Overview

overview

10

Static

static

3

4363463463...63.exe

windows10-ltsc_2021-x64

4363463463...63.exe

windows11-21h2-x64

New Text D...od.exe

windows10-ltsc_2021-x64

New Text D...od.exe

windows11-21h2-x64

10

Resubmissions

15/09/2026, 11:12

260915-navswatygv10

07/09/2026, 00:25

260907-aqql7sttav10

04/08/2026, 14:58

260804-sb5rpashpf10

04/08/2026, 06:06

260804-gt3t9seb3810

04/08/2026, 05:43

260804-gey8jaw1bx10

24/07/2026, 07:14

260724-h2zy1svbmg10

24/07/2026, 07:09

260724-hy9ztatwfy10

24/07/2026, 06:50

260724-hmdggahn6v10

21/07/2026, 16:13

260721-tpe9macc423

21/07/2026, 16:00

260721-tfvb7axvcy10

Analysis

  • max time kernel
    222s
  • max time network
    241s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251015-en
  • resource tags

    arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    10/11/2025, 00:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    4363463463464363463463463.exe
  • Size 10KB
  • Sample251110-apl8dswkgl
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
adwarebotnetoffice04defense_evasiondiscoverydownloaderevasionexecutionazorultquasarsvcstealerxenoratxwormimpactinfostealerpersistenceprivilege_escalationpyinstallerransomwareratspywarestealerthemidatrojanupx

Malware Config

Extracted

Family

  • xenorat

C2

  • 172.245.27.131

Mutex

  • Xeno_rat_nd8912d

Attributes
  • delay

    5000

  • install_path

    nothingset

  • port

    6000

  • startup_name

    nothingset

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • Office04

C2

  • 192.168.137.1:4782

Mutex

  • c9e46391-a513-481f-850c-0575d9434d9b

Attributes
  • encryption_key

    08BB821083C178CF94367793848CD70209AA4A6C

  • install_name

    Client.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    cheats

  • subdirectory

    SubDir

Extracted

Family

  • svcstealer

C2

  • http://176.46.152.46/diamo/data.php

  • http://158.94.208.102/diamo/data.php

  • http://178.16.53.7/diamo/data.php

  • http://176.46.152.47/diamo/data.php

Attributes
  • bot_urls

    http://213.226.113.54/bin/bot.dll

  • build_id

    1/11/2025

  • srv_delay

    1

  • srv_retry

    1

Extracted

Family

  • azorult

C2

  • http://195.245.112.115/index.php

Extracted

Family

  • quasar

Version

  • 1.4.1

Botnet

  • botnet

C2

  • 165.227.31.192:22069

  • 193.161.193.99:64425

  • 193.161.193.99:60470

Mutex

  • 713051d4-4ad4-4ad0-b2ed-4ddd8fe2349d

Attributes
  • encryption_key

    684009117DF150EF232A2EE8AE172085964C1CF0

  • install_name

    System.exe

  • key_salt

    bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Office

  • subdirectory

    Winrar

Extracted

Family

  • xworm

Version

  • XWorm V5.6

C2

  • 147.185.221.27:31149

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Azorult family
    azorult
  • Detect XenoRat Payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Process spawned unexpected child process 15 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 4 IoCs
  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer
  • Svcstealer family
    svcstealer
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • XenorRat

    XenorRat is a remote access trojan written in C#.

    trojanratxenorat
  • Xenorat family
    xenorat
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables use of System Restore points 1 TTPs
    defense_evasion
  • Downloads MZ/PE file 20 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 42 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
    defense_evasion
  • Loads dropped DLL 32 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • ConfuserEx .NET packer 2 IoCs

