amadey | 60c814c50e67dc7f3955480940eefcca439218e841ab28dce2348e5791709ca0

Analysis

max time kernel
35s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16.exe
Size 195KB
Sample260606-vba87aav71
SHA256 60c814c50e67dc7f3955480940eefcca439218e841ab28dce2348e5791709ca0
MD5 89db7f30b990df6be281ef43c6baeb31
SHA1 20144fd3597f80235d1ede9f6e5a84e7cc290c26
SHA512 f2e0c593df874678c91cd89e6e079f5f19553b3cef3fcc2db2bdc543f70b0d8983f921e48961cf65a549c4683f7b029ddd5488c2131a4264c4f08f521f8a0d29
SSDEEP 3072:3gWb82gcMbPdG2kHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:3gv8wqyrWpAKhhvORHJ
TLSH
T1D7147C4763EA21E9E7739138CAA54A13F770B42213149BEF07E0865A5F233D1AD39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

06x05x2026 amadey discovery execution amadey stealc xtinyloader installer loader persistence pyinstaller spyware stealer trojan

Malware Config

Extracted

Family

xtinyloader

62.60.226.159

Wallets

DMhezYpB8cwkowfd8yDLXJc9d4UG58kBoN
LY6YLaCNrmpna78hAUierxH6sWXUVcYxAJ
TZAbN6XgY9w17gTEPJ9AQLd8SvLR7SQi9H
0x0b934e48d35e43ede112226e483576cec4abf19d
1DQdHKjQMJ2RuHVyuJ8AbdnmQCqphAf5PK

Extracted

Family

stealc

Botnet

06x05x2026

http://196.251.107.130

Attributes

url_path
/16b022998f754137b60a.php

rc4.traffic_key

rc4.C2

Extracted

Family

stealc

Botnet

amadey

http://196.251.107.130/16b022998f754137b60a.php

Attributes

url_path
/16b022998f754137b60a.php

rc4.traffic_key

rc4.plain

Signatures

Family: Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc
Family: XTinyLoader
XTinyLoader is a modular loader and stealer.
loader stealer xtinyloader

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b607-214.dat	family_stealc_v2

Downloads MZ/PE file 7 IoCs

flow	pid	Process
4	3568	ivvkz.exe
4	3568	ivvkz.exe
4	3568	ivvkz.exe
4	3568	ivvkz.exe
8	4972	jusched.exe
8	4972	jusched.exe
6	3568	ivvkz.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	SvcHostAnalyzer.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EmbeddedDriverService\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\EmbeddedDriverService.sys"	WinSysKdrv.exe

Executes dropped EXE 26 IoCs

pid	Process
4636	SvcHostAnalyzer.exe
5116	WinUpdateHelper.exe
3932	EmbeddedDriverService.sys
3344	winhost.exe
3908	wcl12aii.exe
3568	ivvkz.exe
1848	ivvkz.exe
2692	QSKDGQRD.exe
4812	WinSysKdrv.exe
3804	ONCSZUFL.exe
2876	svchost.exe
2888	LVIHHCNL.exe
2164	dwrvc.exe
4884	winsysdrv.exe
1372	dwrvc.exe
4648	winsysdrv.exe
4468	dwrvc.exe
3652	EGCDOOGS.exe
1760	EGCDOOGS.tmp
3744	SWXDWYEJ.exe
644	WindowsStore.Update.exe
1044	PRATOXER.exe
2576	OQQIIQMS.exe
4008	PEUHVZCP.exe
4972	jusched.exe
3720	jusched.exe

Loads dropped DLL 3 IoCs

pid	Process
1760	EGCDOOGS.tmp
1760	EGCDOOGS.tmp
3180	Explorer.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\winsysdrv.exe"	LVIHHCNL.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\ProgramData\\winsysdrv.exe"	winsysdrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\winsysdrv.exe"	winsysdrv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsSvcHost = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\WindowsStore.Update.exe"	SWXDWYEJ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\rdvge = "C:\\ProgramData\\ivvkz.exe"	wcl12aii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Host = "C:\\Users\\Admin\\Pictures\\svchost.exe"	ONCSZUFL.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\jusched.job	PEUHVZCP.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2212	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001900000002b61b-367.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsysdrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EGCDOOGS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LVIHHCNL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsysdrv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EGCDOOGS.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x001a00000002b5fa-176.dat	innosetup
behavioral2/memory/3652-178-0x0000000000920000-0x0000000000A0C000-memory.dmp	innosetup
behavioral2/memory/3652-255-0x0000000000920000-0x0000000000A0C000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PRATOXER.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PRATOXER.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	wcl12aii.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1232	schtasks.exe
3544	schtasks.exe
2940	schtasks.exe
1496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5116	WinUpdateHelper.exe
5116	WinUpdateHelper.exe
2164	dwrvc.exe
2164	dwrvc.exe
1372	dwrvc.exe
1372	dwrvc.exe
4468	dwrvc.exe
4468	dwrvc.exe
3744	SWXDWYEJ.exe
3744	SWXDWYEJ.exe
3180	Explorer.EXE
3180	Explorer.EXE
1044	PRATOXER.exe
1044	PRATOXER.exe
3744	SWXDWYEJ.exe
3744	SWXDWYEJ.exe
3744	SWXDWYEJ.exe
3744	SWXDWYEJ.exe
3744	SWXDWYEJ.exe
3744	SWXDWYEJ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3180	Explorer.EXE

