hijackloader | 3fb23f5d7b8b015a5b280010689a039431542f974ada04fc0da794a72769740e

Analysis

max time kernel
92s
max time network
142s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250619-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250619-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
01/08/2025, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kmspico.msi
Size 6.6MB
Sample250801-vknwmsdr71
SHA256 3fb23f5d7b8b015a5b280010689a039431542f974ada04fc0da794a72769740e
MD5 8e054b2a5db26de6fffa3f43e3a8c462
SHA1 e49f5ab3ca7858bb5a1e441028196d69dfe6f37b
SHA512 1058942e5b95b714b6f366ca53932f12a247123d104311affc4b5ae2a0a73e5972e03b60b32280e3a457f4e303083dc2e898f65030a1bc6b7ed9537958758312
SSDEEP 98304:4vzIZiXknujvvdkH3mRMz1yP7Aoj0Oonwz7ZIAOGR4O/jc6EVbxAWxGCzsD8:ilXgubvdkXzUPqLw/ZhzR4O/7gFw8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

hijackloader rhadamanthys discovery execution loader persistence privilege_escalation ransomware stealer

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\AJvalidatev3
inject_dll
%windir%\SysWOW64\pla.dll

xor.hex

Signatures

Detects HijackLoader (aka IDAT Loader) 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000281c2-50.dat	family_hijackloader

Detects Rhadamanthys Payload 1 IoCs

resource	yara_rule
behavioral2/memory/780-139-0x0000000002FB0000-0x00000000033B0000-memory.dmp	family_rhadamanthys_payload

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Hijackloader family
hijackloader
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Rhadamanthys family
rhadamanthys

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5484	powershell.exe
3612	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5336 set thread context of 780	5336	ValidatorF.exe	162
PID 5336 set thread context of 3532	5336	ValidatorF.exe	163

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5797ec.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3D77372D-1473-4F54-8D78-2AD097918BE2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9904.tmp	msiexec.exe
File created	C:\Windows\Installer\e5797ea.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5797ea.msi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4328	ValidatorF.exe
5336	ValidatorF.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1420	sc.exe
4376	sc.exe

