Overview

overview

10

Static

static

10

ProxyLeech...k_.exe

windows10-ltsc_2021-x64

10

Resubmissions

29/05/2025, 12:45

250529-py47wssjs210

23/05/2025, 20:51

250523-znl9faxzav10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250425-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250425-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    29/05/2025, 12:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ProxyLeecherbyAlphacrack_.exe
  • Size 16.1MB
  • Sample250529-py47wssjs2
  • SHA256 e677a9da84b5b1a612abb286c046b17dd32f1dda2892a16a82e6ef4605156a12
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyredlinesvcstealerppvvdiscoverydownloaderexecutioninfostealerpersistencepyinstallerspywarestealertrojan

Malware Config

Extracted

Family

  • svcstealer

C2

  • 176.113.115.149

  • 185.81.68.156

Extracted

Family

  • redline

Botnet

  • ppvv

C2

  • 62.60.226.191:1912

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detects SvcStealer Payload 7 IoCs

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Redline family
    redline
  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer
  • Svcstealer family
    svcstealer
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file 13 IoCs
  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 5 IoCs
  • Executes dropped EXE 54 IoCs
  • Loads dropped DLL 28 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

    execution
  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Users\Admin\AppData\Local\Temp\ProxyLeecherbyAlphacrack_.exe
      "C:\Users\Admin\AppData\Local\Temp\ProxyLeecherbyAlphacrack_.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:392
      • C:\Users\Admin\AppData\Roaming\bvcbghgf.exe
        "C:\Users\Admin\AppData\Roaming\bvcbghgf.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3460
        • C:\Users\Admin\AppData\Local\Temp\is-M8U1R.tmp\bvcbghgf.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-M8U1R.tmp\bvcbghgf.tmp" /SL5="$60210,2150450,143360,C:\Users\Admin\AppData\Roaming\bvcbghgf.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1816
          • C:\Users\Admin\AppData\Roaming\bvcbghgf.exe
            "C:\Users\Admin\AppData\Roaming\bvcbghgf.exe" /VERYSILENT
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3496
            • C:\Users\Admin\AppData\Local\Temp\is-M98F3.tmp\bvcbghgf.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-M98F3.tmp\bvcbghgf.tmp" /SL5="$90118,2150450,143360,C:\Users\Admin\AppData\Roaming\bvcbghgf.exe" /VERYSILENT
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1208
              • C:\Windows\SysWOW64\regsvr32.exe
                "regsvr32.exe" /s /i:--type=renderer "C:\Users\Admin\AppData\Roaming\microsoft\systemcertificates\\PackageSupportFramework_7.pfx"
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3884
                • C:\Windows\system32\regsvr32.exe
                  /s /i:--type=renderer "C:\Users\Admin\AppData\Roaming\microsoft\systemcertificates\\PackageSupportFramework_7.pfx"
                  8⤵
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3528
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:--type=renderer \"%APPDATA%\Microsoft\SystemCertificates\PackageSupportFramework_7.pfx\"' }) { exit 0 } else { exit 1 }"
                    9⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3532
                  • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
                    "PowerShell.exe" -NoProfile -NonInteractive -Command -
                    9⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:5704
      • C:\Users\Admin\AppData\Roaming\cxvezrfde.exe
        "C:\Users\Admin\AppData\Roaming\cxvezrfde.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2464
        • C:\Users\Admin\AppData\Roaming\cxvezrfde.exe
          "C:\Users\Admin\AppData\Roaming\cxvezrfde.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4664
      • C:\Users\Admin\AppData\Roaming\gfgdfxwx.exe
        "C:\Users\Admin\AppData\Roaming\gfgdfxwx.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        PID:2148
      • C:\Users\Admin\AppData\Roaming\wxcvxverd.exe
        "C:\Users\Admin\AppData\Roaming\wxcvxverd.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4312
      • C:\Users\Admin\AppData\Roaming\cvcxxxx.exe
        "C:\Users\Admin\AppData\Roaming\cvcxxxx.exe"
        3⤵
        • Downloads MZ/PE file
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\Users\Admin\AppData\Local\Temp\temp_17292.exe
          "C:\Users\Admin\AppData\Local\Temp\temp_17292.exe"
          4⤵
          • Executes dropped EXE
          PID:664
        • C:\Users\Admin\AppData\Local\Temp\temp_17292.exe