    Detects ConfuserEx .NET packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 1 IoCs
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 40 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 16 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 9 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:3320
    • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
      "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
      2⤵
      • Downloads MZ/PE file
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Users\Admin\AppData\Local\Temp\Files\2.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\2.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:1700
      • C:\Users\Admin\AppData\Local\Temp\Files\random.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6104
        • C:\Users\Admin\AppData\Local\Temp\is-V1HGD.tmp\random.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-V1HGD.tmp\random.tmp" /SL5="$D02B6,1652292,822272,C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:5316
          • C:\Program Files\Optimizer\Optimizer.exe
            "C:\Program Files\Optimizer\Optimizer.exe"
            5⤵
            • Executes dropped EXE
            PID:3016
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Program Files\Optimizer\Optimizer.bat" "
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3144
            • C:\Program Files\Optimizer\Optimizer.exe
              Optimizer.exe /aa
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3820
      • C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3112
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\GMT\UpdateDIr\G7_Update_240401\install.bat" "
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5264
          • C:\Windows\SysWOW64\taskkill.exe
            Taskkill /f /im "BasmDocu.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:492
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:1732
          • C:\GMT\UpdateDIr\G7_Update_240401\IniEditor.exe
            IniEditor.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:900
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 1
            5⤵
            • Delays execution with timeout.exe
            PID:3284
      • C:\Users\Admin\AppData\Local\Temp\Files\hbvTmbP46IIEeHP1.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\hbvTmbP46IIEeHP1.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:3372
      • C:\Users\Admin\AppData\Local\Temp\Files\donut.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1872
      • C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1164
        • C:\Users\Admin\AppData\Local\Temp\is-1VFLL.tmp\safman_setup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-1VFLL.tmp\safman_setup.tmp" /SL5="$4039C,7726804,67584,C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          PID:2628
          • C:\SAF\SAFMan\safman.exe
            "C:\SAF\SAFMan\safman.exe"
            5⤵
              PID:2012
        • C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3096
        • C:\Users\Admin\AppData\Local\Temp\Files\Lab01-02.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\Lab01-02.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2212
        • C:\Users\Admin\AppData\Local\Temp\Files\extra_tool.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\extra_tool.exe"
          3⤵
          • Executes dropped EXE
          PID:5276
          • C:\Users\Admin\AppData\Local\Temp\Files\extra_tool.exe
            "C:\Users\Admin\AppData\Local\Temp\Files\extra_tool.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:492
        • C:\Users\Admin\AppData\Local\Temp\Files\System.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\System.exe"
          3⤵
          • Executes dropped EXE
          PID:1588
          • C:\Users\Admin\AppData\Roaming\Winrar\System.exe
            "C:\Users\Admin\AppData\Roaming\Winrar\System.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4264
        • C:\Users\Admin\AppData\Local\Temp\Files\clp.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\clp.exe"
          3⤵
          • Executes dropped EXE
          • Modifies registry class
          PID:5092
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /query /tn "Google Chrome DeskUpdate"
            4⤵
              PID:1516
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /sc minute /tn "Google Chrome DeskUpdate" /tr "C:\Users\Admin\AppData\Roaming\swibu.exe"
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4168
            • C:\Users\Admin\AppData\Roaming\swibu.exe
              "C:\Users\Admin\AppData\Roaming\swibu.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:3448
              • C:\Users\Admin\AppData\Roaming\swibu.exe
                "C:\Users\Admin\AppData\Roaming\swibu.exe"
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:6080
                • C:\Windows\explorer.exe
                  explorer.exe
                  6⤵
                    PID:2088
            • C:\Users\Admin\AppData\Local\Temp\Files\lol.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\lol.exe"
              3⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:3616
              • C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe
                "C:\Users\Admin\AppData\Local\Temp\35603d5b1d\Srfuhxm.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1580
            • C:\Users\Admin\AppData\Local\Temp\Files\Cloudy.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\Cloudy.exe"
              3⤵
              • Executes dropped EXE
              PID:1008
          • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
            "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
            2⤵
            • Downloads MZ/PE file
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5084
            • C:\Users\Admin\AppData\Local\Temp\Files\xeno.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\xeno.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1912
            • C:\Users\Admin\AppData\Local\Temp\Files\EZFN%20op%20cheats.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\EZFN%20op%20cheats.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:5964
            • C:\Users\Admin\AppData\Local\Temp\Files\cabalmain.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\cabalmain.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:3744
            • C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4116
            • C:\Users\Admin\AppData\Local\Temp\Files\LicenseMalwareBytes.exe
              "C:\Users\Admin\AppData\Local\Temp\Files\LicenseMalwareBytes.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:5960
              • C:\Users\Admin\AppData\Local\Temp\Files\LicenseMalwareBytes.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\LicenseMalwareBytes.exe"
                4⤵
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4240
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c gpupdate /force
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1204
                  • C:\Windows\system32\gpupdate.exe
                    gpupdate /force
                    6⤵
                      PID:4132
              • C:\Users\Admin\AppData\Local\Temp\Files\4.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\4.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:364
              • C:\Users\Admin\AppData\Local\Temp\Files\onetap.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\onetap.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3040
              • C:\Users\Admin\AppData\Local\Temp\Files\ZubovLekciya.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\ZubovLekciya.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4968
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\BlockcomrefDhcp\agAs.vbe"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5012
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\BlockcomrefDhcp\S2T1AGYKXgcDSNksLldDNBs6NjAKZe1cJh6wFjebTHbD.bat" "