Loads dropped DLL 20 IoCs

pid	Process
4328	ValidatorF.exe
4328	ValidatorF.exe
4328	ValidatorF.exe
4328	ValidatorF.exe
4328	ValidatorF.exe
4328	ValidatorF.exe
4328	ValidatorF.exe
4328	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
780	AlphaMonito.exe
3532	XPFix.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5364	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AlphaMonito.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XPFix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ValidatorF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ValidatorF.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5948	PING.EXE
3548	cmd.exe
2368	PING.EXE
4244	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000077236c028bf47d2d0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff00000000270101000088380177236c020000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050e1000000ffffffff000000000700010000e8410177236c02000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea7177236c0200000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000077236c0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
552	reg.exe
5464	reg.exe
2028	reg.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
5948	PING.EXE
2368	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5988	msiexec.exe
5988	msiexec.exe
4328	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5484	powershell.exe
5484	powershell.exe
5484	powershell.exe
3612	powershell.exe
3612	powershell.exe
3612	powershell.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
5336	ValidatorF.exe
780	AlphaMonito.exe
780	AlphaMonito.exe
780	AlphaMonito.exe
780	AlphaMonito.exe
3532	XPFix.exe
3532	XPFix.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
5336	ValidatorF.exe
5336	ValidatorF.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5364	msiexec.exe
Token: SeSecurityPrivilege	5988	msiexec.exe
Token: SeCreateTokenPrivilege	5364	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5364	msiexec.exe
Token: SeLockMemoryPrivilege	5364	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5364	msiexec.exe
Token: SeMachineAccountPrivilege	5364	msiexec.exe
Token: SeTcbPrivilege	5364	msiexec.exe
Token: SeSecurityPrivilege	5364	msiexec.exe
Token: SeTakeOwnershipPrivilege	5364	msiexec.exe
Token: SeLoadDriverPrivilege	5364	msiexec.exe
Token: SeSystemProfilePrivilege	5364	msiexec.exe
Token: SeSystemtimePrivilege	5364	msiexec.exe
Token: SeProfSingleProcessPrivilege	5364	msiexec.exe
Token: SeIncBasePriorityPrivilege	5364	msiexec.exe
Token: SeCreatePagefilePrivilege	5364	msiexec.exe
Token: SeCreatePermanentPrivilege	5364	msiexec.exe
Token: SeBackupPrivilege	5364	msiexec.exe
Token: SeRestorePrivilege	5364	msiexec.exe
Token: SeShutdownPrivilege	5364	msiexec.exe
Token: SeDebugPrivilege	5364	msiexec.exe
Token: SeAuditPrivilege	5364	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5364	msiexec.exe
Token: SeChangeNotifyPrivilege	5364	msiexec.exe
Token: SeRemoteShutdownPrivilege	5364	msiexec.exe
Token: SeUndockPrivilege	5364	msiexec.exe
Token: SeSyncAgentPrivilege	5364	msiexec.exe
Token: SeEnableDelegationPrivilege	5364	msiexec.exe
Token: SeManageVolumePrivilege	5364	msiexec.exe
Token: SeImpersonatePrivilege	5364	msiexec.exe
Token: SeCreateGlobalPrivilege	5364	msiexec.exe
Token: SeBackupPrivilege	2008	vssvc.exe
Token: SeRestorePrivilege	2008	vssvc.exe
Token: SeAuditPrivilege	2008	vssvc.exe
Token: SeBackupPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe
Token: SeTakeOwnershipPrivilege	5988	msiexec.exe
Token: SeRestorePrivilege	5988	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5364	msiexec.exe
5364	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 1900	5988	msiexec.exe	93
PID 5988 wrote to memory of 1900	5988	msiexec.exe	93
PID 5988 wrote to memory of 4328	5988	msiexec.exe	95
PID 5988 wrote to memory of 4328	5988	msiexec.exe	95
PID 5988 wrote to memory of 4328	5988	msiexec.exe	95
PID 4328 wrote to memory of 5336	4328	ValidatorF.exe	96
PID 4328 wrote to memory of 5336	4328	ValidatorF.exe	96
PID 4328 wrote to memory of 5336	4328	ValidatorF.exe	96
PID 5336 wrote to memory of 3580	5336	ValidatorF.exe	97
PID 5336 wrote to memory of 3580	5336	ValidatorF.exe	97
PID 5336 wrote to memory of 3580	5336	ValidatorF.exe	97
PID 3580 wrote to memory of 4132	3580	cmd.exe	99
PID 3580 wrote to memory of 4132	3580	cmd.exe	99
PID 3580 wrote to memory of 4132	3580	cmd.exe	99
PID 4132 wrote to memory of 5052	4132	cmd.exe	101
PID 4132 wrote to memory of 5052	4132	cmd.exe	101
PID 5052 wrote to memory of 4376	5052	cmd.exe	103
PID 5052 wrote to memory of 4376	5052	cmd.exe	103
PID 5052 wrote to memory of 6064	5052	cmd.exe	104
PID 5052 wrote to memory of 6064	5052	cmd.exe	104
PID 5052 wrote to memory of 5712	5052	cmd.exe	105
PID 5052 wrote to memory of 5712	5052	cmd.exe	105
PID 5052 wrote to memory of 5444	5052	cmd.exe	106
PID 5052 wrote to memory of 5444	5052	cmd.exe	106
PID 5052 wrote to memory of 1068	5052	cmd.exe	107
PID 5052 wrote to memory of 1068	5052	cmd.exe	107
PID 5052 wrote to memory of 5164	5052	cmd.exe	108
PID 5052 wrote to memory of 5164	5052	cmd.exe	108
PID 5052 wrote to memory of 2260	5052	cmd.exe	109
PID 5052 wrote to memory of 2260	5052	cmd.exe	109
PID 5052 wrote to memory of 3952	5052	cmd.exe	110
PID 5052 wrote to memory of 3952	5052	cmd.exe	110
PID 5052 wrote to memory of 4564	5052	cmd.exe	111
PID 5052 wrote to memory of 4564	5052	cmd.exe	111
PID 4564 wrote to memory of 2012	4564	cmd.exe	112
PID 4564 wrote to memory of 2012	4564	cmd.exe	112
PID 4564 wrote to memory of 324	4564	cmd.exe	113
PID 4564 wrote to memory of 324	4564	cmd.exe	113
PID 5052 wrote to memory of 1056	5052	cmd.exe	114
PID 5052 wrote to memory of 1056	5052	cmd.exe	114
PID 5052 wrote to memory of 464	5052	cmd.exe	115
PID 5052 wrote to memory of 464	5052	cmd.exe	115
PID 5052 wrote to memory of 928	5052	cmd.exe	116
PID 5052 wrote to memory of 928	5052	cmd.exe	116
PID 5052 wrote to memory of 1216	5052	cmd.exe	117
PID 5052 wrote to memory of 1216	5052	cmd.exe	117
PID 1216 wrote to memory of 5484	1216	cmd.exe	118
PID 1216 wrote to memory of 5484	1216	cmd.exe	118
PID 5052 wrote to memory of 6116	5052	cmd.exe	119
PID 5052 wrote to memory of 6116	5052	cmd.exe	119
PID 6116 wrote to memory of 568	6116	cmd.exe	120
PID 6116 wrote to memory of 568	6116	cmd.exe	120
PID 5052 wrote to memory of 2028	5052	cmd.exe	121
PID 5052 wrote to memory of 2028	5052	cmd.exe	121
PID 5052 wrote to memory of 3732	5052	cmd.exe	122
PID 5052 wrote to memory of 3732	5052	cmd.exe	122
PID 5052 wrote to memory of 5464	5052	cmd.exe	123
PID 5052 wrote to memory of 5464	5052	cmd.exe	123
PID 5052 wrote to memory of 5552	5052	cmd.exe	124
PID 5052 wrote to memory of 5552	5052	cmd.exe	124
PID 5052 wrote to memory of 552	5052	cmd.exe	125
PID 5052 wrote to memory of 552	5052	cmd.exe	125
PID 5552 wrote to memory of 1420	5552	cmd.exe	128
PID 5552 wrote to memory of 1420	5552	cmd.exe	128