          "C:\Users\Admin\AppData\Local\Temp\temp_17292.exe"
          4⤵
          • Checks computer location settings
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Modifies registry class
          PID:5108
          • C:\Windows\system32\sysmanger.exe
            "C:\Windows\system32\sysmanger.exe"
            5⤵
            • Executes dropped EXE
            PID:4736
        • C:\Users\Admin\AppData\Local\Temp\temp_17295.exe
          "C:\Users\Admin\AppData\Local\Temp\temp_17295.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3036
          • C:\Users\Admin\AppData\Local\Temp\is-4DHPM.tmp\temp_17295.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-4DHPM.tmp\temp_17295.tmp" /SL5="$40276,1967372,813056,C:\Users\Admin\AppData\Local\Temp\temp_17295.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3496
            • C:\Users\Admin\AppData\Local\Temp\temp_17295.exe
              "C:\Users\Admin\AppData\Local\Temp\temp_17295.exe" /VERYSILENT
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1232
              • C:\Users\Admin\AppData\Local\Temp\is-QM3IE.tmp\temp_17295.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-QM3IE.tmp\temp_17295.tmp" /SL5="$50276,1967372,813056,C:\Users\Admin\AppData\Local\Temp\temp_17295.exe" /VERYSILENT
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                PID:2932
                • C:\Users\Admin\AppData\Local\Temp\is-L2FVM.tmp\7z.exe
                  "C:\Users\Admin\AppData\Local\Temp\is-L2FVM.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-L2FVM.tmp\AppHostInterface_1.drv.7z" -o"C:\Users\Admin\AppData\Roaming\AppHostInterface_1" -pmkyOzOvxg7yXsjAH44noXr5HpVjXs94S -y
                  8⤵
                  • Executes dropped EXE
                  PID:3888
                • C:\Windows\SysWOW64\regsvr32.exe
                  "regsvr32.exe" /s /i:svc "C:\Users\Admin\AppData\Roaming\AppHostInterface_1\\AppHostInterface_1.drv"
                  8⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2692
                  • C:\Windows\system32\regsvr32.exe
                    /s /i:svc "C:\Users\Admin\AppData\Roaming\AppHostInterface_1\\AppHostInterface_1.drv"
                    9⤵
                    • Loads dropped DLL
                    PID:1104
        • C:\Users\Admin\AppData\Local\Temp\temp_17305.exe
          "C:\Users\Admin\AppData\Local\Temp\temp_17305.exe"
          4⤵
          • Executes dropped EXE
          PID:3468
        • C:\Users\Admin\AppData\Local\Temp\temp_17312.exe
          "C:\Users\Admin\AppData\Local\Temp\temp_17312.exe"
          4⤵
          • Executes dropped EXE
          PID:4812
          • C:\Users\Admin\AppData\Local\Temp\temp_17312.exe
            "C:\Users\Admin\AppData\Local\Temp\temp_17312.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:5608
        • C:\Users\Admin\AppData\Local\Temp\temp_17351.exe
          "C:\Users\Admin\AppData\Local\Temp\temp_17351.exe"
          4⤵
          • Executes dropped EXE
          PID:3036
      • C:\Users\Admin\AppData\Roaming\dfssdfxx.exe
        "C:\Users\Admin\AppData\Roaming\dfssdfxx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Users\Admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe
          "C:\Users\Admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe"
          4⤵
          • Downloads MZ/PE file
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2140
          • C:\Users\Admin\AppData\Local\Temp\10000320101\1.exe
            "C:\Users\Admin\AppData\Local\Temp\10000320101\1.exe"
            5⤵
            • Executes dropped EXE
            PID:2136
          • C:\Users\Admin\AppData\Local\Temp\10000330101\2.exe
            "C:\Users\Admin\AppData\Local\Temp\10000330101\2.exe"
            5⤵
            • Checks computer location settings
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:1868
            • C:\Windows\system32\sysmanger.exe
              "C:\Windows\system32\sysmanger.exe"
              6⤵
              • Executes dropped EXE
              PID:5648
          • C:\Users\Admin\AppData\Local\Temp\10000340101\3.exe
            "C:\Users\Admin\AppData\Local\Temp\10000340101\3.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4576
            • C:\Users\Admin\AppData\Local\Temp\is-9BE37.tmp\3.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-9BE37.tmp\3.tmp" /SL5="$70028,1967372,813056,C:\Users\Admin\AppData\Local\Temp\10000340101\3.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1488
              • C:\Users\Admin\AppData\Local\Temp\10000340101\3.exe
                "C:\Users\Admin\AppData\Local\Temp\10000340101\3.exe" /VERYSILENT