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
4636	SvcHostAnalyzer.exe
4636	SvcHostAnalyzer.exe
4812	WinSysKdrv.exe
4812	WinSysKdrv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4636	SvcHostAnalyzer.exe
Token: SeLoadDriverPrivilege	4636	SvcHostAnalyzer.exe
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeLoadDriverPrivilege	4812	WinSysKdrv.exe
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeLoadDriverPrivilege	4812	WinSysKdrv.exe
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeDebugPrivilege	3744	SWXDWYEJ.exe
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE
Token: SeCreatePagefilePrivilege	3180	Explorer.EXE
Token: SeShutdownPrivilege	3180	Explorer.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE
3180	Explorer.EXE

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 2552	5116	WinUpdateHelper.exe	52
PID 5116 wrote to memory of 704	5116	WinUpdateHelper.exe	53
PID 5116 wrote to memory of 3180	5116	WinUpdateHelper.exe	54
PID 5116 wrote to memory of 3688	5116	WinUpdateHelper.exe	59
PID 5116 wrote to memory of 3764	5116	WinUpdateHelper.exe	60
PID 3180 wrote to memory of 1736	3180	Explorer.EXE
PID 3180 wrote to memory of 2120	3180	Explorer.EXE
PID 5116 wrote to memory of 3908	5116	WinUpdateHelper.exe	87
PID 3908 wrote to memory of 3568	3908	wcl12aii.exe	88
PID 3180 wrote to memory of 1620	3180	Explorer.EXE
PID 3568 wrote to memory of 2692	3568	ivvkz.exe	91
PID 3568 wrote to memory of 3804	3568	ivvkz.exe	94
PID 3180 wrote to memory of 4204	3180	Explorer.EXE
PID 3568 wrote to memory of 2888	3568	ivvkz.exe	97
PID 2888 wrote to memory of 1232	2888	LVIHHCNL.exe	98
PID 2888 wrote to memory of 2164	2888	LVIHHCNL.exe	100
PID 2164 wrote to memory of 3180	2164	dwrvc.exe	54
PID 3180 wrote to memory of 2816	3180	Explorer.EXE
PID 4884 wrote to memory of 3544	4884	winsysdrv.exe	103
PID 4884 wrote to memory of 1372	4884	winsysdrv.exe	105
PID 1372 wrote to memory of 3180	1372	dwrvc.exe	54
PID 3180 wrote to memory of 840	3180	Explorer.EXE
PID 4648 wrote to memory of 2940	4648	winsysdrv.exe	108
PID 4648 wrote to memory of 4468	4648	winsysdrv.exe	110
PID 4468 wrote to memory of 3180	4468	dwrvc.exe	54
PID 3568 wrote to memory of 3652	3568	ivvkz.exe	111
PID 3652 wrote to memory of 1760	3652	EGCDOOGS.exe	112
PID 3568 wrote to memory of 3744	3568	ivvkz.exe	114
PID 3180 wrote to memory of 2012	3180	Explorer.EXE
PID 3568 wrote to memory of 1044	3568	ivvkz.exe	117
PID 3568 wrote to memory of 2576	3568	ivvkz.exe	118
PID 1044 wrote to memory of 3120	1044	PRATOXER.exe	119
PID 1044 wrote to memory of 3120	1044	PRATOXER.exe	119
PID 3568 wrote to memory of 4008	3568	ivvkz.exe	122
PID 4008 wrote to memory of 4972	4008	PEUHVZCP.exe	123
PID 1044 wrote to memory of 5044	1044	PRATOXER.exe	124
PID 1044 wrote to memory of 5044	1044	PRATOXER.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2552

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:704

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Users\Admin\AppData\Local\Temp\16.exe
  "C:\Users\Admin\AppData\Local\Temp\16.exe"
  2⤵
  PID:2332

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3688

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
"C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
"C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\wcl12aii.exe
  "C:\Users\Admin\AppData\Local\Temp\wcl12aii.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3908
- - C:\ProgramData\ivvkz.exe
    "C:\ProgramData\ivvkz.exe"
    3⤵
    - Downloads MZ/PE file
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\QSKDGQRD.exe
      "C:\Users\Admin\AppData\Local\Temp\QSKDGQRD.exe"
      4⤵
      Executes dropped EXE
      PID:2692
  - - C:\Users\Admin\AppData\Local\Temp\ONCSZUFL.exe
      "C:\Users\Admin\AppData\Local\Temp\ONCSZUFL.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\LVIHHCNL.exe
      "C:\Users\Admin\AppData\Local\Temp\LVIHHCNL.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\winsysdrv.exe" /sc onlogon /rl highest /f
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1232
    - - C:\Users\Admin\AppData\Roaming\dwrvc.exe
        