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\kmspico.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5364

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1900
- C:\Users\Admin\AppData\Local\Muskrat\ValidatorF.exe
  "C:\Users\Admin\AppData\Local\Muskrat\ValidatorF.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\ProgramData\AJvalidatev3\ValidatorF.exe
    C:\ProgramData\AJvalidatev3\ValidatorF.exe
    3⤵
    - Suspicious use of SetThreadContext
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:5336
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /min "" "C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4132
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat" re1"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\System32\sc.exe
        
        sc query Null
        7⤵
        Launches sc.exe
        
        PID:4376
        
        C:\Windows\System32\find.exe
        
        find /i "RUNNING"
        7⤵
        
        PID:6064
        
        C:\Windows\System32\findstr.exe
        
        findstr /v "$" "444.bat"
        7⤵
        
        PID:5712
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ver
        7⤵
        
        PID:5444
        
        C:\Windows\System32\reg.exe
        
        reg query "HKCU\Console" /v ForceV2
        7⤵
        
        PID:1068
        
        C:\Windows\System32\find.exe
        
        find /i "0x0"
        7⤵
        
        PID:5164
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
        7⤵
        
        PID:2260
        
        C:\Windows\System32\find.exe
        
        find /i "ARM64"
        7⤵
        
        PID:3952
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        8⤵
        
        PID:2012
        
        C:\Windows\System32\cmd.exe
        
        cmd
        8⤵
        
        PID:324
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat" "
        7⤵
        
        PID:1056
        
        C:\Windows\System32\find.exe
        
        find /i "C:\Users\Admin\AppData\Local\Temp"
        7⤵
        
        PID:464
        
        C:\Windows\System32\fltMC.exe
        
        fltmc
        7⤵
        
        PID:928
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat') -split ':pstst';iex ($f[1])}" 2>nul
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat') -split ':pstst';iex ($f[1])}"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5484
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c mode con
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:6116
        
        C:\Windows\System32\mode.com
        
        mode con
        8⤵
        
        PID:568
        
        C:\Windows\System32\reg.exe
        
        reg query HKCU\Console /v QuickEdit
        7⤵
        Modifies registry key
        
        PID:2028
        
        C:\Windows\System32\find.exe
        
        find /i "0x0"
        7⤵
        
        PID:3732
        
        C:\Windows\System32\reg.exe
        
        reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f
        7⤵
        Modifies registry key
        
        PID:5464
        
        C:\Windows\System32\cmd.exe
        
        cmd.exe /c ""C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat" -qedit"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:5552
        