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4896
                • C:\Users\Admin\AppData\Local\Temp\is-MF44T.tmp\3.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-MF44T.tmp\3.tmp" /SL5="$80028,1967372,813056,C:\Users\Admin\AppData\Local\Temp\10000340101\3.exe" /VERYSILENT
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  PID:1816
                  • C:\Users\Admin\AppData\Local\Temp\is-O2KP9.tmp\7z.exe
                    "C:\Users\Admin\AppData\Local\Temp\is-O2KP9.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-O2KP9.tmp\AppHostInterface_1.drv.7z" -o"C:\Users\Admin\AppData\Roaming\AppHostInterface_1" -pmkyOzOvxg7yXsjAH44noXr5HpVjXs94S -y
                    9⤵
                    • Executes dropped EXE
                    PID:5960
                  • C:\Windows\SysWOW64\regsvr32.exe
                    "regsvr32.exe" /s /i:svc "C:\Users\Admin\AppData\Roaming\AppHostInterface_1\\AppHostInterface_1.drv"
                    9⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:1076
                    • C:\Windows\system32\regsvr32.exe
                      /s /i:svc "C:\Users\Admin\AppData\Roaming\AppHostInterface_1\\AppHostInterface_1.drv"
                      10⤵
                      • Loads dropped DLL
                      PID:2020
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:svc \"%APPDATA%\AppHostInterface_1\AppHostInterface_1.drv\"' }) { exit 0 } else { exit 1 }"
                        11⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:632
                      • C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
                        "PowerShell.exe" -NoProfile -NonInteractive -Command -
                        11⤵
                        • Command and Scripting Interpreter: PowerShell
                        PID:3536
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\7ae14b05c802cd\clip64.dll, Main
            5⤵
            • Blocklisted process makes network request
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:3856
      • C:\Users\Admin\AppData\Local\Temp\Launcher.exe
        "C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3728
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\gfgdfxwx.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5804
      • C:\Users\Admin\AppData\Roaming\gfgdfxwx.exe
        C:\Users\Admin\AppData\Roaming\gfgdfxwx.exe
        3⤵
        • Executes dropped EXE
        PID:4256
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\winapp\winapp.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Users\Admin\AppData\Roaming\winapp\winapp.exe
        C:\Users\Admin\AppData\Roaming\winapp\winapp.exe
        3⤵
        • Executes dropped EXE
        PID:2388
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\sysmanger.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3276
      • C:\Windows\system32\sysmanger.exe
        C:\Windows\system32\sysmanger.exe
        3⤵
        • Executes dropped EXE
        PID:2704
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\sysrtlcw.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2908
      • C:\Windows\sysrtlcw.exe
        C:\Windows\sysrtlcw.exe
        3⤵
        • Executes dropped EXE
        PID:1340
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\Sysmrdrv\sysmrdrv.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:868
      • C:\Users\Admin\AppData\Roaming\Sysmrdrv\sysmrdrv.exe
        C:\Users\Admin\AppData\Roaming\Sysmrdrv\sysmrdrv.exe
        3⤵
        • Executes dropped EXE
        PID:3064
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\sysmrdrv.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2572
      • C:\Users\Admin\AppData\Roaming\sysmrdrv.exe
        C:\Users\Admin\AppData\Roaming\sysmrdrv.exe
        3⤵
        • Executes dropped EXE
        PID:3088
    • C:\Users\Admin\AppData\Local\Temp\F4C0.tmp.exe
      C:\Users\Admin\AppData\Local\Temp\F4C0.tmp.exe
      2⤵
      • Downloads MZ/PE file
      • Checks computer location settings
      • Executes dropped EXE
      PID:5756
      • C:\Users\Admin\AppData\Local\Temp\temp_17318.exe
        "C:\Users\Admin\AppData\Local\Temp\temp_17318.exe"
        3⤵
        • Executes dropped EXE
        PID:2976
      • C:\Users\Admin\AppData\Local\Temp\temp_17321.exe
        "C:\Users\Admin\AppData\Local\Temp\temp_17321.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies registry class
        PID:5124
        • C:\Windows\system32\sysmanger.exe
          "C:\Windows\system32\sysmanger.exe"
          4⤵
          • Executes dropped EXE
          PID:4536
      • C:\Users\Admin\AppData\Local\Temp\temp_17325.exe