        "C:\Users\Admin\AppData\Roaming\dwrvc.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\EGCDOOGS.exe
      "C:\Users\Admin\AppData\Local\Temp\EGCDOOGS.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\is-UNUH49YTC8.tmp\EGCDOOGS.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-UNUH49YTC8.tmp\EGCDOOGS.tmp" /SL5="$1002D6,4658119,905216,C:\Users\Admin\AppData\Local\Temp\EGCDOOGS.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\SWXDWYEJ.exe
      "C:\Users\Admin\AppData\Local\Temp\SWXDWYEJ.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\PRATOXER.exe
      "C:\Users\Admin\AppData\Local\Temp\PRATOXER.exe"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        5⤵
        
        PID:3120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:5044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:4004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        5⤵
        
        PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\OQQIIQMS.exe
      "C:\Users\Admin\AppData\Local\Temp\OQQIIQMS.exe"
      4⤵
      Executes dropped EXE
      PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\PEUHVZCP.exe
      "C:\Users\Admin\AppData\Local\Temp\PEUHVZCP.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
        
        "C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe"
        5⤵
        Downloads MZ/PE file
        Executes dropped EXE
        
        PID:4972
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Expand-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\10000040261\amadey_x64.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\10000040261\amadey_x64\'
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\10000040261\amadey_x64\amadey_x64.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000040261\amadey_x64\amadey_x64.exe"
        6⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\10000060101\clp1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000060101\clp1.exe"
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\10000070101\clp2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000070101\clp2.exe"
        6⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\winsysdrv.exe" /sc onlogon /rl highest /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1496
        
        C:\Users\Admin\AppData\Roaming\dwrvc.exe
        
        "C:\Users\Admin\AppData\Roaming\dwrvc.exe"
        7⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\10000180101\tkr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000180101\tkr.exe"
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\10000180101\tkr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000180101\tkr.exe"
        7⤵
        
        PID:4976
- C:\Users\Admin\AppData\Local\Temp\1wykgo2n.exe
  "C:\Users\Admin\AppData\Local\Temp\1wykgo2n.exe"
  2⤵
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\czkt582k.exe
  "C:\Users\Admin\AppData\Local\Temp\czkt582k.exe"
  2⤵
  PID:5020

C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
1⤵
- Executes dropped EXE
PID:3932

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Services\winhost.exe
1⤵
- Executes dropped EXE
PID:3344

C:\ProgramData\ivvkz.exe
C:\ProgramData\ivvkz.exe
1⤵
- Executes dropped EXE
PID:1848

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4812

C:\Users\Admin\Pictures\svchost.exe
C:\Users\Admin\Pictures\svchost.exe
1⤵
- Executes dropped EXE
PID:2876

C:\Users\Admin\AppData\Roaming\winsysdrv.exe
C:\Users\Admin\AppData\Roaming\winsysdrv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "WindowsUpdate" /tr "C:\ProgramData\winsysdrv.exe" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3544
- C:\ProgramData\dwrvc.exe
  "C:\ProgramData\dwrvc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1372

C:\ProgramData\winsysdrv.exe
C:\ProgramData\winsysdrv.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Roaming\winsysdrv.exe" /sc onlogon /rl highest /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2940
- C:\Users\Admin\AppData\Roaming\dwrvc.exe
  "C:\Users\Admin\AppData\Roaming\dwrvc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4468

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exe
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\WindowsStore.Update.exe
1⤵
- Executes dropped EXE
PID:644

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2892

C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
1⤵
- Executes dropped EXE
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3256

C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
"C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe"
1⤵
PID:5092

C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
C:\Users\Admin\AppData\Local\Temp\08e25196df\jusched.exe
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

990F0203-89D0-E69F-845B-98370C33E04F.txt

Path C:\ProgramData\990F0203-89D0-E69F-845B-98370C33E04F.txt
Size 64B
SHA256 20c02b08df48799ca09860f70c0dc2fce512be8ad079dcf0798caaba14858df8
MD5 d772e39ee9d5236baea2be92ea114b2c
SHA1 6831a71ab4d484eff4fdd60d87e068352326173b
SHA512 e645e2dd43c6b3ab664ceee0e7ef92e9aaf99c1e2d53da4ea32fd767c9feff7d863d1bdc697962c708fccdcb8f28a60ef3d617676839bfd542f493a487d09621
TLSH
T1C2A022B8802CEE0B2ECF20C2038C823003BC030A83C080E33020000CF3300880C20000
MD5 SHA1 SHA512 TLSH