        C:\Windows\System32\sc.exe
        
        sc query Null
        8⤵
        Launches sc.exe
        
        PID:1420
        
        C:\Windows\System32\find.exe
        
        find /i "RUNNING"
        8⤵
        
        PID:6120
        
        C:\Windows\System32\findstr.exe
        
        findstr /v "$" "444.bat"
        8⤵
        
        PID:2932
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
        8⤵
        
        PID:2844
        
        C:\Windows\System32\find.exe
        
        find /i "/"
        8⤵
        
        PID:2888
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ver
        8⤵
        
        PID:3248
        
        C:\Windows\System32\reg.exe
        
        reg query "HKCU\Console" /v ForceV2
        8⤵
        
        PID:3132
        
        C:\Windows\System32\find.exe
        
        find /i "0x0"
        8⤵
        
        PID:4040
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "
        8⤵
        
        PID:1096
        
        C:\Windows\System32\find.exe
        
        find /i "ARM64"
        8⤵
        
        PID:2568
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c echo prompt $E | cmd
        8⤵
        
        PID:2200
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "
        9⤵
        
        PID:3644
        
        C:\Windows\System32\cmd.exe
        
        cmd
        9⤵
        
        PID:2184
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat" "
        8⤵
        
        PID:4912
        
        C:\Windows\System32\find.exe
        
        find /i "C:\Users\Admin\AppData\Local\Temp"
        8⤵
        
        PID:5268
        
        C:\Windows\System32\fltMC.exe
        
        fltmc
        8⤵
        
        PID:2760
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat') -split ':pstst';iex ($f[1])}" 2>nul
        8⤵
        
        PID:4252
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[io.file]::ReadAllText('C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat') -split ':pstst';iex ($f[1])}"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3612
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c mode con
        8⤵
        
        PID:4680
        
        C:\Windows\System32\mode.com
        
        mode con
        9⤵
        
        PID:5240
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ping -n 1 activated.win
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4244
        
        C:\Windows\System32\PING.EXE
        
        ping -n 1 activated.win
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2368
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c ping -n 1 updatecheck34.activated.win
        8⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3548
        
        C:\Windows\System32\PING.EXE
        
        ping -n 1 updatecheck34.activated.win
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5948
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
        8⤵
        
        PID:3216
        
        C:\Windows\System32\find.exe
        
        find /i "/S"
        8⤵
        
        PID:2380
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /S /D /c" echo "-qedit" "
        8⤵
        
        PID:4540
        
        C:\Windows\System32\find.exe
        
        find /i "/"
        8⤵
        
        PID:4524
        
        C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        8⤵
        
        PID:5324
        
        C:\Windows\System32\reg.exe
        
        reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop
        9⤵
        
        PID:236
        
        C:\Windows\System32\mode.com
        
        mode 76, 34
        8⤵
        
        PID:3384
        
        C:\Windows\System32\choice.exe
        
        choice /C:123456789EH0 /N
        8⤵
        
        PID:4592
        
        C:\Windows\System32\reg.exe
        
        reg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f
        7⤵
        Modifies registry key
        
        PID:552
  - - C:\Users\Admin\AppData\Local\AlphaMonito.exe
      C:\Users\Admin\AppData\Local\AlphaMonito.exe
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:780
  - - C:\Users\Admin\AppData\Roaming\AJvalidatev3\XPFix.exe
      "C:\Users\Admin\AppData\Roaming\AJvalidatev3\XPFix.exe" "C:\Users\Admin\AppData\Roaming\AJvalidatev3\XPFix.exe" /u
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5797eb.rbs

Path C:\Config.Msi\e5797eb.rbs
Size 9KB
SHA256 1739ba3bfd579c603c4a78b36d285d9107ac0e78f5cfa7c8ab66d48cde597510
MD5 eb6b5cae42cb0faa183fab0608655157
SHA1 95546858bc9deaae53ab7ccf3266c5bf34a55e9f
SHA512 05d7e349435afc5d70ece5ec585413a85e27c69dfd38a1ca6d7f3b38693251f8300756747f2afad406fdeb70080e5856c5d731ec2dc3a3ff2ad1f4c4db4c88b5
SSDEEP 96:VXVvZiauGJOxmCySReXGRfareQYoY1rUl3WCsThqkFUl3WC6jCIsYWYwSThqkKHf:VXVxz8X8eFY9FIle9FelMAb2ph
MD5 SHA1 SHA512 SSDEEP