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:5856
                    • C:\BlockcomrefDhcp\Portcrt.exe
                      "C:\BlockcomrefDhcp/Portcrt.exe"
                      6⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:5008
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5pvzmofiiT.bat"
                        7⤵
                          PID:8
                          • C:\Windows\system32\chcp.com
                            chcp 65001
                            8⤵
                              PID:5344
                            • C:\Windows\system32\w32tm.exe
                              w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                              8⤵
                                PID:5712
                              • C:\Users\Default\Templates\conhost.exe
                                "C:\Users\Default\Templates\conhost.exe"
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3944
                    • C:\Users\Admin\AppData\Local\Temp\Files\Annabelle.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\Annabelle.exe"
                      3⤵
                      • Modifies WinLogon for persistence
                      • Modifies Windows Defender DisableAntiSpyware settings
                      • Modifies Windows Defender Real-time Protection settings
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Event Triggered Execution: Image File Execution Options Injection
                      • Executes dropped EXE
                      • Impair Defenses: Safe Mode Boot
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • System policy modification
                      PID:1048
                      • C:\Windows\SYSTEM32\vssadmin.exe
                        vssadmin delete shadows /all /quiet
                        4⤵
                        • Interacts with shadow copies
                        PID:1796
                      • C:\Windows\SYSTEM32\vssadmin.exe
                        vssadmin delete shadows /all /quiet
                        4⤵
                        • Interacts with shadow copies
                        PID:4752
                      • C:\Windows\SYSTEM32\vssadmin.exe
                        vssadmin delete shadows /all /quiet
                        4⤵
                        • Interacts with shadow copies
                        PID:3616
                      • C:\Windows\SYSTEM32\NetSh.exe
                        NetSh Advfirewall set allprofiles state off
                        4⤵
                        • Modifies Windows Firewall
                        • Event Triggered Execution: Netsh Helper DLL
                        PID:3116
                      • C:\Windows\System32\shutdown.exe
                        "C:\Windows\System32\shutdown.exe" -r -t 00 -f
                        4⤵
                          PID:200
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
                    1⤵
                      PID:4864
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:3332
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 5 /tr "'C:\BlockcomrefDhcp\SppExtComObj.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:2796
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\BlockcomrefDhcp\SppExtComObj.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:2980
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\BlockcomrefDhcp\SppExtComObj.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4512
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\4363463463464363463463463.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1792
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "4363463463464363463463463" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\4363463463464363463463463.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:2820
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "43634634634643634634634634" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\4363463463464363463463463.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3684
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4044
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4940
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3844
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 6 /tr "'C:\GMT\UpdateDIr\G7_Update_240401\services.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:1004
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\GMT\UpdateDIr\G7_Update_240401\services.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3496
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\GMT\UpdateDIr\G7_Update_240401\services.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3472
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Templates\conhost.exe'" /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:4180
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Default\Templates\conhost.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3448
                      • C:\Windows\system32\schtasks.exe
                        schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 7 /tr "'C:\Users\Default\Templates\conhost.exe'" /rl HIGHEST /f
                        1⤵
                        • Process spawned unexpected child process
                        • Scheduled Task/Job: Scheduled Task
                        PID:3272
                      • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\4363463463464363463463463.exe
                        "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\4363463463464363463463463.exe"
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:904
                      • C:\GMT\UpdateDIr\G7_Update_240401\services.exe
                        "C:\GMT\UpdateDIr\G7_Update_240401\services.exe"
                        1⤵
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3400
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat"
                          2⤵
                            PID:1184
                            • C:\Windows\system32\chcp.com
                              chcp 65001
                              3⤵
                                PID:5980
                              • C:\Windows\system32\PING.EXE
                                ping -n 10 localhost
                                3⤵
                                • System Network Configuration Discovery: Internet Connection Discovery
                                • Runs ping.exe
                                PID:1864
                              • C:\GMT\UpdateDIr\G7_Update_240401\services.exe
                                "C:\GMT\UpdateDIr\G7_Update_240401\services.exe"
                                3⤵
                                • Executes dropped EXE
                                PID:2348
                          • C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe
                            "C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\csrss.exe"
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4548
                          • C:\Users\Default\Templates\conhost.exe
                            "C:\Users\Default\Templates\conhost.exe"
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4332
                          • C:\BlockcomrefDhcp\SppExtComObj.exe
                            "C:\BlockcomrefDhcp\SppExtComObj.exe"
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3828
                          • C:\BlockcomrefDhcp\SppExtComObj.exe
                            "C:\BlockcomrefDhcp\SppExtComObj.exe"
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5888
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                              PID:3484
                            • C:\Windows\system32\LogonUI.exe
                              "LogonUI.exe" /flags:0x4 /state0:0xa39f7055 /state1:0x41c64e6d
                              1⤵
                                PID:1080