Submit Download

amadey_x64.zip

Path C:\Users\Admin\AppData\Local\Temp\10000040261\amadey_x64.zip
Size 355KB
SHA256 ea40264823faac3810f68a4a57cb6c80befe79e051de7a32fce09edfc9b4ef3d
MD5 6f08c03081b552076dc428d861601235
SHA1 a1ec860f857dd40f6665049902c329ddb7165387
SHA512 651038a6223add04369c9c0ba3e14f2bd6f9597e8e595b2c2d8cdf3b9627d2df7c73d3b04d478753bf9be8ff4371451d1a0c2139e93147583a21e5d377581eb1
SSDEEP 6144:PAxUY8CWtaCQ6CdAuIHrZB/Ohh4A8sHP0a/QLk2LtsXOWYEjb/m19DxORVm:YxUY85MJEu2dZahmsHP0mQLtqOWYa7mT
TLSH
T1F474237F413050A9F0985EFA5800D428E736A6C8D88729DEFCC7559B39013FC6AB759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

amadey_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\10000040261\amadey_x64\amadey_x64.exe
Size 767KB
SHA256 2a0f053855da59b3b56812e580d7baeba59fc9493694722aa9e3f121ee3363f1
MD5 95b318d953fd939f284efe2be78fe95b
SHA1 2f3d86e77248b23ef93b7b8c2a9915b2eace5d46
SHA512 ea50556c5b612ae6058263b1a6f25690f23a16c49c6bc00651c556848aa593837555fad8127a99d1fa0eaf36340597e8e053bf0a307b03db9ad522ebd56b9124
SSDEEP 12288:cAXUMRGu4T4r7O6a9fiCVYuyxBlDetAqxSv+8:cEUPu4qy6kqsYuybX
TLSH
T1D9F49E1AF3A512FCD1BBC274CA524553EB72B8565330A69F03E14A661F336A05F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clp1.exe

Path C:\Users\Admin\AppData\Local\Temp\10000060101\clp1.exe
Size 618KB
SHA256 7ef255e94933f871003d27bc4cb063eedbb91d413f515f7daa61bad779f11d26
MD5 f1da1aa91be714e1aa491db66fb523c9
SHA1 a181c8e090d60766d6571f5e34ccbfd189a6e327
SHA512 f37a752527f1fde6b1ea1af0b0e95c62833e5b390ff07c83b36c452e6631bbdfe2187f587968805a966b5b056c61d80567ebec0d5d8ac6a5c9c5508dcf038f7d
SSDEEP 12288:x6lDnxd+Om/d94mKCd2y+u9Qe7ncZalvKE3Oc4:xobxiKCYyD9jngEJH4
TLSH
T12ED47B8FE8DF0DB2D83D11F829613999ABC90B24DB941F25736BD1338DED4684B90D89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clp2.exe

Path C:\Users\Admin\AppData\Local\Temp\10000070101\clp2.exe
Size 2.5MB
SHA256 c8ade7f7a8f1684e4ce322ebd6c3e5a1a4f1e7b0fc36a659be36f63fbfc52a6b
MD5 d1fe4ef024293edd4274be90c7da29a3
SHA1 66d4855739860c15625f5a82534cd850b93e2193
SHA512 847ae6a30311db71d92223480091332327c205c3d3ea293cec9f620fdebfe37d7cc431c83a52bb57802e851b85270369d074caf4ee5f842bf9b1493776f2d6d8
SSDEEP 24576:+Lksx0ml5c6yiHCPc/5vXL0pCC0gePvqC:kn0mZyHcWC4eN
TLSH
T1FFC5E28D775D41ACC56244B210F10A92A7B9DB16A3E85E071BC6CC788E120DDBBBDBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tkr.exe

Path C:\Users\Admin\AppData\Local\Temp\10000180101\tkr.exe
Size 21.8MB
SHA256 75a0c9bfe6df8f6f1830d99fdc9edb7e6d1fef39fa7264758f591c32e17a3ef5
MD5 aa4d0981c9c725603df937b33dd832ee
SHA1 0bb4da015b24f043b36b740cefd327fd91379f00
SHA512 e3218ebfd9847fe53c1381ae7cdc6c57ed055037039cc43ff15a8aac89d5554a2ef7f7adc05745aff2d5dfd48eff5077967d37539c73e019600b7160599df511
SSDEEP 393216:LvuzPOH9uE0pvcu1MUdq1B7GRuRxOggdHsnOTqiqJ0piWpQw4adw4:wPHJFp1MUg1wmxUgO2iy0pFmw4i
TLSH
T12037339083628F12F59EB53F54A790A1F172F8506773598F5FA802653EAF0E04D3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