Submit Download

WebView2Loader.dll

Path C:\ProgramData\AJvalidatev3\WebView2Loader.dll
Size 112KB
SHA256 d6f70c734b09917e1ef9abc54a0edc84afea3f784e31c8ec75fb525b2821eee5
MD5 8fb7d2fa445716d23433ee696d41387d
SHA1 e9b64d19435fbcac962f2fc4de7853f4a5da2736
SHA512 d9a572fd60697bf142255f59065cacda4b78bf4ffd242daf89041c2054b7fc980c3044678ee209ed93874aba0e59f55527bae934fe50d6e50cddf8319d44d0c6
SSDEEP 3072:NswDUh9T2dO9O3ed9zJ11Xx3QKHwsT+2Et+AlLWD/I3qFW:Ns39T2dO4o91LEt7ht3sW
MD5 SHA1 SHA512 SSDEEP

Submit Download

AlphaMonito.exe

Path C:\Users\Admin\AppData\Local\AlphaMonito.exe
Size 105KB
SHA256 e7528b33c7cd299843613b6cb46b44bdcbccdb6e6462ca5fa9c8eddef6af89c7
MD5 d63b4b6a6645ae07c6095e86cd22c068
SHA1 b532392851cd09275a42de34b71f94e3c511b640
SHA512 b55c3e3ad9d4ddc48688cfda83dd3c0a29fc67b7fe54b56bfb5c42e11056c23c2f0c3e89849c4ea867d14885a94f1cbad6377d3a0295ee7b4e9c23335c8fab9a
SSDEEP 1536:MddQw3UY+aNgmZL2wBDY1dgQWqs+jBXujxw+KLEnzGrprj38uLx9+7axQ:vwLMeLAs+jE9wrrp/suLv+d
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 560aa5d6ec6739876253b86910ff244500d3958cdd8001dcea9c652a05e7cc93
MD5 553c1558f901a16ed4302ab4bafaf9f3
SHA1 b77f695bd5f765b6500d97757acbad6b5953e19c
SHA512 1da668e21b220a1d4aa20486819cb4f3bc5bf2baf876fcb2635a0c93f4e2bc5fc62ed9f5ac14ea2f4a8c5d8031377483537542820bede8b0ce4a3834362dd200
MD5 SHA1 SHA512

Submit Download

MSVCP140.dll

Path C:\Users\Admin\AppData\Local\Muskrat\MSVCP140.dll
Size 426KB
SHA256 51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad
MD5 8ff1898897f3f4391803c7253366a87b
SHA1 9bdbeed8f75a892b6b630ef9e634667f4c620fa0
SHA512 cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03
SSDEEP 12288:/gO0BGzePo6+J+4P0xYv7IQgnhUgiW6QR7t5s03Ooc8dHkC2esKcWKe0:701Po6+J+dxYv7IQgk03Ooc8dHkC2ezc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tikthaitkraert.lw

Path C:\Users\Admin\AppData\Local\Muskrat\Tikthaitkraert.lw
Size 22KB
SHA256 b511f571a0c86557c4818d11cbf6293a9f525229d6ca366bc0b1a58854dbea03
MD5 7e0c94ea824ed0494934d25546e22b9f
SHA1 e84ecfb8b785c875aafb2e4cf4610a6ad94faec8
SHA512 3ba958db4c837114e850b6181822af6dd8b147677fc3d3edeec8852fae2d0163a4df03740ccc81e7ca069125d02f1d8f4275281533d7d375c36b3fed39c87882
SSDEEP 384:gg2P+SM/8JA1+va699rnBfDvCvDO++OQbYYu5LSeqNG6aNZXJjaKNdXcsTWEm:Z21McCmrBfDvmWYYOsNLa9jaKnHm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Up.dll

Path C:\Users\Admin\AppData\Local\Muskrat\Up.dll
Size 589KB
SHA256 57972c5ce575ea09835212dba27791f33b8f07980bba69393d75b1cc20d58a6c
MD5 14bf5d3b181d00eaa72e0fe4a3c4d138
SHA1 53d6030fdf0077b1a4e4c362ed16b0a7ff9e8bf1
SHA512 8f4a64054fb8495b6fdbfc83aa9183c89fbbf4bab2dda539c39dbff511dbeb1e432ad066a68f119ce940c67ef874e178b97d6de3d0263633add8d22226e9ad8b
SSDEEP 12288:1qyzMOuCr45sYE6/jBiogAzJ72lVN6ElP17DO+FIN3MLSLqkvqg6c1ysDDZ+3y/G:YyQxDoAl2lfSe1adIPMI7OBW7D
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Muskrat\VCRUNTIME140.dll
Size 74KB
SHA256 9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5
MD5 1a84957b6e681fca057160cd04e26b27
SHA1 8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe
SHA512 5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa
SSDEEP 1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
MD5 SHA1 SHA512 SSDEEP