                              Network

                                    MITRE ATT&CK Enterprise v16

                                    Reconnaissance

                                    Resource Development

                                    Initial Access

                                    Execution

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Windows Management Instrumentation

                                    1
                                    T1047

                                    Persistence

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Winlogon Helper DLL

                                    1
                                    T1547.004

                                    Create or Modify System Process

                                    3
                                    T1543

                                    Windows Service

                                    3
                                    T1543.003

                                    Event Triggered Execution

                                    2
                                    T1546

                                    Image File Execution Options Injection

                                    1
                                    T1546.012

                                    Netsh Helper DLL

                                    1
                                    T1546.007

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Privilege Escalation

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Boot or Logon Autostart Execution

                                    2
                                    T1547

                                    Registry Run Keys / Startup Folder

                                    1
                                    T1547.001

                                    Winlogon Helper DLL

                                    1
                                    T1547.004

                                    Create or Modify System Process

                                    3
                                    T1543

                                    Windows Service

                                    3
                                    T1543.003

                                    Event Triggered Execution

                                    2
                                    T1546

                                    Image File Execution Options Injection

                                    1
                                    T1546.012

                                    Netsh Helper DLL

                                    1
                                    T1546.007

                                    Scheduled Task/Job

                                    1
                                    T1053

                                    Scheduled Task

                                    1
                                    T1053.005

                                    Defense Evasion

                                    Abuse Elevation Control Mechanism

                                    1
                                    T1548

                                    Bypass User Account Control

                                    1
                                    T1548.002

                                    Direct Volume Access

                                    1
                                    T1006

                                    Impair Defenses

                                    5
                                    T1562

                                    Disable or Modify System Firewall

                                    1
                                    T1562.004

                                    Disable or Modify Tools

                                    3
                                    T1562.001

                                    Safe Mode Boot

                                    1
                                    T1562.009

                                    Indicator Removal

                                    2
                                    T1070

                                    File Deletion

                                    2
                                    T1070.004

                                    Modify Registry

                                    7
                                    T1112

                                    Virtualization/Sandbox Evasion

                                    1
                                    T1497

                                    Credential Access

                                    Credentials from Password Stores

                                    1
                                    T1555

                                    Credentials from Web Browsers

                                    1
                                    T1555.003

                                    Unsecured Credentials

                                    1
                                    T1552

                                    Credentials In Files

                                    1
                                    T1552.001

                                    Discovery

                                    Query Registry

                                    4
                                    T1012

                                    Remote System Discovery

                                    1
                                    T1018

                                    System Information Discovery

                                    3
                                    T1082

                                    System Location Discovery

                                    1
                                    T1614

                                    System Language Discovery

                                    1
                                    T1614.001

                                    System Network Configuration Discovery

                                    1
                                    T1016

                                    Internet Connection Discovery

                                    1
                                    T1016.001

                                    Virtualization/Sandbox Evasion

                                    1
                                    T1497

                                    Lateral Movement

                                    Collection

                                    Data from Local System

                                    1
                                    T1005

                                    Command and Control

                                    Web Service

                                    1
                                    T1102

                                    Exfiltration

                                    Impact

                                    Inhibit System Recovery

                                    3
                                    T1490

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    IniEditor.exe
                                    • Path C:\GMT\UpdateDIr\G7_Update_240401\IniEditor.exe
                                    • Size 365KB
                                    • SHA256 23a860b3550e62c7223921e99e1b1c2bd7297d479a04da15e7925bf144e9276d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    install.bat
                                    • Path C:\GMT\UpdateDIr\G7_Update_240401\install.bat
                                    • Size 833B
                                    • SHA256 71a73988f39ab8deb1ae0851ae0c139bc07a140e15ecc557927877c4a8c32b8a
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    4363463463464363463463463.exe
                                    • Path C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\4363463463464363463463463.exe
                                    • Size 3.5MB
                                    • SHA256 586888c122389866bbdc33abe08aebb20b3a12da7ea20306b977330af3e94c5b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Newtonsoft.Json.dll
                                    • Path C:\Program Files\Optimizer\Newtonsoft.Json.dll
                                    • Size 695KB
                                    • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Optimizer.bat
                                    • Path C:\Program Files\Optimizer\Optimizer.bat
                                    • Size 81B
                                    • SHA256 af2911c7e5e7f0e42e2a8b2d016b2119cb66b4d6a76fabdc1fcdc8a6b3986236
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    Optimizer.exe
                                    • Path C:\Program Files\Optimizer\Optimizer.exe
                                    • Size 2.5MB
                                    • SHA256 b528d7d5186327ea8020a723fbf07b2430b814d2a3bcdce40fffdf8e6b485980
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Optimizer.exe.config
                                    • Path C:\Program Files\Optimizer\Optimizer.exe.config
                                    • Size 184B
                                    • SHA256 9f127f2e8efd9b1a0f61267c53f2bafecd2b90110793e70cee5c4fa4c463a763
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    safman.exe
                                    • Path C:\SAF\SAFMan\safman.exe
                                    • Size 16.3MB
                                    • SHA256 5f9ee19cfa8d414cdc23c2f76c94483601eb764280f10e2e83d020a79b70b8fe
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    2.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\2.exe
                                    • Size 551KB
                                    • SHA256 00ccb3b5a2a11689366587a20c3a1cee0e65414f04ed13b5e70c7e1376c748d0
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    4.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\4.exe
                                    • Size 478KB
                                    • SHA256 002de10c98dd19eedff23495f7fd8d35f4c2fe69f4cc81ff70396908252897f7
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Annabelle.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\Annabelle.exe
                                    • Size 15.9MB
                                    • SHA256 716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Cloudy.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\Cloudy.exe
                                    • Size 63KB
                                    • SHA256 fc9fb9d6e3dfa400a51df18b7dfe73f5102b636b1db879083cbf1f9b5ab410c7
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    EZFN%20op%20cheats.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\EZFN%20op%20cheats.exe
                                    • Size 3.1MB
                                    • SHA256 fc0afaabeb1bec166e86302143e2ae0387142cc17df7a8980c8b7a9de43aad67