        "C:\Users\Admin\AppData\Local\Temp\temp_17325.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:3944
        • C:\Users\Admin\AppData\Local\Temp\is-PAP4H.tmp\temp_17325.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-PAP4H.tmp\temp_17325.tmp" /SL5="$5002C,1967372,813056,C:\Users\Admin\AppData\Local\Temp\temp_17325.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3960
          • C:\Users\Admin\AppData\Local\Temp\temp_17325.exe
            "C:\Users\Admin\AppData\Local\Temp\temp_17325.exe" /VERYSILENT
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:464
            • C:\Users\Admin\AppData\Local\Temp\is-10TH0.tmp\temp_17325.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-10TH0.tmp\temp_17325.tmp" /SL5="$6002C,1967372,813056,C:\Users\Admin\AppData\Local\Temp\temp_17325.exe" /VERYSILENT
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:4972
              • C:\Users\Admin\AppData\Local\Temp\is-7KEN1.tmp\7z.exe
                "C:\Users\Admin\AppData\Local\Temp\is-7KEN1.tmp\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\is-7KEN1.tmp\AppHostInterface_1.drv.7z" -o"C:\Users\Admin\AppData\Roaming\AppHostInterface_1" -pmkyOzOvxg7yXsjAH44noXr5HpVjXs94S -y
                7⤵
                • Executes dropped EXE
                PID:5584
              • C:\Windows\SysWOW64\regsvr32.exe
                "regsvr32.exe" /s /i:svc "C:\Users\Admin\AppData\Roaming\AppHostInterface_1\\AppHostInterface_1.drv"
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:4080
                • C:\Windows\system32\regsvr32.exe
                  /s /i:svc "C:\Users\Admin\AppData\Roaming\AppHostInterface_1\\AppHostInterface_1.drv"
                  8⤵
                  • Loads dropped DLL
                  PID:2572
      • C:\Users\Admin\AppData\Local\Temp\temp_17331.exe
        "C:\Users\Admin\AppData\Local\Temp\temp_17331.exe"
        3⤵
        • Executes dropped EXE
        PID:4816
      • C:\Users\Admin\AppData\Local\Temp\temp_17338.exe
        "C:\Users\Admin\AppData\Local\Temp\temp_17338.exe"
        3⤵
        • Executes dropped EXE
        PID:6012
        • C:\Users\Admin\AppData\Local\Temp\temp_17338.exe
          "C:\Users\Admin\AppData\Local\Temp\temp_17338.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4296
    • C:\Users\Admin\AppData\Local\Temp\DC62.tmp.exe
      C:\Users\Admin\AppData\Local\Temp\DC62.tmp.exe
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies registry class
      PID:1824
      • C:\Windows\system32\sysmanger.exe
        "C:\Windows\system32\sysmanger.exe"
        3⤵
        • Executes dropped EXE
        PID:6088
  • C:\Users\Admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe
    "C:\Users\Admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe"
    1⤵
    • Executes dropped EXE
    PID:3684
  • C:\Windows\system32\regsvr32.EXE
    "C:\Windows\system32\regsvr32.EXE" /s /i:--type=renderer "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\PackageSupportFramework_7.pfx"
    1⤵
    • Loads dropped DLL
    PID:2600
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:--type=renderer \"%APPDATA%\Microsoft\SystemCertificates\PackageSupportFramework_7.pfx\"' }) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4552
  • C:\Windows\system32\regsvr32.EXE
    "C:\Windows\system32\regsvr32.EXE" /s /i:svc "C:\Users\Admin\AppData\Roaming\AppHostInterface_1\AppHostInterface_1.drv"
    1⤵
    • Loads dropped DLL
    PID:2136
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:svc \"%APPDATA%\AppHostInterface_1\AppHostInterface_1.drv\"' }) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2624
  • C:\Users\Admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe
    "C:\Users\Admin\AppData\Local\Temp\56e51a1e3a\nudwee.exe"
    1⤵
    • Executes dropped EXE
    PID:2592
  • C:\Windows\system32\regsvr32.EXE
    "C:\Windows\system32\regsvr32.EXE" /s /i:--type=renderer "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\PackageSupportFramework_7.pfx"
    1⤵
    • Loads dropped DLL
    PID:4264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:--type=renderer \"%APPDATA%\Microsoft\SystemCertificates\PackageSupportFramework_7.pfx\"' }) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1968
  • C:\Windows\system32\regsvr32.EXE
    "C:\Windows\system32\regsvr32.EXE" /s /i:svc "C:\Users\Admin\AppData\Roaming\AppHostInterface_1\AppHostInterface_1.drv"
    1⤵
    • Loads dropped DLL
    PID:3100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:svc \"%APPDATA%\AppHostInterface_1\AppHostInterface_1.drv\"' }) { exit 0 } else { exit 1 }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4696