Submit Download

ValidatorF.exe

Path C:\Users\Admin\AppData\Local\Muskrat\ValidatorF.exe
Size 13.6MB
SHA256 3bab196c00e6aee9b91887f4575190fb722a04ed2094efd29db3c661c9f11ffb
MD5 b1ab1e61e7337d1583d37a2a47e0a032
SHA1 c0cd7602ba63955479ae087e158f05aaaa1a1ea9
SHA512 185010f4ea4de972317debd2eadf7fca090da945bcb004a9709462aeccd9167365f08d30a5a168c71f5401f09d4ae2ef22599f360da96a6f52a49e23f8211c5b
SSDEEP 98304:T8ypJkz5rZPYRMqRa6p0tk2svjGhw8Ov60XD:T8yPkz5rZjqRa6pFqh0T
MD5 SHA1 SHA512 SSDEEP

Submit Download

Zousdrair.tl

Path C:\Users\Admin\AppData\Local\Muskrat\Zousdrair.tl
Size 1.8MB
SHA256 a2b22415297f4c3ac62cfa992a74f0ab6c69dfe47273383cc944f946dba6d9bc
MD5 a7891f13f01a8a3701d558634887ea28
SHA1 4c033eb6cf095eb9080ffeb08ec058e4f7cca009
SHA512 b3d5cae6cb40cdb1b7d1db0b737446216f1a2f29f04249ec791b0724daef210a471be9bb456a4a63a9e80b83352f6b54f78bcb65767a617eb5a48c34c65140cd
SSDEEP 24576:ev9fAOL7kRJuA5F9j0ZzTUSUhbJyUuw7JmAvdOHs9+kDVOaah0Yj5tdJJj1BchS:ev9fzL7G2FTQdXYkDVOR5tdPJBchS
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-1_1.dll

Path C:\Users\Admin\AppData\Local\Muskrat\libcrypto-1_1.dll
Size 1.6MB
SHA256 729482ae82ae4f8509d1422345c361fb41fa355a46d2c58b8dfd10cd3ac2a0b2
MD5 1379eb0ade7b9559c56ac5b8895dc625
SHA1 d7d89c35ee1538beaabf3eb3ce4eb439a8de3397
SHA512 db7d3fd1792b763dc68d04637129580cbf28e49a4696cf8bd283146ba9d986cb4e6cea219445bb0ced12094b9c9009766c0224b9b29aaa0714de6520170b6f62
SSDEEP 49152:6t0EbtOBBL7g/Ubmg7m1CPwDv3uFciDuH:6t0EEBlgsbmgK1CPwDv3uFciQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

mfc140u.dll

Path C:\Users\Admin\AppData\Local\Muskrat\mfc140u.dll
Size 4.9MB
SHA256 e422c9366a53536a35e307ef301f08661c28c29b7fcda1b454333c6a41c6bb21
MD5 e76b52d11db435d36453d26c8b446a8f
SHA1 6e20c17ed973e38d4a3f26cfc020af05ff9a6eea
SHA512 486be0145d5e439d3d9f5191a4a49ea3685619796557cd7a361117c25a279ee7b94a9ff70c4d73adbe839a6ce508ab15692ddd8fd6eabc3dbef18b68d6b0c67f
SSDEEP 98304:bJZczGW8ke6KllNHsyBqGeQVrrNW2XkGMWrGFLOAkGkzdnEVomFHKnPUUdMG:XczGRGKLBZ/YGkGMWKFLOyomFHKnPr1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ns.dll