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    G7_Update.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe
                                    • Size 218KB
                                    • SHA256 6976b474677ccdc95117332b7da88fa578b9e40b4e4da75874dcc665893ae324
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    Lab01-02.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\Lab01-02.exe
                                    • Size 3KB
                                    • SHA256 c876a332d7dd8da331cb8eee7ab7bf32752834d4b2b54eaa362674a2a48f64a6
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    LicenseMalwareBytes.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\LicenseMalwareBytes.exe
                                    • Size 7.9MB
                                    • SHA256 2de955cb5926261634ce51565e5cc9fd52ebccd9c3b7f8b5dd1db369cb1f9731
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    System.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\System.exe
                                    • Size 3.1MB
                                    • SHA256 95f172a69bb9e7310bf636d76e310ec9603601e488473f2bdfe3c0e7dd2b9667
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    ZubovLekciya.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\ZubovLekciya.exe
                                    • Size 3.9MB
                                    • SHA256 571484620a85f9a97436f064ba0ee8cecd36f1762237dc2314712f1cf48d49ab
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    cabalmain.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\cabalmain.exe
                                    • Size 46.9MB
                                    • SHA256 da1da318c266b85b9ba028b4883dacc02114250f7dd953ede8bfe7f6e6c4bc23
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    clp.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\clp.exe
                                    • Size 1.0MB
                                    • SHA256 d1bb18e8a3e4e3cbe08910ed8d92b970c936094059e3179b8f48c3f8df18853e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    donut.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\donut.exe
                                    • Size 157KB
                                    • SHA256 ee0fbd09ef81052faa267adb297a644ab51e80245e66346f97e31834bae9814b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    extra_tool.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\extra_tool.exe
                                    • Size 7.4MB
                                    • SHA256 930cfc6270400f18f09349135451f45e8d68b529d772555792db00a1e94dc436
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    hbvTmbP46IIEeHP1.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\hbvTmbP46IIEeHP1.exe
                                    • Size 3.9MB
                                    • SHA256 27629e7de659a0c67d073ba155f97229b9f31d0b9a2797f24f6196615de49ef0
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    justpoc.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe
                                    • Size 5KB
                                    • SHA256 f58b95ca013aee22037b7d90c217d412b9385bf7f808ecc1d5ffda9aed65924b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    keygen.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe
                                    • Size 31KB
                                    • SHA256 f00cb610ffed124a9eb3bdfc2cf0d6f061980af8bdd30b79df178a7f3a072fd3
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    lol.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\lol.exe
                                    • Size 1.4MB
                                    • SHA256 27c2134b7774f29e657f881ca9177fe6e93a9b6e03fda4579168b9099c0005a8
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    new.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\new.exe
                                    • Size 11KB
                                    • SHA256 ccfb585f9f9ff3cf149479235c5af1d5d6ac45b787bc99aaee47d20e49ae9751
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    onetap.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\onetap.exe
                                    • Size 112KB
                                    • SHA256 21314041b5b17d156a68d246935ab476d3532a1c9c72a39b02d98a6b7ef59473
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    random.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\random.exe
                                    • Size 2.5MB
                                    • SHA256 c0b441bab865803e1e85f305f7eaa2e16a7efdda9ebeeb8ad8e1db5965fae59f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    safman_setup.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\safman_setup.exe
                                    • Size 7.7MB
                                    • SHA256 d6370c7ba402d29184e975060d82bdad6fa4720fce83a3cf1aed9b231f3b2427
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    xeno.exe
                                    • Path C:\Users\Admin\AppData\Local\Temp\Files\xeno.exe
                                    • Size 45KB
                                    • SHA256 b564ff977533173152028f7e29034fe63e39f1e7b1e210b9bdb106e6fe8eb780
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    VCRUNTIME140.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\VCRUNTIME140.dll
                                    • Size 87KB
                                    • SHA256 bf5ff4603557c9959acec995653d052d9054ad4826df967974efd2f377c723d1
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    _bz2.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_bz2.pyd
                                    • Size 87KB
                                    • SHA256 e7af6119b56ddd47fd0a909710f7163d7ef4822405fc138d24e6ce9de7a5022f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    _cffi_backend.cp37-win_amd64.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_cffi_backend.cp37-win_amd64.pyd
                                    • Size 176KB
                                    • SHA256 73dfaaa3149a8bfbd2a79f255f39ab7cb7e9d5fb1f0d7ba1b1e7cebf0360580d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    _ctypes.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_ctypes.pyd
                                    • Size 131KB
                                    • SHA256 41c593c960f3f89b1e1629c6b7bd6171fe306168f816bef02027332a263de117
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    _hashlib.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_hashlib.pyd
                                    • Size 38KB
                                    • SHA256 e2701f4e4a7556adab7415e448070289ba4fe047227f48c3a049d7c3154aff0b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    _lzma.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_lzma.pyd
                                    • Size 251KB
                                    • SHA256 5a45f7cd517ad396a042bc2767ae73221dc68f934e828a9433249924a371ee5e
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    _socket.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_socket.pyd
                                    • Size 74KB
                                    • SHA256 e002a1bd6fba44681d557b64d439585dba9820226e1c3da5a62628bbaa930ae3
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    _ssl.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\_ssl.pyd
                                    • Size 121KB
                                    • SHA256 7040d3712f31b7d11882ce8c907452fa725678b646b900f6868f43ab3e4ddab6
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    base_library.zip
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\base_library.zip
                                    • Size 763KB
                                    • SHA256 73ee03e78ad4c1c5014651cf0df3214c789fc0c93779eb6f74922f54e613c6de
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    _constant_time.cp37-win_amd64.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\cryptography\hazmat\bindings\_constant_time.cp37-win_amd64.pyd
                                    • Size 12KB
                                    • SHA256 3b7a10f7560e6cd1416f9536484d7759cd6f02676d718fd200d16929e3d9ce57
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    _openssl.cp37-win_amd64.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\cryptography\hazmat\bindings\_openssl.cp37-win_amd64.pyd
                                    • Size 2.7MB
                                    • SHA256 08cfd7943440990f7c5285bf8693f33d4fdd48df69eb9524e2ff7648c4389e6c
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    libcrypto-1_1.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libcrypto-1_1.dll
                                    • Size 3.2MB
                                    • SHA256 012866b68f458ec204b9bce067af8f4a488860774e7e17973c49e583b52b828d
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    libssl-1_1.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\libssl-1_1.dll
                                    • Size 670KB
                                    • SHA256 1ce7ba99e817c1c2d71bc88a1bdd6fcad82aa5c3e519b91ebd56c96f22e3543b
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    python37.dll
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\python37.dll
                                    • Size 3.6MB
                                    • SHA256 12f26beb439ddf8d56e7544b06a0675d5da6670c02f8f9cede7aad1de71eb116
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    select.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\select.pyd
                                    • Size 26KB
                                    • SHA256 9514b4c40c35396b1952a8acf805e993a3875b37370f44ef36ed33c7151412ef
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    unicodedata.pyd
                                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI59602\unicodedata.pyd
                                    • Size 1.0MB
                                    • SHA256 465ab1b24c39a5a5da9415c96740dfdb4d071b25a7a87e275841e1d66a57e88f
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    evb50F6.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\evb50F6.tmp
                                    • Size 1KB
                                    • SHA256 a7b6610574e729c9544a0e5fd5feb47d7dff391bdce48cbda1154b3240b93c63
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    evb5106.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\evb5106.tmp
                                    • Size 1KB
                                    • SHA256 1828400aacc1a31dbcea3750ce0fe32cc4e6f703ecbde255ecc57577e2583106
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    evb5107.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\evb5107.tmp
                                    • Size 1KB
                                    • SHA256 ba44d33aaf54cdf40782e4ae948be9f620c47212b987cca328235c7de2ab13ba
                                    • MD5 SHA1 SHA512
                                    Submit Download