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Modify Registry

        1
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        2
        T1552

        Credentials In Files

        2
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Query Registry

        2
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Screenshot.jpg
        • Path C:\ProgramData\{5c9f31d1-222e-11f0-8b4f-806e6f6e6963}\Screenshot.jpg
        • Size 93KB
        • SHA256 6fd7ca8ef803d9c529f58210a7e47826f9c1c226351b7603d1a9de9cc60f6e09
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        1.exe
        • Path C:\Users\Admin\AppData\Local\Temp\10000320101\1.exe
        • Size 273KB
        • SHA256 c8913dafd7358b2d266c485d26f80835380468e00316f015dbe54c42eb812d74
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2.exe
        • Path C:\Users\Admin\AppData\Local\Temp\10000330101\2.exe
        • Size 195KB
        • SHA256 d6b7c87e6caec7f88bb2cb14a8488a5989260ca2b27f14a91ee56695ed453abf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        3.exe
        • Path C:\Users\Admin\AppData\Local\Temp\10000340101\3.exe
        • Size 2.8MB
        • SHA256 84d8ac8e76397cb0ad4285d1bb189e901212632ab3d5f777eb8fd468ec74c480
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        4.exe
        • Path C:\Users\Admin\AppData\Local\Temp\10000420101\4.exe
        • Size 299B
        • SHA256 c76a47d748daf5017a564db8ebb28b9abf35e7782d54ca5899954ff3f6dc4193
        • MD5 SHA1 SHA512
        Submit Download