409539145334

Path C:\Users\Admin\AppData\Local\Temp\409539145334
Size 113KB
SHA256 b057e2ae8e1edc6dbe774ae4b19658e4a7cdd9dea9fbe20027962b6d15df4d74
MD5 15e0452276026a55dee34e4add2624e0
SHA1 00f72a91279a3d7911fea3af9a705498d49a53f9
SHA512 67950ec6fb0a7bd51cb06694431b32fde27d00b6e7d3374f31e23c9f42e2314bd94dae537e3af69464948d06b32f5a778da3694f1520674d9bac2b4ef379f497
SSDEEP 1536:I30RFByYSuqqL+1MCC+TgyDuYtYHrExZAu2yygiqTWDQ8l/7LFwir1lNr+EnrElN:neYSz+Olu8QuxTuQuvF/1j+EY5
TLSH
T123B3555ABFD0FD8B4027A37768BF574B76177373DA2B6BA4D04F8D84122A1821916CE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EGCDOOGS.exe

Path C:\Users\Admin\AppData\Local\Temp\EGCDOOGS.exe
Size 11.6MB
SHA256 eb35e29e65134d98d2a84a140b804014fc52fe90361234e2aed8a52b593d6f7a
MD5 dd900c31b79540ccb2e585f82fa9746d
SHA1 33f7acb3a82ab87fac9c244f21ab9594f8be1dd6
SHA512 67b9c5c4e7bcc067ed0860e2f632047409c2fa205156f3604f3d87a64f9388460b047d1725c7dc0e87b5e9cb5f92e1b692ca099a058bc59ce05a36e0f85094b7
SSDEEP 98304:x5/MGN/IkkMKSVqqSiA0cQVgf8/6WnlntoRbc50lMWeY5MauqkyknKlD:r0GN/IvZ+qqZnVf6W1tGblMpFqRN
TLSH
T14AC6123BE2CB653AE3695A37F572B230453B6E11A5138C1696E0E44CCF35CB11E3E686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EmbeddedDriverService.sys

Path C:\Users\Admin\AppData\Local\Temp\EmbeddedDriverService.sys
Size 34KB
SHA256 70bcec00c215fe52779700f74e9bd669ff836f594df92381cbfb7ee0568e7a8b
MD5 485a04675df7cf40a8865706e003eb25
SHA1 711ef221526997039e804a18db9647c91680bbe2
SHA512 f4bfd8c2056ccc08012cc35a4480eea5f91f43d69872dd65e935d6224ee56eca0a017cca1d088245440a3ceeb129fc90fbef4c1a30550de08b6102a7cf526350
SSDEEP 768:fag4/W+9Nz53T+rBORCDItmhcK6OpmlQu9lcsD/9z0y:CgGzVGORWItmhcK6OpQN9lcEz0y
TLSH
T1A1F24CC072EC48C5E8AA9974E555D647AAF0F6420310D9FF46D0C1585F277C2EE3D2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LVIHHCNL.exe

Path C:\Users\Admin\AppData\Local\Temp\LVIHHCNL.exe
Size 2.5MB
SHA256 472db8d633e8a9a0c3a2d19ff44f08abdb28487664c8dbb17b013a28dc7e92ae
MD5 8714dba5fba9544a282922529d5ee3fb
SHA1 7123ea325a26a9285e8a480cceeff9059136bbc5
SHA512 00d0457e671befc9cb801684c6615c0904e636a3289a0fd806395f730afe0a2a76b13570cf6403395121152d811d05e1c482c757b7d9d2a51b2f88115fe22db9
SSDEEP 24576:pLksxMml5c6yiHCPc/5vXL0pCC0gePvqC:9nMmZyHcWC4eN
TLSH
T1F0C5E28D775D41ACC56244B210F10A92A7B9DB16A3E85E071BC6CC788E120DDBBBDBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ONCSZUFL.exe

Path C:\Users\Admin\AppData\Local\Temp\ONCSZUFL.exe
Size 251KB
SHA256 5667b25447a91885e8ce5cd3fb2f79c11d8db7f4c13eb12ebd6afec11322e933
MD5 139544af661ab3b39c076ad732e6cf49
SHA1 af50c11258826cfbda95a5384432d3f9b8611466
SHA512 cdde4f5a91b4a678e89173ccd41102c3ce7cf48b5765f5f25a549908bd6afe3215d45c58250ca0447acba3bda01d2e2e93baea5aa6c8aaeb34e504563173af66
SSDEEP 3072:WU+vyj8GlM3hjRsROFoc6QFbl4Zxznjsx1XNyyRTvzKYHy1HGL5cTfixAZh:WU2yj8yMRNsRrt2J4Zcl5vbomLa0AZ
TLSH
T109447C05B7A80CFDED7B853DC9524906DB727C560760EACF07A04A965F236E09E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OQQIIQMS.exe