                                    random.tmp
                                    • Path C:\Users\Admin\AppData\Local\Temp\is-V1HGD.tmp\random.tmp
                                    • Size 3.2MB
                                    • SHA256 506c862ce57b36ee0c19c81a78af341efad621f9556323e44566ad1b123a65a4
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    swibu.exe
                                    • Path C:\Users\Admin\AppData\Roaming\swibu.exe
                                    • Size 945KB
                                    • SHA256 2c0ddf000d9048b1bca93eaacaddd3b8a1a07e3248ad26c0a099cae3cbece1eb
                                    • MD5 SHA1 SHA512 SSDEEP
                                    Submit Download

                                    memory/364-340-0x00007FF64FBA0000-0x00007FF64FC1D000-memory.dmp
                                    Download

                                    memory/364-337-0x00007FF64FBA0000-0x00007FF64FC1D000-memory.dmp
                                    Download

                                    memory/492-768-0x00007FF929FC0000-0x00007FF929FDA000-memory.dmp
                                    Download

                                    memory/492-765-0x00007FF91DBA0000-0x00007FF91DBC5000-memory.dmp
                                    Download

                                    memory/492-803-0x00007FF91B010000-0x00007FF91B6D8000-memory.dmp
                                    Download

                                    memory/492-799-0x00007FF91C270000-0x00007FF91C294000-memory.dmp
                                    Download

                                    memory/492-798-0x00007FF9349E0000-0x00007FF9349EF000-memory.dmp
                                    Download

                                    memory/492-797-0x00007FF929FC0000-0x00007FF929FDA000-memory.dmp
                                    Download

                                    memory/492-796-0x00007FF91DB70000-0x00007FF91DB9D000-memory.dmp
                                    Download

                                    memory/492-801-0x00007FF91C250000-0x00007FF91C269000-memory.dmp
                                    Download

                                    memory/492-781-0x00007FF91B010000-0x00007FF91B6D8000-memory.dmp
                                    Download

                                    memory/492-795-0x00007FF934D50000-0x00007FF934D5F000-memory.dmp
                                    Download

                                    memory/492-754-0x00007FF91B010000-0x00007FF91B6D8000-memory.dmp
                                    Download

                                    memory/492-767-0x00007FF934D50000-0x00007FF934D5F000-memory.dmp
                                    Download

                                    memory/492-794-0x00007FF91DBA0000-0x00007FF91DBC5000-memory.dmp
                                    Download

                                    memory/492-800-0x00007FF91AE80000-0x00007FF91B009000-memory.dmp
                                    Download

                                    memory/492-778-0x00007FF91C250000-0x00007FF91C269000-memory.dmp
                                    Download

                                    memory/492-793-0x00007FF924530000-0x00007FF92453D000-memory.dmp
                                    Download

                                    memory/492-779-0x00007FF924530000-0x00007FF92453D000-memory.dmp
                                    Download

                                    memory/492-774-0x00007FF91AE80000-0x00007FF91B009000-memory.dmp
                                    Download

                                    memory/492-773-0x00007FF91C270000-0x00007FF91C294000-memory.dmp
                                    Download

                                    memory/492-769-0x00007FF91DB70000-0x00007FF91DB9D000-memory.dmp
                                    Download