Path C:\Users\Admin\AppData\Local\Muskrat\ns.dll
Size 112KB
SHA256 b20b4852d5816942f69cfa26bfa7d1c7b60759b8cc9b2b00de9e541ab0756635
MD5 cd8a665f8aaed8e4c30a0acc87665811
SHA1 a9ddaa4b2034bba4aa50154b6b897bcfaa0d174a
SHA512 b848ddc70f096e5b2369d807eca6b6d94e6b95e5f48a9a7f3940611be2a26c4aa98824294fdcaa63ed3cdb26cc66c8f391ace7ca4b6b7f8e4a531fa3e2ebb360
SSDEEP 1536:Zka7y9jTlj8HC+Q8ynMXq5YNJeimDXQg5sN14rZ3GI7EsG37kt:HsjBQHC+Q5nJmWSgcarZ3GI7EsG37kt
MD5 SHA1 SHA512 SSDEEP

Submit Download

2329E05.tmp

Path C:\Users\Admin\AppData\Local\Temp\2329E05.tmp
Size 2.4MB
SHA256 3089e7ec6fe054942ff03a07a4bd44d4825ed00b636e32fd4b050a9f8f40ef6b
MD5 050e2d2b72180c93b730c2f6d72123df
SHA1 b38f4d2a40e5096b664ae9ab2cfe5b8c3fe6f18a
SHA512 32b91013f8988cd4bc0da37fdb5aaa5d5b873ad0d8c2f3dc5af7ba7f3e55a8b777ce4f65aa5958d6c057ad5ce115ae0a5ffbba9622ad19ecac184c2c87311b10
SSDEEP 49152:DPER2oJ3pcdbmQVAapqlQnuD7MOG8vf6Ztf29PsJxZ954L/7+t:i2oDcdbmQSlag7u8vfa+sjDn
MD5 SHA1 SHA512 SSDEEP

Submit Download

2329E05.tmp

Path C:\Users\Admin\AppData\Local\Temp\2329E05.tmp
Size 2.4MB
SHA256 8be5525fe915c3c9210d752df117d9e727d850c01eccc7f5c182bfbdd4718610
MD5 2696a6150b0582166d5d79a916a4c626
SHA1 e31e0c2472adb8690b0d4f2c422e20c6a8a48f6d
SHA512 ad35a625b35cd47acf4aaa7311bcee613c3ef7a8028ab427940085a138ae948093b52b899bc2c8edfa2eb1fb8ae5153bcfc55305593387251265c45ed234922d
SSDEEP 49152:vPER2oJ3GcdbmQVAapqlQnuD7MOG8vf6Ztf29PsJxZ954L/7+t:O2oMcdbmQSlag7u8vfa+sjDn
MD5 SHA1 SHA512 SSDEEP

Submit Download

865DF08.tmp

Path C:\Users\Admin\AppData\Local\Temp\865DF08.tmp
Size 40B
SHA256 72c8a422a46ae2992113810f88ae20f1137a37ef84abbebaf280034dcde97348
MD5 6768dd207b566d5f59816395efbc79e4
SHA1 148fa1b191f3bc55f3253797e8d567c6bc2c78fe
SHA512 176c7c3c89807f766e4095c56da31d3413492bb0019f594a311084306e2fbb424959cb07d1916dabb1834a3c7b872ec36a99729aa0c357ec8b6366909cf2cb72
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_dewwrhih.crl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dewwrhih.crl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

444.bat

Path C:\Users\Admin\AppData\Roaming\AJvalidatev3\EGBHINLCEUMPRF\444.bat
Size 757KB
SHA256 38dd00457d7c364f112b54019990c33db227a23356fab2521be7399ebd3640a5
MD5 8fb1d4045c59a3bebf3c8e4c1c6cc827
SHA1 82ab2c2667880c0c9c5da13a095ef36ac2f7b6d6
SHA512 5663d04b0c48d3f6661a2e22a65066d14d995df7f13001c7b4666c1ec758d430e501d7516950f3523919f0f2b193359375560ae78ace0e21b3d1bb15c9a62019
SSDEEP 6144:P2Iw0Mqx05wrUcEvTUQWObw7nccN4PK0yk4Bcub:P2Iw0T6cEvTU9O6c+EK0yk4BN
MD5 SHA1 SHA512 SSDEEP

Submit Download

XPFix.exe

Path C:\Users\Admin\AppData\Roaming\AJvalidatev3\XPFix.exe
Size 286KB
SHA256 5ec174af8a18a5516b8a6e11d8a27481d70df14d1edb67c48b5458ff44df9146
MD5 810d42177538ad5ca18d4dd597c00658
SHA1 7374bbe63c44de9536c22cdc111894c6d4929eb3
SHA512 233cdbaa1658719e9e44869930aef8ed09a17bd1e227c43785ce1b4298fd9f767818b75888db9cb5184a134a0babedd32cc0788059c251a1dff3f6aa27ebd30d
SSDEEP 6144:WEDFuBN6zANskE9qgfyMEvt93L2kx3W71+KL:WiuB4fyzvtFt3WFL
MD5 SHA1 SHA512 SSDEEP