        Launcher.exe
        • Path C:\Users\Admin\AppData\Local\Temp\Launcher.exe
        • Size 475KB
        • SHA256 a3e2c415e6fcde6efedfef34d23f8ea1385377c1f3d1d13766cbd14107207f26
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\VCRUNTIME140.dll
        • Size 87KB
        • SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\_bz2.pyd
        • Size 82KB
        • SHA256 c55821f5fdb0064c796b2c0b03b51971f073140bc210cbe6ed90387db2bed929
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\_ctypes.pyd
        • Size 120KB
        • SHA256 9459d246df7a3c638776305cf3683946ba8db26a7de90df8b60e1be0b27e53c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\_hashlib.pyd
        • Size 44KB
        • SHA256 3692fc8e70e6e29910032240080fc8109248ce9a996f0a70d69acf1542fca69a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\_lzma.pyd
        • Size 246KB
        • SHA256 9442dc46829485670a6ac0c02ef83c54b401f1570d1d5d1d85c19c1587487764
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-console-l1-1-0.dll
        • Size 19KB
        • SHA256 f3a41d882544202b2e1bdf3d955458be11fc7f76ba12668388a681870636f143
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-datetime-l1-1-0.dll
        • Size 19KB
        • SHA256 7e5bd3ee263d09c7998e0d5ffa684906ddc56da61536331c89c74b039df00c7c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-debug-l1-1-0.dll
        • Size 19KB
        • SHA256 990e46d8f7c9574a558ebdfcb8739fbccba59d0d3a2193c9c8e66807387a276d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 19KB
        • SHA256 a011260fafaaaefd7e7326d8d5290c6a76d55e5af4e43ffa4de5fea9b08fa928
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-file-l1-1-0.dll
        • Size 22KB
        • SHA256 5d72feac789562d445d745a55a99536fa9302b0c27b8f493f025ba69ba31941c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-file-l1-2-0.dll
        • Size 19KB
        • SHA256 2a59dd891533a028fae7a81e690e4c28c9074c2f327393fab17329affe53fd7b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-file-l2-1-0.dll
        • Size 19KB
        • SHA256 0a6e2224cde90a0d41926e8863f9956848ffbf19848e8855bd08953112afc801
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-handle-l1-1-0.dll
        • Size 19KB
        • SHA256 f82d05aea21bcf6337ef45fbdad6d647d17c043a67b44c7234f149f861a012b9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-heap-l1-1-0.dll
        • Size 19KB
        • SHA256 63fb84a49308b857804ae1481d2d53b00a88bbd806d257d196de2bd5c385701e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 19KB
        • SHA256 6a83ab9a413afd74d77a090f52784b0128527bee9cb0a4224c59d5c75fc18387
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 19KB
        • SHA256 84c579a8263a87991ca1d3aee2845e1c262fb4b849606358062093d08afdc7a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-localization-l1-2-0.dll
        • Size 21KB
        • SHA256 67ebe168b7019627d68064043680674f9782fda7e30258748b29412c2b3d4c6b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-memory-l1-1-0.dll
        • Size 19KB
        • SHA256 9ca500775fee9ff69b960d65040b8dc415a2efde2982a9251ee6a3e8de625bc7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 19KB
        • SHA256 2695761b010d22fdfda2b5e73cf0ac7328ccc62b4b28101d5c10155dd9a48020
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 20KB
        • SHA256 5660030ee4c18b1610fb9f46e66f44d3fc1cf714ecce235525f08f627b3738d7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 21KB
        • SHA256 6781071119d66757efa996317167904697216ad72d7c031af4337138a61258d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 19KB
        • SHA256 4ef09fa6510eeebb4855b6f197b20a7a27b56368c63cc8a3d1014fa4231ab93a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-profile-l1-1-0.dll
        • Size 18KB
        • SHA256 c4868e4cebdf86126377a45bd829d88449b4aa031c9b1c05edc47d6d395949d4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 19KB
        • SHA256 4b532729988224fe5d98056cd94fc3e8b4ba496519f461ef5d9d0ff9d9402d4b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-string-l1-1-0.dll
        • Size 19KB
        • SHA256 f040b6e07935b67599ea7e32859a3e93db37ff4195b28b4451ad0d274db6330e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-synch-l1-1-0.dll
        • Size 21KB
        • SHA256 f596c72be43db3a722b7c7a0fd3a4d5aea68267003986fbfd278702af88efa74
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-synch-l1-2-0.dll
        • Size 19KB
        • SHA256 b394b1142d060322048fb6a8ac6281e4576c0e37be8da772bc970f352dd22a20
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 20KB
        • SHA256 286068a999fe179ee91b289360dd76e89365900b130a50e8651a9b7ece80b36d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-timezone-l1-1-0.dll
        • Size 19KB
        • SHA256 05fe96faa8429992520451f4317fbceba1b17716fa2caf44ddc92ede88ce509d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-core-util-l1-1-0.dll
        • Size 19KB
        • SHA256 8aca888849e9089a3a56fa867b16b071951693ab886843cfb61bd7a5b08a1ece
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-conio-l1-1-0.dll
        • Size 20KB
        • SHA256 f1a2499cc238e52d69c63a43d1e61847cf852173fe95c155056cfbd2cb76abc3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-convert-l1-1-0.dll
        • Size 23KB
        • SHA256 08a43a53a66d8acb2e107e6fc71213cedd180363055a2dc5081fe5a837940dce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-environment-l1-1-0.dll
        • Size 19KB
        • SHA256 5af7aa065ffdbf98d139246e198601bfde025d11a6c878201f4b99876d6c7eac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 21KB
        • SHA256 424fd5d3d3297a8ab1227007ef8ded5a4f194f24bd573a5211be71937aa55d22
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-heap-l1-1-0.dll
        • Size 20KB
        • SHA256 735703c0597da278af8a6359fc051b9e657627f50ad5b486185c2ef328ad571b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-locale-l1-1-0.dll
        • Size 19KB
        • SHA256 89d9f54e6c9ae1cb8f914da1a2993a20de588c18f1aaf4d66efb20c3a282c866
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-math-l1-1-0.dll
        • Size 28KB
        • SHA256 560baf1b87b692c284ccbb82f2458a688757231b315b6875482e08c8f5333b3d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-process-l1-1-0.dll
        • Size 20KB
        • SHA256 7e90e7acc69aca4591ce421c302c7f6cdf8e44f3b4390f66ec43dff456ffea29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 23KB
        • SHA256 fe7336d2fb3b13a00b5b4ce055a84f0957daefdace94f21b88e692e54b678ac3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 25KB
        • SHA256 c14f0d929a761a4505628c4eb5754d81b88aa1fdad2154a2f2b0215b983b6d89
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-string-l1-1-0.dll
        • Size 25KB
        • SHA256 1eb30ea95dae91054a33a12b1c73601518d28e3746db552d7ce120da589d4cf4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-time-l1-1-0.dll
        • Size 21KB
        • SHA256 de81c4d37833380a1c71a5401de3ab4fe1f8856fc40d46d0165719a81d7f3924
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\api-ms-win-crt-utility-l1-1-0.dll
        • Size 19KB
        • SHA256 88d3918e2f063553cee283306365aa8701e60fb418f37763b4719f9974f07477
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\base_library.zip
        • Size 821KB
        • SHA256 b191e669b1c715026d0732cbf8415f1ff5cfba5ed9d818444719d03e72d14233
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\libffi-7.dll
        • Size 32KB
        • SHA256 8c1f7f64579d01fedfde07e0906b1f8e607c34d5e6424c87abe431a2322eba79
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\python38.dll
        • Size 4.0MB
        • SHA256 59ab345c565304f638effa7c0236f26041fd06e35041a75988e13995cd28ace9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\select.pyd
        • Size 26KB
        • SHA256 63b81af5d3576473c17ac929bea0add5bf8d7ea95c946caf66cbb9ad3f233a88
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\ucrtbase.dll
        • Size 1021KB
        • SHA256 3c60056371f82e4744185b6f2fa0c69042b1e78804685944132974dd13f3b6d9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI24642\unicodedata.pyd
        • Size 1.0MB
        • SHA256 0f84e9f0d0bf44d10527a9816fcab495e3d797b09e7bbd1e6bd666ceb4b6c1a8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        __PSScriptPolicyTest_kmm50roo.nq4.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kmm50roo.nq4.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512
        Submit Download