                                    memory/492-772-0x00007FF9349E0000-0x00007FF9349EF000-memory.dmp
                                    Download

                                    memory/900-361-0x0000000000400000-0x0000000000461000-memory.dmp
                                    Download

                                    memory/900-518-0x0000000000400000-0x0000000000461000-memory.dmp
                                    Download

                                    memory/1008-882-0x0000000000500000-0x0000000000516000-memory.dmp
                                    Download

                                    memory/1048-493-0x000001DB64740000-0x000001DB65734000-memory.dmp
                                    Download

                                    memory/1048-501-0x000001DB019C0000-0x000001DB02F4E000-memory.dmp
                                    Download

                                    memory/1164-462-0x0000000000400000-0x0000000000417000-memory.dmp
                                    Download

                                    memory/1164-498-0x0000000000400000-0x0000000000417000-memory.dmp
                                    Download

                                    memory/1588-771-0x00000000004A0000-0x00000000007C4000-memory.dmp
                                    Download

                                    memory/1700-40-0x00007FF9447A0000-0x00007FF9449A9000-memory.dmp
                                    Download

                                    memory/1700-38-0x0000000002D70000-0x0000000003170000-memory.dmp
                                    Download

                                    memory/1700-42-0x0000000076140000-0x0000000076392000-memory.dmp
                                    Download

                                    memory/1700-39-0x0000000002D70000-0x0000000003170000-memory.dmp
                                    Download

                                    memory/1912-16-0x0000000000080000-0x0000000000092000-memory.dmp
                                    Download

                                    memory/2212-482-0x0000000000400000-0x0000000000407000-memory.dmp
                                    Download

                                    memory/2212-481-0x0000000000400000-0x0000000000407000-memory.dmp
                                    Download

                                    memory/2252-2-0x00000000055E0000-0x00000000055F0000-memory.dmp
                                    Download

                                    memory/2252-1-0x00000000053D0000-0x000000000546C000-memory.dmp
                                    Download

                                    memory/2252-0-0x0000000000850000-0x0000000000858000-memory.dmp
                                    Download

                                    memory/2252-3-0x00000000055E0000-0x00000000055F0000-memory.dmp
                                    Download

                                    memory/2628-499-0x0000000000400000-0x00000000004C1000-memory.dmp
                                    Download

                                    memory/3016-127-0x00000208D1430000-0x00000208D144E000-memory.dmp
                                    Download

                                    memory/3016-88-0x00000208B4BB0000-0x00000208B4E2E000-memory.dmp
                                    Download

                                    memory/3016-93-0x00000208B52A0000-0x00000208B52C2000-memory.dmp
                                    Download

                                    memory/3016-94-0x00000208B52F0000-0x00000208B53A2000-memory.dmp
                                    Download

                                    memory/3016-118-0x00000208D12C0000-0x00000208D1336000-memory.dmp
                                    Download

                                    memory/3040-347-0x0000000000400000-0x0000000000421000-memory.dmp
                                    Download

                                    memory/3096-500-0x0000000000400000-0x0000000000418000-memory.dmp
                                    Download

                                    memory/3112-311-0x0000000000400000-0x0000000000416000-memory.dmp
                                    Download

                                    memory/3112-304-0x0000000000400000-0x0000000000416000-memory.dmp
                                    Download

                                    memory/3320-541-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-546-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-338-0x0000000011B20000-0x0000000011BA3000-memory.dmp
                                    Download

                                    memory/3320-339-0x0000000011B20000-0x0000000011BA3000-memory.dmp
                                    Download

                                    memory/3320-404-0x0000000000A50000-0x0000000000A51000-memory.dmp
                                    Download

                                    memory/3320-411-0x0000000007370000-0x00000000073A3000-memory.dmp
                                    Download

                                    memory/3320-409-0x0000000011B20000-0x0000000011BA3000-memory.dmp
                                    Download

                                    memory/3320-408-0x0000000011B20000-0x0000000011BA3000-memory.dmp
                                    Download

                                    memory/3320-407-0x0000000002500000-0x0000000002501000-memory.dmp
                                    Download

                                    memory/3320-406-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
                                    Download

                                    memory/3320-405-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
                                    Download

                                    memory/3320-413-0x0000000011B20000-0x0000000011BA3000-memory.dmp
                                    Download

                                    memory/3320-418-0x000000000EEB0000-0x000000000EEB1000-memory.dmp
                                    Download

                                    memory/3320-419-0x000000000EEC0000-0x000000000EEC1000-memory.dmp
                                    Download

                                    memory/3320-563-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-559-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-560-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-561-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-558-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-557-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-556-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-549-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-551-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-550-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-552-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-548-0x000000000EDF0000-0x000000000EDF1000-memory.dmp
                                    Download

                                    memory/3320-543-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-502-0x0000000002D00000-0x0000000002D01000-memory.dmp
                                    Download

                                    memory/3320-512-0x00000000025B0000-0x00000000025B1000-memory.dmp
                                    Download

                                    memory/3320-544-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-524-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
                                    Download

                                    memory/3320-534-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-535-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-539-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-537-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-540-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-538-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-545-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3320-547-0x0000000002B30000-0x0000000002B40000-memory.dmp
                                    Download