Path C:\Users\Admin\AppData\Local\Temp\OQQIIQMS.exe
Size 40KB
SHA256 c2ef45750d754850b8f6d448899409379489c5c4380bcf83c4ab6f61c9e01215
MD5 fbfdd9cd005ebd2b4033086ad693cdd8
SHA1 780e14dc895da785e14c37589d7f3ba81c11c9cd
SHA512 502bd2b45e8c02172b7b0b7b4e5aebbfbbca649dfbb1c80c304bd9bbcbee707ee2552b56faf4e20404ce5d949e25479b6e7e59e654d9ae43998d6f7fbeba5b7c
SSDEEP 768:QCBpYx44vJVqtuj5QmsPJ/af9TBSUp/SV9zKXjpjbCl/3Neu79ZaBu:hom4vnqtJPJSj9yEjpClFeuxiu
TLSH
T11B033A3DA29F1186DDE28978E1E622F7E670F6877D14560F8720C41D2F62903B0DCE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PEUHVZCP.exe

Path C:\Users\Admin\AppData\Local\Temp\PEUHVZCP.exe
Size 516KB
SHA256 de05caadc10e95569a6f423f26000a6b2488e3f64f90bf15d7ea88ba45087ec0
MD5 851002f48a6dd00c41532bcc749bfd6a
SHA1 48b9c278d131df429c1aed74d7a4f20c372712e6
SHA512 ad58ff0a9dc531218905d257e2eb455c1b71aed6bbb2deccbdcbacf3dec158bc1f384c88abed8bd6719942d56070e11835828f9a8452881097f910badc897567
SSDEEP 6144:LyB4DWmxd3DH+SOe3I3qEQ1kRtFlHvNzubRDePTRBhUCaraPOlfj1ohPVL8On:Lyi5h+SU3VQ1kRDhv0ibRQnolVLN
TLSH
T1A5B44A5AA25943FDE07BA17CD9535E42F639744703B18AEF039005772E532E2AF3AB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PRATOXER.exe

Path C:\Users\Admin\AppData\Local\Temp\PRATOXER.exe
Size 767KB
SHA256 efe7eb517cc449cc7721c5c0acfb8cf454f28fdf2f37c08854aad4deefd7edc9
MD5 f87fd8891c767f0695e85728f238d33b
SHA1 84ca77ca0b27789b8236978ef3fb8cf774597555
SHA512 fa553eb7d793ca820b46131a354a35840f7bbc4050a7b2ef2cd1e182f21f305c3607e40042e3eb47529e1ca74ee724d0732dc3c50212dccb3c3065077401695a
SSDEEP 12288:TrHqQr5XgvVozsROaYzPIP17vMKrrhYyxBlDetAqxSv:nPgvVqsI0d70eVYyb
TLSH
T195F48D1EF7A612F8D0B7C274CA428952E77278465370978F03E15AAA5F372905F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QSKDGQRD.exe

Path C:\Users\Admin\AppData\Local\Temp\QSKDGQRD.exe
Size 225KB
SHA256 349f2a111f84473773c4a4a89a9761b6e9b960e0baf8389b823d7eab66c2d125
MD5 5dbbd0fcabb4370ddc60dac029a8a9e2
SHA1 665350678b54670bca5926a7e89a7e0706be0705
SHA512 445b7ea8b6c74b2ac83edb5d9b75703c75f164ebb879546d06749575a0881b35f06c3c39b06f2e89740b630e6789f37cee22596ce16c89f71341ecbfee43e2e3
SSDEEP 3072:5QcTIZOCgxewOocm4Uw+BGIUkHTmrWph2Pe4Kh62FgFeOWXeTLnZz8EN9lDtx:5QcTjheXjmK8yrWpAKhhvOjHJx
TLSH
T193345B4673E924F9E1778278C9A54A46E772F8620730ABDF07A0425A1F233D1AD3DB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWXDWYEJ.exe

Path C:\Users\Admin\AppData\Local\Temp\SWXDWYEJ.exe
Size 232KB
SHA256 f87238a50db54c9cfb0b32dcc448d8574ea8bf7c996c8252d72dbc08532ba130
MD5 5cbac8108792e6517885d1f3be36f2f0
SHA1 e9d99a6a1d8d7ab6c699a05f7929902d700d8119
SHA512 8b425d6141d48e803da888a5b7ff67e58e0e5fa80372c691b5810c418e1d74e9f0d8f3d0c1d98bb109a260368dfcb5bae3e4ef9f842ba89b58c913b07c6e0ba8
SSDEEP 6144:30WoKA+vzDrCztaMC0u6qe9+TYqqJzLBixFBheYc:kyzDrGqE+TYp5LBN
TLSH
T13E34D057B7E434F8D57B4278C8216A06E777B43607609BAF036083662F236E15D3EBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SvcHostAnalyzer.exe

Path C:\Users\Admin\AppData\Local\Temp\SvcHostAnalyzer.exe
Size 147KB
SHA256 5847e5335818953dfb13c349a7f1b530c5a75a0ff671b471b5e6d8f9b55b23e8
MD5 a641a6184845dfbbb5f0fff2e3a059f2
SHA1 01d66a8288c5c7078c0f8b75aae610a40ac5585a
SHA512 b22568b179f3be8e9149c3960ca151383ad64f50c0a6f519dc2574e81d4f0711dbf972e961f4aec32b0941257e4f085992582bb62fa7de62de956eea5173818d
SSDEEP 3072:nkHTmrWph2Pe4Kh62FgFeOWXehLnZz8EN9lDt:gyrWpAKhhvORHJ
TLSH
T157E35A4363E920E9F1778678C9A58A46E771B83207209BEF07E0465A4F237D1ED3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinSysKdrv.exe