        temp_17295.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-4DHPM.tmp\temp_17295.tmp
        • Size 3.3MB
        • SHA256 8dd10666fe31c9b726aadd5c49d8475045764fcb905a601a594dcdec09a107af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _shfoldr.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-58KES.tmp\_isetup\_shfoldr.dll
        • Size 22KB
        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        is-CGALU.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-7KEN1.tmp\is-CGALU.tmp
        • Size 683KB
        • SHA256 1ba33da39ffa078bc712d6dc5560f05716472d68e3c99ac22fb11a141c9a11f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _setup64.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-8AGFV.tmp\_isetup\_setup64.tmp
        • Size 6KB
        • SHA256 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        7z.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-L2FVM.tmp\7z.exe
        • Size 1.3MB
        • SHA256 fbb3dadcc29bcbc5460484d858c5f33f99e5317f5f6cd8d9c83f4dd8c39b3e30
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        temp_17305.exe
        • Path C:\Users\Admin\AppData\Local\Temp\temp_17305.exe
        • Size 1.2MB
        • SHA256 1cbed022238c36698389ef25a9e8b54abfc21cd0041f29e8960d9af0ba70daf4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        temp_17312.exe
        • Path C:\Users\Admin\AppData\Local\Temp\temp_17312.exe
        • Size 5.6MB
        • SHA256 7135da890aef09e3f56291cb944e8e8fd341937649cf437ddb988447d4033cc4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        clip64.dll
        • Path C:\Users\Admin\AppData\Roaming\7ae14b05c802cd\clip64.dll
        • Size 124KB
        • SHA256 cdd864c3c225c3d95f0b5ef2ad7993781cf5216b9777cf6f5366f4266189e1ab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bvcbghgf.exe
        • Path C:\Users\Admin\AppData\Roaming\bvcbghgf.exe
        • Size 2.4MB
        • SHA256 35c4b9c27fd5e7fe2ae63026d52efd10a4672d5254584190923aeb8169cd4da2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cvcxxxx.exe
        • Path C:\Users\Admin\AppData\Roaming\cvcxxxx.exe
        • Size 3.0MB
        • SHA256 fbcbe26a6c1a6fc8b451d3aec8a91384a15124c8ca9931363bdd9ed174631b11
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        cxvezrfde.exe
        • Path C:\Users\Admin\AppData\Roaming\cxvezrfde.exe
        • Size 5.6MB
        • SHA256 789bec99500eb4b2c3ce10d651f9bc46acc89bac5636c731dc0414ce36e391c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        dfssdfxx.exe
        • Path C:\Users\Admin\AppData\Roaming\dfssdfxx.exe
        • Size 415KB
        • SHA256 2106190991efc4291f4211dd54ddb7444e7bf51503842a1380a4a1d902d888b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        gfgdfxwx.exe
        • Path C:\Users\Admin\AppData\Roaming\gfgdfxwx.exe
        • Size 138KB
        • SHA256 47ec05fa7ed4b24c51ce19c2cca63982a8d376278247391910b4ebaf7af4dcee
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        wxcvxverd.exe
        • Path C:\Users\Admin\AppData\Roaming\wxcvxverd.exe
        • Size 3.7MB
        • SHA256 631491fd39ec560d77b9c0bf55c1fb8c144e2b7effd25fe52342ed99c052d4ee
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/464-632-0x0000000000D20000-0x0000000000DF6000-memory.dmp
        Download

        memory/464-605-0x0000000000D20000-0x0000000000DF6000-memory.dmp
        Download

        memory/1208-226-0x0000000000400000-0x0000000000528000-memory.dmp
        Download

        memory/1232-507-0x0000000000390000-0x0000000000466000-memory.dmp
        Download

        memory/1232-478-0x0000000000390000-0x0000000000466000-memory.dmp
        Download

        memory/1488-418-0x0000000000430000-0x0000000000792000-memory.dmp
        Download

        memory/1816-214-0x0000000000400000-0x0000000000528000-memory.dmp
        Download