Submit Download

e5797ea.msi

Path C:\Windows\Installer\e5797ea.msi
Size 6.6MB
SHA256 3fb23f5d7b8b015a5b280010689a039431542f974ada04fc0da794a72769740e
MD5 8e054b2a5db26de6fffa3f43e3a8c462
SHA1 e49f5ab3ca7858bb5a1e441028196d69dfe6f37b
SHA512 1058942e5b95b714b6f366ca53932f12a247123d104311affc4b5ae2a0a73e5972e03b60b32280e3a457f4e303083dc2e898f65030a1bc6b7ed9537958758312
SSDEEP 98304:4vzIZiXknujvvdkH3mRMz1yP7Aoj0Oonwz7ZIAOGR4O/jc6EVbxAWxGCzsD8:ilXgubvdkXzUPqLw/ZhzR4O/7gFw8
MD5 SHA1 SHA512 SSDEEP

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 9487ba8a9cbbe4df276e738e8e2be92510c767297772731c1f056af652cdb1f1
MD5 e1256ad1c4b936cf625376a0431f7b33
SHA1 fce3449120648c1325cd5ce5da6c94acb75b9a93
SHA512 0704139189dfe5b69f51ae83cf6a93f9a941dcdfc7d5cff8ad3c16d810d449d3092a8d50f65361499ba4982186e06ed796a3b771669e747bb15e16ec281c3879
SSDEEP 24576:GDEmg3k9doO/vvTLDYKuQ5GEC83fXClcGKY98TW4c/ajGG0n4vpsfqRxEz:Ca
MD5 SHA1 SHA512 SSDEEP

Submit Download

{c1c0fd9d-43e3-4dd7-a691-282d091f49f6}_OnDiskSnapshotProp

Path \??\Volume{026c2377-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{c1c0fd9d-43e3-4dd7-a691-282d091f49f6}_OnDiskSnapshotProp
Size 6KB
SHA256 d8ce2da7a7153a8dcbb1725d7c916f5bc9e91bc3480a8b915ca87cd8fcddf3c6
MD5 9a3f8ce7fbf5f02df4e834cf083ed6f5
SHA1 c01d6eb865e7f9161ad3d42f3ae652a96a722320
SHA512 4fa436b9b4cdda15a05730e8de3d5e9ffa7ee4ab1e295ced98193412deacbf0baa45957a72fd38b7143aa2ff683fcff7fe58dd27dfdef8bdaa26fb0d9bdafcdf
SSDEEP 96:FRcKrJMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:QN1b++ZVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/780-139-0x0000000002FB0000-0x00000000033B0000-memory.dmp

Download

memory/780-149-0x0000000000B90000-0x0000000000C2F000-memory.dmp

Download

memory/780-140-0x0000000002FB0000-0x00000000033B0000-memory.dmp

Download

memory/780-131-0x0000000000B90000-0x0000000000C2F000-memory.dmp

Download

memory/780-144-0x0000000075C50000-0x0000000075E8A000-memory.dmp

Download

memory/780-136-0x00007FFE70EF0000-0x00007FFE710E8000-memory.dmp

Download

memory/780-137-0x0000000000B90000-0x0000000000C2F000-memory.dmp

Download

memory/3532-150-0x00007FFE70EF0000-0x00007FFE710E8000-memory.dmp

Download

memory/4328-51-0x0000000073D90000-0x0000000073F0B000-memory.dmp

Download

memory/4328-52-0x00007FFE70EF0000-0x00007FFE710E8000-memory.dmp

Download

memory/5336-123-0x0000000073F50000-0x00000000740CB000-memory.dmp

Download

memory/5336-67-0x0000000073F50000-0x00000000740CB000-memory.dmp

Download

memory/5336-65-0x00007FFE70EF0000-0x00007FFE710E8000-memory.dmp

Download

memory/5336-64-0x0000000073F50000-0x00000000740CB000-memory.dmp

Download

memory/5484-108-0x00000228D0E00000-0x00000228D0E22000-memory.dmp

Download