                                    memory/3372-326-0x0000000140000000-0x0000000140A09000-memory.dmp
                                    Download

                                    memory/3372-325-0x0000000140000000-0x0000000140A09000-memory.dmp
                                    Download

                                    memory/3372-324-0x0000000140000000-0x0000000140A09000-memory.dmp
                                    Download

                                    memory/3372-320-0x0000000140000000-0x0000000140A09000-memory.dmp
                                    Download

                                    memory/3744-153-0x0000000010000000-0x000000001001D000-memory.dmp
                                    Download

                                    memory/3744-150-0x0000000004A40000-0x0000000004C3F000-memory.dmp
                                    Download

                                    memory/3744-154-0x0000000004A40000-0x0000000004C3F000-memory.dmp
                                    Download

                                    memory/3744-134-0x0000000004420000-0x0000000004A28000-memory.dmp
                                    Download

                                    memory/3744-152-0x0000000004420000-0x0000000004A28000-memory.dmp
                                    Download

                                    memory/3744-144-0x0000000004420000-0x0000000004A28000-memory.dmp
                                    Download

                                    memory/3744-142-0x0000000010000000-0x000000001001D000-memory.dmp
                                    Download

                                    memory/3744-148-0x0000000004A40000-0x0000000004C3F000-memory.dmp
                                    Download

                                    memory/3744-294-0x0000000004420000-0x0000000004A28000-memory.dmp
                                    Download

                                    memory/3744-293-0x0000000000400000-0x000000000114D000-memory.dmp
                                    Download

                                    memory/3820-92-0x000001A85CFE0000-0x000001A85D092000-memory.dmp
                                    Download

                                    memory/4264-894-0x000000001D580000-0x000000001D632000-memory.dmp
                                    Download

                                    memory/5008-385-0x000000001CEA0000-0x000000001CEB0000-memory.dmp
                                    Download

                                    memory/5008-384-0x000000001CE30000-0x000000001CE40000-memory.dmp
                                    Download

                                    memory/5008-371-0x000000001C9D0000-0x000000001C9EC000-memory.dmp
                                    Download

                                    memory/5008-370-0x000000001CD10000-0x000000001CD2C000-memory.dmp
                                    Download

                                    memory/5008-369-0x000000001C940000-0x000000001C94E000-memory.dmp
                                    Download

                                    memory/5008-368-0x000000001C9A0000-0x000000001C9C6000-memory.dmp
                                    Download

                                    memory/5008-367-0x0000000000290000-0x000000000061A000-memory.dmp
                                    Download

                                    memory/5008-389-0x000000001CED0000-0x000000001CEDE000-memory.dmp
                                    Download

                                    memory/5008-391-0x000000001D1E0000-0x000000001D22E000-memory.dmp
                                    Download

                                    memory/5008-390-0x000000001D170000-0x000000001D188000-memory.dmp
                                    Download

                                    memory/5008-373-0x000000001C950000-0x000000001C960000-memory.dmp
                                    Download

                                    memory/5008-388-0x000000001CEC0000-0x000000001CED0000-memory.dmp
                                    Download

                                    memory/5008-387-0x000000001CEB0000-0x000000001CEBE000-memory.dmp
                                    Download

                                    memory/5008-386-0x000000001CF10000-0x000000001CF6A000-memory.dmp
                                    Download

                                    memory/5008-374-0x000000001CDA0000-0x000000001CDB8000-memory.dmp
                                    Download

                                    memory/5008-372-0x000000001CDD0000-0x000000001CE20000-memory.dmp
                                    Download

                                    memory/5008-383-0x000000001CE20000-0x000000001CE2E000-memory.dmp
                                    Download

                                    memory/5008-382-0x000000001D3D0000-0x000000001D8F8000-memory.dmp
                                    Download

                                    memory/5008-381-0x000000001CE80000-0x000000001CE92000-memory.dmp
                                    Download

                                    memory/5008-380-0x000000001CE60000-0x000000001CE76000-memory.dmp
                                    Download

                                    memory/5008-379-0x000000001CDC0000-0x000000001CDD0000-memory.dmp
                                    Download

                                    memory/5008-378-0x000000001CE40000-0x000000001CE52000-memory.dmp
                                    Download

                                    memory/5008-377-0x000000001CD90000-0x000000001CD9E000-memory.dmp
                                    Download

                                    memory/5008-375-0x000000001C9F0000-0x000000001CA00000-memory.dmp
                                    Download

                                    memory/5008-376-0x000000001CD80000-0x000000001CD90000-memory.dmp
                                    Download

                                    memory/5084-29-0x0000000005140000-0x0000000005150000-memory.dmp
                                    Download

                                    memory/5084-4-0x0000000005140000-0x0000000005150000-memory.dmp
                                    Download

                                    memory/5316-125-0x0000000000B10000-0x0000000000E46000-memory.dmp
                                    Download

                                    memory/5964-28-0x0000000000F60000-0x0000000001284000-memory.dmp
                                    Download

                                    memory/6104-53-0x00000000004B0000-0x0000000000587000-memory.dmp
                                    Download

                                    memory/6104-126-0x00000000004B0000-0x0000000000587000-memory.dmp
                                    Download