        memory/1816-471-0x00000000000D0000-0x0000000000432000-memory.dmp
        Download

        memory/2020-633-0x00007FFBA6FC0000-0x00007FFBA715C000-memory.dmp
        Download

        memory/2932-505-0x00000000005D0000-0x0000000000932000-memory.dmp
        Download

        memory/3036-463-0x0000000000390000-0x0000000000466000-memory.dmp
        Download

        memory/3036-490-0x0000000000390000-0x0000000000466000-memory.dmp
        Download

        memory/3036-789-0x000001DB0B960000-0x000001DB0B9B2000-memory.dmp
        Download

        memory/3064-295-0x0000019AC08B0000-0x0000019AC0AA8000-memory.dmp
        Download

        memory/3460-107-0x0000000000400000-0x000000000042D000-memory.dmp
        Download

        memory/3460-216-0x0000000000400000-0x000000000042D000-memory.dmp
        Download

        memory/3488-304-0x0000000009EE0000-0x0000000009FEB000-memory.dmp
        Download

        memory/3488-372-0x0000000009EE0000-0x0000000009FEB000-memory.dmp
        Download

        memory/3488-373-0x0000000009C70000-0x0000000009CA3000-memory.dmp
        Download

        memory/3488-303-0x0000000009EE0000-0x0000000009FEB000-memory.dmp
        Download

        memory/3488-378-0x0000000009EE0000-0x0000000009FEB000-memory.dmp
        Download

        memory/3488-371-0x00000000033E0000-0x00000000033E1000-memory.dmp
        Download

        memory/3488-375-0x0000000009EE0000-0x0000000009FEB000-memory.dmp
        Download

        memory/3496-227-0x0000000000400000-0x000000000042D000-memory.dmp
        Download

        memory/3496-212-0x0000000000400000-0x000000000042D000-memory.dmp
        Download

        memory/3496-476-0x0000000000150000-0x00000000004B2000-memory.dmp
        Download

        memory/3528-305-0x00007FFBB2150000-0x00007FFBB27C6000-memory.dmp
        Download

        memory/3528-296-0x00007FFBB2150000-0x00007FFBB27C6000-memory.dmp
        Download

        memory/3528-297-0x0000000002F70000-0x0000000003075000-memory.dmp
        Download

        memory/3532-237-0x00000185FF460000-0x00000185FF482000-memory.dmp
        Download

        memory/3728-204-0x0000000005170000-0x0000000005202000-memory.dmp
        Download

        memory/3728-209-0x0000000005230000-0x000000000523A000-memory.dmp
        Download

        memory/3728-202-0x0000000000860000-0x00000000008DE000-memory.dmp
        Download

        memory/3728-203-0x0000000005820000-0x0000000005DC6000-memory.dmp
        Download

        memory/3944-608-0x0000000000D20000-0x0000000000DF6000-memory.dmp
        Download

        memory/3944-598-0x0000000000D20000-0x0000000000DF6000-memory.dmp
        Download

        memory/3960-604-0x0000000000860000-0x0000000000BC2000-memory.dmp
        Download

        memory/4312-330-0x0000022EA5210000-0x0000022EA524C000-memory.dmp
        Download

        memory/4312-329-0x0000022EA40E0000-0x0000022EA40F2000-memory.dmp
        Download

        memory/4312-517-0x0000022EA6AE0000-0x0000022EA6CA2000-memory.dmp
        Download

        memory/4312-254-0x0000022E88060000-0x0000022E88260000-memory.dmp
        Download

        memory/4312-527-0x0000022EA71E0000-0x0000022EA7708000-memory.dmp
        Download

        memory/4312-308-0x0000022E8B6F0000-0x0000022E8B742000-memory.dmp
        Download

        memory/4312-477-0x0000022EA52B0000-0x0000022EA5300000-memory.dmp
        Download

        memory/4312-328-0x0000022EA5DC0000-0x0000022EA5ECA000-memory.dmp
        Download

        memory/4576-420-0x0000000000D00000-0x0000000000DD6000-memory.dmp
        Download

        memory/4576-405-0x0000000000D00000-0x0000000000DD6000-memory.dmp
        Download

        memory/4896-474-0x0000000000D00000-0x0000000000DD6000-memory.dmp
        Download

        memory/4896-417-0x0000000000D00000-0x0000000000DD6000-memory.dmp
        Download

        memory/4948-252-0x00000189E3280000-0x00000189E33E9000-memory.dmp
        Download

        memory/4972-630-0x0000000000930000-0x0000000000C92000-memory.dmp
        Download