Path C:\Users\Admin\AppData\Local\Temp\WinSysKdrv.exe
Size 147KB
SHA256 b47a2609a644adee63f9425c7539dd51e963733e7390e4cad667e1985baba2aa
MD5 ee32c790c506bc8faeac05590a1472a5
SHA1 e69a156811756c2af3c18dd12f7a1daa278b4a18
SHA512 6512ef88fa238fcfa6512469159f8c2e71d2fd901bffa084ba4803a70ff0325a26da547850fbc71445537cc4b5d78e28df5516b400d2c8c56770136d4000a692
SSDEEP 3072:HkHTmrWph2Pe4Kh62FgFeOWXeTLnZz8EN9lDt:AyrWpAKhhvOjHJ
TLSH
T15EE35A4363E920E9F1778678C9A58A46E771B83207209BEF07E0465A4F237D1ED3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinUpdateHelper.exe

Path C:\Users\Admin\AppData\Local\Temp\WinUpdateHelper.exe
Size 41KB
SHA256 58a1b5140163c685f143e6e19864c25603b9ba81937c08586652e87e5e1b9117
MD5 a6eb58c97b7e165d191d1bff9250f793
SHA1 d9d8e1306adc314933814215b44c28d4195062b8
SHA512 ca69ae2b64f7c235f33350b25b32fa8e19b57a8a8591ae5f71cce4bf50078c74e6a0b04d856b76efddb9b465546a0f94478ea5dbd503cf6bd7822d36150256b7
SSDEEP 768:DXM/YSZcW52SaXvfkk+r4LknXuRJjAVPfG8TVROWb4D7ZZy1xyG:ra1cW522k+rosXgjwMbPbOyG
TLSH
T18213291E62DF428EDB23A174EFF12B33F574F682611C06AF43A0C5596F6B111A614F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_dk1gsozm.0fr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dk1gsozm.0fr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-NTXJGV1I1Q.tmp\_isetup\_isdecmp.dll
Size 34KB
SHA256 31d04c1e4bfdfa34704c142fa98f80c0a3076e4b312d6ada57c4be9d9c7dcf26
MD5 c6ae924ad02500284f7e4efa11fa7cfc
SHA1 2a7770b473b0a7dc9a331d017297ff5af400fed8
SHA512 f321e4820b39d1642fc43bf1055471a323edcc0c4cbd3ddd5ad26a7b28c4fb9fc4e57c00ae7819a4f45a3e0bb9c7baa0ba19c3ceedacf38b911cdf625aa7ddae
SSDEEP 768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
TLSH
T11EF23AA1BDED1F53DA8A0A3056C994235C31E1D44B0008F7D5D9CA672A8E3A75FB329F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EGCDOOGS.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-UNUH49YTC8.tmp\EGCDOOGS.tmp
Size 4.2MB
SHA256 9ad6e0b378dd93244a5257a1a0ce49e61049e58fd3a14cf06dfd05855a1e90eb
MD5 11afcdcfe2b4f98f9a947fcfca649452
SHA1 a1d194d63cb20bf8e925f3f36c8a464890c9a471
SHA512 63e98d56487993b1cb9e1500069c800559a6c91197c3cd99b4f1792920e6b758ef4c20bca9ea64691c7aade70ab453e15a5b9fb134ec6ac6627435d05220998c
SSDEEP 98304:+3U5HY/KwjoYY1j48UWm2eTMFdC+Jh3339:X4/1jorPmEV
TLSH
T15C166D03F389653EE5571A3B883FB290983F7E213A16CD4B6BF4095C8E399416D2A753
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsruntime12989.tmp

Path C:\Users\Admin\AppData\Local\Temp\vsruntime12989.tmp
Size 109KB
SHA256 10aabdd53dcf9afc1d987fbb5079e05c3856e1b5480e4df4d762f052cf35ba56
MD5 15529588a11ece6e02d28aaf5d875b0d
SHA1 28d395be90b326c63111eeb5fc24457ccbf6f9ab
SHA512 f7ae54db243586650e2af660be0b6f94d3f99af6dae7e2ad51ec620e25739553827f1681172c2d81d5aa5b48f8cb4438f927a44764060a7102937b8b3e830eb1
SSDEEP 1536:KDUYUvkWsLfGbpbFFCgVJ1QsSagU6wLvTDoSPJssWVd09dlbcRsh:QjUvkJLfG9bFkgBQsp6wLvTUSP0M9ca
TLSH
T135B36C5BB3E400BFE4768674C9634906D77678120B61DBAF13A082A92F737D19D3AF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wcl12aii.exe

