606636358aa8b66688181403b8c36cf01fb0678

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZU0wBsGYBkUt.bat

Filesize
207B

MD5
fc4f82e6df8677fafd013d26413447eb

SHA1
cd4416171e300424795f0017a8a1866e67602834

SHA256
f643208e193c259cf75f58d9903303c29b3b10b29ca0923da03547e62429411a

SHA512
407aa0e89b5642be139e1abb9337fb5ef7c8b531eda4f50343cc32a59ac953297197881e3ccc8573ada2ac5619ffbc9735cc35f6b48625d69769074130d934a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_inwocofp.alt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bqELlwNO6xE3.bat

Filesize
206B

MD5
0bd159ecb056a49ae181506337a9e7ae

SHA1
165dca029b47bfa25d2dd9f8914dd2072d4e5feb

SHA256
0de2fb0aac2f29a5a0eeb9043639415163436952b732503ce8fabde8b4b82d56

SHA512
c5da3c7e79fb45b87c315537901729c8467be88b707b951bfc06585ffb2ab51cf3f2f0992049c4f05a347dab992dc88a53398f871c5587c183185310f070aefd

Download Submit
C:\Users\Admin\AppData\Local\Temp\e3s7SqeKWpcd.bat

Filesize
207B

MD5
ec1c5ce479caf61c1061553e69707092

SHA1
be93b40937a196f1fe9b3a0e3342a9b4d7804284

SHA256
1988eda20b353b473071e0edfaeb155d38c45fba5171ba0e8c2c4334ec02d4a7

SHA512
41cda13a0b2a487d013da80f2130d37ad3c9db79912c9bde0d0baaa8d28a562a6b376e7bd2875a81d655efdb847b29097b51535b71e660446d8a30a01826cdd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\mcsPicsbF98b.bat

Filesize
207B

MD5
18d94f87245cebd45270168248fdf54e

SHA1
7e013059b99a49e027b049abd860938691c87f82

SHA256
5e8cbffa3f2467c047c3d82a7e43e14d7866d7321d2b9006632810e8f7f06afc

SHA512
fc3f06d1d9e133a3b0d3c9c848de5d9cc07435c2bb09129d6a7645c5f04581292d7a083dc775a99a6f491ae5ecce07b3a7fcad622b13f74a80cb266a6dbf5d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xW3QUZGeQEoY.bat

Filesize
207B

MD5
e1fdfac5d88b19022917cd030bdffb4d

SHA1
277edd69fc96eee03d02c5dd1e8d61c3b073165a

SHA256
d2d1fa783355dc661419ba3fa1920b97b67eb83bb6de7fabd483dfae6e2e7fac

SHA512
7a8ef4be1017e0b84355e4cc69b86df18d80f3fb0a9daaf42b9bdb763c24d7d87103e9a7df1b9f5c1ec83deb6836a4adef7797f752f25aeb09f03c978a2935b7

Download Submit
C:\Users\Admin\AppData\Roaming\msvcp110.dll

Filesize
642KB

MD5
9bc424be13dca227268ab018dca9ef0c

SHA1
f6f42e926f511d57ef298613634f3a186ec25ddc

SHA256
59d3999d0989c9c91dae93c26499f5a14b837a0fe56e6fc29f57456f54a1f8a2

SHA512
70a1abb35bd95efc40af6653d5db2e155fab9a8575b7ae5b69ab3fbcd60925c66a675dac6cba57564a430e9b92f1a2ea9e912c4d7f356b82696ed77e92b52715

Download Submit
memory/664-275-0x0000000000C10000-0x0000000000F50000-memory.dmp

Filesize
3.2MB

Download
memory/804-232-0x0000000000E40000-0x0000000000ED0000-memory.dmp

Filesize
576KB

Download
memory/1116-371-0x00000000008D0000-0x00000000008E2000-memory.dmp

Filesize
72KB

Download
memory/1116-240-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1116-242-0x0000000000400000-0x0000000000465000-memory.dmp

Filesize
404KB

Download
memory/1392-133-0x0000000000DF0000-0x0000000000DF8000-memory.dmp

Filesize
32KB

Download
memory/1392-125-0x0000000072AAE000-0x0000000072AAF000-memory.dmp

Filesize
4KB

Download
memory/1392-319-0x0000000072AAE000-0x0000000072AAF000-memory.dmp

Filesize
4KB

Download
memory/1392-134-0x0000000005700000-0x000000000579C000-memory.dmp

Filesize
624KB

Download
memory/1512-295-0x0000000000180000-0x00000000004A4000-memory.dmp

Filesize
3.1MB

Download
memory/1908-197-0x00007FFA200B0000-0x00007FFA200C0000-memory.dmp

Filesize
64KB

Download
memory/1908-195-0x00007FFA200B0000-0x00007FFA200C0000-memory.dmp

Filesize
64KB

Download
memory/1908-194-0x00007FFA200B0000-0x00007FFA200C0000-memory.dmp

Filesize
64KB

Download
memory/1908-196-0x00007FFA200B0000-0x00007FFA200C0000-memory.dmp

Filesize
64KB

Download
memory/1908-193-0x00007FFA200B0000-0x00007FFA200C0000-memory.dmp

Filesize
64KB

Download
memory/1908-199-0x00007FFA1D7C0000-0x00007FFA1D7D0000-memory.dmp

Filesize
64KB

Download
memory/1908-198-0x00007FFA1D7C0000-0x00007FFA1D7D0000-memory.dmp

Filesize
64KB

Download
memory/1916-320-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1916-448-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1916-504-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1916-321-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1916-132-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/1996-395-0x0000000000CD0000-0x0000000000CE2000-memory.dmp

Filesize
72KB

Download
memory/2084-308-0x000000001C1F0000-0x000000001C2A2000-memory.dmp

Filesize
712KB

Download
memory/2084-307-0x000000001C0E0000-0x000000001C130000-memory.dmp

Filesize
320KB

Download
memory/2176-541-0x0000000000190000-0x00000000001A6000-memory.dmp

Filesize
88KB

Download
memory/2256-325-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2256-299-0x00000000006C0000-0x000000000070B000-memory.dmp

Filesize
300KB

Download
memory/3688-512-0x000001941D3C0000-0x000001941D3E2000-memory.dmp

Filesize
136KB

Download
memory/4532-549-0x00000000000F0000-0x0000000000349000-memory.dmp

Filesize
2.3MB

Download
memory/4532-628-0x00000000000F0000-0x0000000000349000-memory.dmp

Filesize
2.3MB

Download
memory/4892-0-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/4892-129-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download