Path C:\Users\Admin\AppData\Local\Temp\wcl12aii.exe
Size 165KB
SHA256 5c35e40a72e8d6e59045ea8ba951ba61aea55cdf133b93c61830a8a6f8376620
MD5 40c2bfb087d7077a65818d9965981089
SHA1 8e9e7bf09228633b8b9171e211749fda8ff89113
SHA512 ac23a97226bd76287a4acd62ab1e05d252f7c07e4027ad10641925d4223b588fe5b24e0c97cb0c21c8bb62ee9204b39fb1739dca70eebd34123bc77b4e6fb468
SSDEEP 3072:nVWeDmfnP+SMIwTjAGrN3ooK26D76NbQ4SZOr+AFk+ZqK5vYKe:9mfnP+S9wT8GrWzH6+4S8+vbw
TLSH
T163F34D0B336460F4E1779279CDA25A46E7B2787A17B1634E437443BA5F332919E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dwrvc.exe

Path C:\Users\Admin\AppData\Roaming\dwrvc.exe
Size 2.4MB
SHA256 4e56d256bcc125a7e5dc7f46c28c36347ea0d67cfefdab63b2e7dd6433ceb1ff
MD5 58a12c00541b1f50e0c10add58c17da0
SHA1 31112f7899b5047dce851931a859103718dadac3
SHA512 47843ffb4d058a30dcaf4fb58903c926281af76035ad977a6ec63c19da2e3563b86cfb8c5be4d5adbe667a0bf1fe35701ea2ea5503f61ff7f346d6788fa8bdcf
SSDEEP 12288:BGuYsl4wcxOSKyiG//87gRgYafcCxlNv//8G0pDdly8ECd9EgenPvq:Uml5c6yiHCPc/5vXL0pCC0gePvq
TLSH
T196C5D18D775D41ACC55244B210F10A92A7B9DB16A3E85E071BC6CCB88E120DDBBBDBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1372-149-0x00007FF7A3C60000-0x00007FF7A3EDA000-memory.dmp

Download

memory/1392-347-0x00007FF668640000-0x00007FF6688BA000-memory.dmp

Download

memory/1760-321-0x0000000000480000-0x00000000008C6000-memory.dmp

Download

memory/1760-256-0x0000000000480000-0x00000000008C6000-memory.dmp

Download

memory/2164-135-0x00007FF7150E0000-0x00007FF71535A000-memory.dmp

Download

memory/2212-283-0x000001DF72130000-0x000001DF72142000-memory.dmp

Download

memory/2212-267-0x000001DF71DB0000-0x000001DF71DD2000-memory.dmp

Download

memory/2212-284-0x000001DF72050000-0x000001DF7205A000-memory.dmp

Download

memory/2212-282-0x000001DF72130000-0x000001DF7213A000-memory.dmp

Download

memory/2212-281-0x000001DF72070000-0x000001DF72123000-memory.dmp

Download

memory/2212-280-0x000001DF72050000-0x000001DF7206C000-memory.dmp

Download

memory/2552-13-0x00000255963A0000-0x00000255963A3000-memory.dmp

Download

memory/2576-227-0x00007FFF3B960000-0x00007FFF3BB69000-memory.dmp

Download

memory/3180-24-0x0000000003530000-0x0000000003537000-memory.dmp

Download

memory/3180-32-0x0000000003640000-0x0000000003641000-memory.dmp

Download

memory/3180-151-0x0000000003480000-0x0000000003481000-memory.dmp

Download

memory/3180-346-0x00007FF668640000-0x00007FF6688BB000-memory.dmp

Download

memory/3180-134-0x00007FF7150E0000-0x00007FF71535B000-memory.dmp

Download

memory/3180-81-0x0000000003470000-0x0000000003471000-memory.dmp

Download

memory/3180-113-0x0000000003440000-0x0000000003441000-memory.dmp

Download

memory/3180-164-0x00007FF698C30000-0x00007FF698EAB000-memory.dmp

Download

memory/3180-136-0x0000000003460000-0x0000000003461000-memory.dmp

Download

memory/3180-148-0x00007FF7A3C60000-0x00007FF7A3EDB000-memory.dmp

Download

memory/3180-31-0x00000000035B0000-0x00000000035B1000-memory.dmp

Download

memory/3180-204-0x0000000003490000-0x0000000003491000-memory.dmp

Download

memory/3344-38-0x00007FFF3B960000-0x00007FFF3BB69000-memory.dmp

Download

memory/3652-255-0x0000000000920000-0x0000000000A0C000-memory.dmp

Download

memory/3652-178-0x0000000000920000-0x0000000000A0C000-memory.dmp

Download

memory/3688-681-0x0000000140000000-0x0000000140044000-memory.dmp

Download

memory/4468-165-0x00007FF698C30000-0x00007FF698EAA000-memory.dmp

Download

memory/5116-9-0x00007FFF3B960000-0x00007FFF3BB69000-memory.dmp

Download